Artificial intelligence has become a business enablement catalyst and enterprise risk at the same time. Companies are using AI to support decisions involving employment, credit, safety, critical infrastructure, healthcare, customer engagement, workforce productivity, and core operations. To deploy AI responsibly at scale, organizations need governance programs that identify AI use, assess risk, assign accountability, support adoption, and create documentation that can withstand regulatory, customer, investor, and board scrutiny.
Baker Botts helps clients design, implement, and mature practical AI governance programs that enable responsible AI adoption while managing legal, regulatory, privacy, cybersecurity, employment, consumer protection, and operational risk. We help clients integrate AI governance, privacy, and cybersecurity into a coordinated framework rather than disconnected compliance programs.
Our AI governance work combines technical fluency with deep experience in privacy, cybersecurity, regulated industries, and corporate governance. We help clients prepare for AI adoption, enable responsible deployment, and defend governance decisions when challenged. This includes aligning programs with leading frameworks and requirements, including the NIST AI Risk Management Framework, the EU AI Act, U.S. state AI laws, and sector-specific regulation.
Baker Botts has a particular focus advising organizations that deploy AI in operational, safety-sensitive, and highly regulated environments. These systems can affect critical infrastructure, physical operations, workforce safety, environmental compliance, customer outcomes, and core business functions. We design governance programs for organizations whose AI systems must be reliable, explainable, secure, and defensible under operational and regulatory scrutiny.
What We Do
AI Governance Program Design and Implementation
We help clients design, implement, and mature AI governance programs that fit their business, risk profile, and regulatory footprint. Our work includes governance charters, policies, procedures, accountability structures, committee design, implementation guides, escalation pathways, training, reporting, documentation standards, and program controls. We also help clients translate leading risk management frameworks, including the NIST AI RMF and ISO standards, into governance structures that can be implemented across legal, compliance, cybersecurity, technical, and business teams.
Enterprise AI Adoption and Workforce Enablement
We help clients manage enterprise AI adoption by developing acceptable use policies, employee guidance, AI literacy programs, intake and approval workflows, and controls for generative AI, productivity tools, and business-unit AI deployments. This work helps organizations reduce shadow AI risk while giving employees practical rules for using AI tools safely, consistently, and in alignment with company policy.
AI Governance Assessments and Program Maturity Reviews
We help organizations evaluate the maturity and defensibility of existing AI governance programs. Our assessments identify gaps in policies, inventories, accountability structures, risk classification, documentation, human oversight, monitoring, vendor governance, and incident response. We then provide practical recommendations and prioritized roadmaps that help clients move from ad hoc AI use to a scalable governance model.
AI System Inventory, Risk Assessment, and Classification
A defensible AI governance program starts with knowing what AI systems the organization uses, how those systems operate, what data they rely on, and what decisions they make or influence. We help clients conduct AI inventories, map AI use cases, classify systems by risk, assess gaps against applicable requirements, and prioritize remediation based on legal, operational, reputational, and enforcement risk.
AI Risk Management Frameworks and Controls
We advise clients on practical implementation of AI risk management controls, including risk tiering, impact assessment, testing and validation, human oversight, monitoring, transparency, cybersecurity, data governance, incident escalation, and model change management. Our work helps organizations convert framework concepts into operating controls that support AI adoption, risk reduction, regulatory readiness, and defensible decision-making.
AI Regulatory Compliance
We counsel clients on AI-specific and adjacent regulatory obligations, including the EU AI Act, U.S. state AI governance laws, sector-specific rules, privacy and cybersecurity requirements, employment and consumer protection laws, and public company disclosure obligations. Our work includes regulatory scoping, compliance roadmaps, high-risk AI documentation, conformity assessment readiness, impact assessments, transparency obligations, monitoring, and incident reporting.
AI Vendor and Third-Party Risk Management
Most organizations deploy AI through vendor tools, embedded software, cloud platforms, and third-party models. We help clients assess vendor AI risk, update procurement workflows, review and negotiate AI-related contract terms, obtain documentation and audit rights, allocate responsibility for system failures, and build third-party governance processes that support regulatory and operational accountability.
Board and Executive AI Governance Advisory
We advise boards and executive teams on AI oversight structures that integrate with enterprise risk management, compliance reporting, cybersecurity governance, disclosure controls, and management accountability. Our work includes board education, reporting frameworks, committee oversight, escalation protocols, disclosure preparedness, and documentation practices that demonstrate meaningful AI oversight without turning the board into a technical review body.
AI Incident Response, Investigations, and Regulatory Defense
When AI systems fail, the issue may quickly become a regulatory, litigation, disclosure, privacy, cybersecurity, employment, consumer protection, or board governance matter. We help clients investigate AI-related incidents, assess legal exposure, preserve and evaluate technical documentation, manage regulator inquiries, coordinate incident response, and defend governance decisions when AI outputs or system behavior are challenged.
Industries We Serve
Baker Botts advises organizations deploying AI in critical infrastructure, industrial operations, safety-sensitive environments, healthcare, workforce management, customer-facing systems, financial decision-making, enterprise operations, and vendor-enabled platforms. Our lawyers help clients address the governance, privacy, cybersecurity, regulatory, and operational risks associated with AI use across energy, industrial and manufacturing, transportation and logistics, technology, life sciences and healthcare, financial services, and consumer-facing businesses. Because AI governance obligations often intersect with existing regulatory frameworks, we work closely with regulatory, privacy, cybersecurity, environmental, energy, employment, life sciences, and corporate governance practitioners across the firm to provide integrated advice tailored to each client’s industry, use cases, and risk profile.
Key Contacts
Samir A. Bhavsar | Partner | Privacy, Cybersecurity & AI Governance | Dallas | AIGP · CIPP/US · CIPP/E Samir leads Baker Botts' AI governance advisory practice. He advises organizations on enterprise AI governance, AI risk management, acceptable-use and deployment frameworks, board governance, regulatory compliance, and AI incident response. Drawing on a technical background in electrical engineering and computer science, Samir works with legal, compliance, cybersecurity, operational, and technical teams to design governance programs for AI systems operating in highly regulated and mission-critical environments.
Matthew R. Baker | Partner | Chair, Privacy, Cybersecurity & AI Governance | San Francisco | CIPM · CIPP/US · CIPP/E Matt leads Baker Botts' AI governance, data privacy and cybersecurity practice, bringing deep expertise in global privacy compliance — GDPR, CCPA, and the full spectrum of international data protection frameworks — that forms the regulatory foundation for AI governance programs operating across jurisdictions. His practice covers data governance strategy, privacy regulatory compliance, cyber incident response, and the privacy dimensions of AI system design and deployment.
