Counsel for the companies building intelligence and for the capital behind them. Venture financings and M&A, model and data licensing, IP ownership, and a governance posture for rules that are still being written, run by a partner who knows where the next problem comes from.
Firm facts · ReachA corporate and private-capital boutique with international reach: a principal office in Chicago, a second office in Oakbrook Terrace, offices in London and Dubai through partner firms, meeting locations by appointment in seven further US cities, and a partner network across ~51 jurisdictions on five continents. Founded 2013.
A model trained with more than 1025 floating-point operations is presumed under the EU AI Act to carry systemic risk, and every general-purpose model placed on the EU market since 2 August 2025 must carry technical documentation, a copyright policy and a public summary of its training data. An AI company's legal position is a chain of specifics: who wrote the code and what they signed, where each dataset came from and on what terms, and what the customer contract promises about output.
The weak link is usually a document. An assignment in which a contractor "will assign" inventions transfers nothing until a second signature; one that "hereby assigns" transfers title today. The US Copyright Office registers only the human-authored parts of a work made with AI, so output may be protected by contract and by nothing else.
We advise AI companies and the investors behind them from formation through financing and sale. The licenses, the customer paper and the governance file are drafted to be read by a buyer's counsel and a regulator, with registered patent counsel and locally admitted counsel brought in where needed.
Clean ownership of the model and the code, which means assignment discipline from every founder and contractor, careful handling of open-source weights and frameworks, and an IP position that follows how the system is actually made. We coordinate with registered patent or other IP counsel where a matter requires it.
The data supply chain an AI product runs on, covering inbound and outbound licensing, web-scraped, customer, and third-party data, and representations and indemnities that say only what the company can honestly stand behind.
Company-, founder-, and investor-side support across SAFEs, convertible notes, priced rounds, and buy- and sell-side M&A, from the term sheet and deal documents through the IP, data, and model diligence an AI transaction turns on.
Customer agreements, terms of service, and data-processing terms that allocate accuracy, reliance, output-ownership, and indemnity risk, carry the revenue, and survive a customer's diligence.
A governance posture that can adapt as the EU AI Act, US sectoral and state rules, and the frameworks emerging in the UK and UAE harden. We advise on these matters and coordinate with locally admitted counsel where a jurisdiction requires it.
Privacy and security obligations where users sit in the United States, the United Kingdom, the European Union, or the Gulf, coordinated with entity and group structuring so data, IP, and revenue move cleanly across the borders AI companies cross early.
The prohibitions have applied since 2 February 2025 and the general-purpose model duties since 2 August 2025. The high-risk obligations follow on a timetable the Commission has already proposed to stretch, and the fine for a prohibited practice runs to 7 percent of worldwide turnover. The compliance plan needs a date column that can move.
Training on personal data in the EU needs a lawful basis, and the regulators' 2024 opinion allows legitimate interest only on a documented three-step test. A scraped corpus carries the website terms it was taken under, and the AI Act's training-content summary now puts the sources in public. A provenance register answers all three.
The Copyright Office registers only the human-authored parts of a work made with AI, a prompt alone makes no one an author, and a patent needs a natural person as inventor. What a customer owns in its output is whatever the agreement assigns and the confidentiality clause protects, so the agreement should say it.
A model license that caps commercial use at a number of monthly users, or forbids using the outputs to train a competitor, is the first term a buyer's counsel reads. A copyleft library can oblige disclosure of the company's code when the service runs over a network. Both surface in week one.
The FTC has brought deception cases over AI capability claims since 2024 under Section 5 of its founding Act, and an Illinois company that collects a face template without a written release answers under the state's 2008 biometric statute, which carries a private right of action. Neither waited for an AI law.
The AI Act applies to a provider outside the Union whenever the system's output is used inside it, and a non-EU provider of a general-purpose model must appoint an authorized representative there. A US company with EU users already owes one under the GDPR. Two mailboxes in Europe, before a single European sale.
Before anything is promised, we reconstruct the stack's chain of title: every founder and contractor assignment, every open-source weight and framework license, and every dataset traced to where it came from and what rights actually came with it. The gaps get closed while they are still cheap.
Inbound data licenses, outbound model terms, and customer contracts are papered as one system: what the company may train on, what it may promise, and who owns the output. Each representation and indemnity is sized to what the provenance audit proved rather than to what a sales cycle wants to hear.
The product is mapped against the rules that already reach it: the EU AI Act's risk tiers, US sectoral and state regimes, and the privacy law that applied before any AI statute. Then a governance file is built that can absorb the frameworks still being written without re-architecting the company.
A financing or exit sends the other side's counsel into the model, the data supply chain, and the IP position. Because the file was built for this moment, diligence confirms rather than discovers, and the questions that kill AI deals were answered quarters ago, on the company's terms.
In AI, the model is the company, and the company is only worth what its chain of title can prove.
Three files a buyer or a regulator will ask for. The first is the chain of title: a present-tense invention assignment from every founder, employee and contractor, and a list of every open-source weight and library with its license. The second is the data provenance register, recording where each training set came from, under what terms and on what lawful basis, which is also what the EU AI Act's training-content summary is written from. The third is the customer paper, allocating accuracy, reliance and output ownership in terms the provenance register can support. We build the three together, because a change in one moves the other two.
The model and the code belong to whoever holds the assignments, and an assignment that says a contractor "will assign" is a promise, not a transfer, until a second document is signed. The weights themselves are protected mainly as trade secrets, so access controls and confidentiality terms are part of the title. The output is different. The US Copyright Office registers only the human-authored portion of a work made with AI, a prompt alone does not make the user an author, and a patent needs a natural person named as inventor. A customer's rights in output are therefore what the contract gives it, and we draft that clause to say exactly that, coordinating with registered patent counsel where a filing is in view.
We start with a register: each dataset, its source, the license or terms it came under, whether it contains personal data and, if so, the lawful basis for training on it. Scraped data carries the website terms it was taken under, customer data is limited by the processing terms the customer signed, and licensed data is limited by its field of use. The register then sizes the outbound promises. A representation that the training data was lawfully obtained is drafted to match what the register proves, and an indemnity for infringement claims is capped and carved to the same facts. The same register answers the EU AI Act's public training-content summary.
The European Union has a statute in force. Its prohibitions have applied since 2 February 2025, its general-purpose model duties since 2 August 2025, and its high-risk obligations follow on a timetable the Commission has already proposed to adjust. The United States has no federal AI statute; the FTC polices AI claims under Section 5, several states have enacted their own AI and automated-decision laws, and privacy and biometric statutes already reach training data. The United Kingdom has so far left AI to its sector regulators, and the UAE's rules run through federal strategy and free-zone rulebooks. We map the product against each regime it touches and engage locally admitted counsel where a filing is required.
Hart David Carson LLP acts for companies, founders, and investors across SAFEs, convertible notes, priced rounds, and buy- and sell-side M&A, handling the term sheet, the financing and deal documents, and the IP, data, and model diligence an AI deal turns on. A partner runs the matter, so the people negotiating your terms are the people who understand how your technology is built and where its value and its risk sit.
Yes. The borders arrive before the revenue does: the EU AI Act applies to a provider outside the Union whenever its system's output is used inside it, a non-EU provider of a general-purpose model must appoint an authorized representative there, and a US company with EU users already owes one under the GDPR. We handle the US structure and contracts from Chicago, work through partner firms in London and Dubai, and engage locally admitted counsel from a partner network of about 51 jurisdictions where a filing or a representative is required.
The software foundation AI is built on, with venture financings and M&A, IP and licensing, data and privacy, and equity compensation for the companies building the platforms.
Explore →The other regulatory frontier still being drawn, with token, exchange, fund, and compliance strategy for on-chain ventures and the institutions financing them.
Explore →Where AI meets a regulated field, in health-tech, data, and the legal questions forming around models in medicine and human optimization.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.