Apocalyptic AI is keeping law firms busy: these are the most common legal enquiries
The rapid advance of artificial intelligence poses a growing challenge for legal advice, with increasingly complex enquiries focusing on the risks associated with the decisions made by these systems, their governance and regulatory compliance. Juan Carlos Guerrero, an IT partner at ECIJA, points out that there is currently no standalone civil liability regime in the EU specifically designed for AI, following the formal withdrawal of the proposed Directive on liability in the field of artificial intelligence in October 2025. He therefore emphasises that the contractual allocation of risks and the application of general and sector-specific liability regimes take on even greater importance when determining, in the event of an incident, which part of the liability lies with the provider and which with the user company.
In this context, ECIJA also anticipates that AI-related issues will play a more prominent role in corporate transactions, such as initial public offerings, acquisitions or mergers. Guerrero anticipates that, if due diligence reveals a significant AI-related contingency linked to regulatory compliance, the ownership of training data or governance frameworks, this may ultimately have an impact on the valuation, the transaction timetable or the contractual guarantees, with an increasing prevalence of representations and warranties, specific indemnities and conditions relating to AI compliance.
On the regulatory challenge, Guerrero believes that the European regulatory framework is likely to mature: “Europe continues to have the most comprehensive regulatory framework, but we are seeing attempts to reconcile the protection of rights and security with the need for obligations to be practicable and not to stifle innovation.” The ECIJA partner points out that the Digital Omnibus Act on AI, adopted in July, has deferred the obligations under the Artificial Intelligence Regulation (AIR) for high-risk systems until December 2027, and until August 2028 for certain AI integrated into regulated products.
The report also highlights the lessons learnt from the first attack involving autonomous AI in Spain, following the Spanish Data Protection Agency’s (AEPD) receipt of the first notification of a data breach caused by an attack carried out autonomously by an artificial intelligence model. Juan Carlos Guerrero of ECIJA points out that, legally speaking, this incident does not change the rules: the security and breach management obligations set out in Articles 32, 33 and 34 of the General Data Protection Regulation (GDPR) remain the same. “What has changed significantly is the risk landscape,” he emphasises.
ECIJA’s IT partner warns that it is no longer possible to view AI solely as a tool for improving corporate processes; rather, it must also be seen as a technology capable of automating and accelerating a cyberattack: “An agent can analyse an environment, identify vulnerabilities and adapt its behaviour at a speed far exceeding an organisation’s capacity to react manually.” This observation forms part of a broader context in which law firms agree on the need for multidisciplinary teams capable of combining data protection, intellectual property, competition law, employment law and financial regulation with a deep understanding of the underlying technology.
Read the full article in Cinco Días