Artificial Intelligence

We work alongside companies and organisations that deploy artificial intelligence systems in complying with the applicable European and Italian legislation. We tailor the service to the Client’s sector, considering the needs behind the use of each system.
We start from a mapping of the AI applications already in use or planned, analysing their compliance and classifying their risk level under the AI Act.
On this basis we identify and implement the compliance obligations connected with adopting the systems, defining procedures, roles and internal safeguards designed to ensure a responsible, transparent and safe use of AI. We pay close attention to the operational sustainability of our proposals, supporting the Client from the initial assessment through to the full and informed integration of the systems into business processes and operating models.

We work alongside the Client, with the support of an integrated legal and technical/IT team, in designing artificial intelligence systems that comply with the requirements of the AI Act from the outset (compliance by design). For a provider of AI systems — especially high-risk ones — acting at the design stage prevents critical issues, contains later remediation costs and speeds up the path to market.
The service starts from the classification of the system’s risk level and the identification of the applicable requirements, which we then translate into concrete design choices: data quality and data governance, transparency and traceability logic, human oversight measures and robustness and cybersecurity safeguards. We also assist the Client in preparing the technical documentation and instructions for use required by the legislation.
From the earliest stages we combine legal and IT expertise, in order to design systems that are not only AI Act-compliant but also trustworthy, sustainable and consistent with business objectives and with the constant evolution of the European and national regulatory framework.

We work alongside the Client in negotiating and drafting contracts with providers of artificial intelligence solutions, calibrating the protections on the role the Company takes on under the AI Act (Provider or Deployer).
We prepare the key clauses of the agreement — AI Act compliance declarations, allocation of liability between the parties, service levels, zero data retention commitments and rules on the use of data — and take care of the interplay with personal data protection rules. For high-risk systems and general-purpose AI models we carry out pre-contractual due diligence, checking the documentation, warranties and safeguards offered by the provider.
We complete the service with the classification of the systems already in use and the preparation of any contractual addenda needed to bring agreements up to date. Our approach is to build a contractual framework that protects the Client along the entire AI supply chain, covering liability, compliance and operational continuity.
.

We work alongside Digital Health companies and Deployers in complying jointly with the AI Act and the Medical Device Regulation (MDR) as they apply to medical devices and software based on artificial intelligence.
The service starts from the correct qualification of the product — as a medical device and, at the same time, as an AI system that is often high-risk — to manage the two conformity assessment procedures in a coordinated way and avoid duplication. We assist the Client in aligning the technical and clinical documentation, defining human oversight and risk management measures and obtaining the CE marking of the system. We also handle the contractual arrangements with developers, suppliers and healthcare facilities, allocating liability and obligations along the chain.
We aim to provide strategic advice combining regulatory, healthcare and technology expertise, supporting the product from design through to placing on the market and post-market surveillance.

We assist the Client in identifying and implementing the obligations that the AI Act lays down for high-risk artificial intelligence systems. The first step is the correct qualification of the Company’s role — Provider or Deployer — from which different, specific obligations follow.
On this basis we map the applicable requirements: risk management system, data governance, technical documentation and log retention, transparency towards users, human oversight, accuracy, robustness and cybersecurity. We then support the Client in the practical implementation of these obligations, defining procedures, organisational safeguards and control tools integrated into business processes, as well as in keeping the documentation needed to demonstrate compliance.
We build a practical, tailor-made path that turns regulatory obligations into measures that are genuinely workable and verifiable, reducing the risk of sanctions and strengthening the trustworthiness of the AI systems adopted or placed on the market.

We advise on the definition of governance models for developing and adopting artificial intelligence within the company. A clear organisational framework is now essential to manage the lifecycle of AI systems consistently and to demonstrate a responsible use of the technology.
The service includes preparing internal procedures, policies and codes of ethics setting out the key rules and fundamental principles to follow — transparency, non-discrimination, human oversight, security and data protection — as well as identifying roles, responsibilities and control and approval flows. We also take care of integrating AI governance with the management systems the Client has already adopted, from data protection to 231 compliance and cybersecurity.
The added value is a concrete, sustainable governance model, calibrated to the organisation’s complexity, that supports technological innovation while preserving trust, reputation and consistency with company values.

We work alongside the Client in adopting artificial intelligence solutions in the workplace, an area where technology directly affects workers’ rights and employers’ obligations. The service includes support in implementing the obligations that Italian legislation attaches to the use of AI in employment relationships — from recruitment to the management and organisation of work — and in applying the guidance in the guidelines adopted by the Italian Labour Ministry of Labour.
We analyse the tools used, assess their impact on workers and define the information, transparency and non-discrimination obligations, coordinating everything with personal data protection rules and with the legislation on the remote monitoring of workers. Our aim is to enable the Client to seize the opportunities AI offers in managing human resources, while safeguarding regulatory compliance and the protection of the people involved.

We provide legal support in carrying out the impact assessments required for artificial intelligence systems: the fundamental rights impact assessment (FRIA) and the data protection impact assessment (DPIA under Article 35 GDPR), with particular reference to high-risk systems. The service starts from an analysis of the system and of the processing involved, in order to identify and weigh the risks to people’s rights and freedoms and define the technical and organisational mitigation measures, such as stateless architectures, human-in-the-loop mechanisms and security safeguards.
The deliverable is a rigorous analysis, combining legal and technical expertise, that allows the Client to adopt AI systems in an informed, documented and compliant way, aiming to prevent objections from the supervisory authorities.

We work alongside providers of high-risk artificial intelligence systems in the conformity assessment process and in the CE marking of systems required by the AI Act. The service starts from the verification of the requirements applicable to the system and the choice of the relevant conformity assessment procedure, distinguishing between internal control and the involvement of a notified body. We assist the Client in preparing and updating the technical documentation, drafting the EU declaration of conformity and handling the steps connected with affixing the CE marking and registering the system in the European database. We also coordinate with any other conformity procedures applicable to the product, to avoid duplication. The added value is hands-on support throughout the entire path to market, combining regulatory and technical expertise and allowing providers to place high-risk AI systems on the market in a compliant, traceable and timely way.

We provide legal support in complying with the transparency obligations that the AI Act lays down for artificial intelligence systems intended to interact with users and the public. Where needed, we start by mapping the systems used and how they interact with people, to identify the specific information obligations that apply. We prepare the notices informing users that they are interacting with an AI system, the procedures for labelling artificially generated or manipulated content — in particular so-called deepfakes and synthetic content — and the safeguards for marking the related outputs.
We also define the internal procedures that ensure clear, accessible and timely information, coordinating them with the transparency obligations arising from personal data protection rules. The result is a consistent, documented transparency framework that strengthens users’ trust and allows the Client to demonstrate compliance with the information obligations imposed by the legislation.

We assist importers and distributors of artificial intelligence systems in complying with the specific obligations that the AI Act places on them along the supply chain. The service includes verifying that the systems placed or made available on the market are accompanied by the proper conformity assessment, the CE marking and the required documentation and instructions for use, as well as by the provider’s details. We define the procedures for handling non-compliance, assisting the Client with the necessary corrective actions — withdrawals and recalls of systems from the market — and with the communications and notifications due to the provider, distributors and competent authorities.
We also handle the contractual arrangements with the other operators in the chain, preventing liability and protecting the business continuity of importers and distributors.

We work alongside the Client in taking part in the regulatory sandboxes provided for by the AI Act — controlled testing environments in which innovative artificial intelligence systems can be developed, tested and validated under the supervision of the competent authority. The service starts from assessing the project’s eligibility and preparing the application documentation and then supports the Client throughout the entire testing path. We handle the dialogue with the supervisory authority, the definition of the sandbox plan and compliance with the conditions and safeguards imposed by the regime, with particular attention to personal data protection and risk management. At the end, we support the Client in making the most of the results obtained and the evidence gathered for the subsequent conformity assessment and placing on the market. We are committed to turning participation in the sandbox into a competitive advantage for the Client, combining innovation, lower regulatory risk and legal certainty

In managing its day-to-day activities, every company runs into a range of ordinary legal issues that often call for multidisciplinary input — with higher management costs and a greater dispersion of energies, which inevitably affect how quickly action can be taken. This is the scenario the Legal Desk service offered by netforLegaL is designed for. It is a multidisciplinary legal assistance and advisory service whose availability and, above all, speed the Client can always count on. The service meets the need to outsource the handling of legal issues in less complex business contexts and can also be a valuable support to the in-house legal department in more structured organisations.
The involvement of a pool of senior professionals — organised by area of specialisation — allows the Client to capitalise on the advisory experience gained, ensuring constant regulatory updates in its sector. The multidisciplinary approach also delivers attractive economies of scale.

Our areas of work include:

• Support in adopting and using artificial intelligence solutions compliantly;
• Contract assistance with developers, suppliers and integrators of AI systems;
• Definition of AI governance and ethical principles;
• Transparency and information obligations for AI systems;
• Impact assessments on AI systems (FRIA and DPIA);
  AI literacy and staff training;
• Support with compliance with the EU Artificial Intelligence Regulation.

For each Client the service involves a “contact lawyer”, who coordinates the work and has an ongoing relationship with the company. The presence of this figure brings:

• A stronger relationship of trust with the Client;
• The progressive personalisation of the service, as knowledge of the company context steadily grows;
• The guarantee of a constant legal presence, which also plays a proactive role towards the Client.

As for how the service is offered, the methodology is that of a typical help desk: maximum freedom and flexibility for the Client to set upfront an annual budget for the initiative, to make the most of its economies of scale.
The expected result is to turn what has perhaps been perceived until now as the cost of regulatory compliance into an insurance policy — or an investment — in the peace of mind of doing things properly.

We work alongside the Client in complying with the AI literacy and ongoing training obligations laid down by the AI Act.
We design training sessions for company staff on best practices for the ethical and lawful implementation of AI technologies, on their legal implications and on the related risks and compliance obligations, keeping people up to date and ensuring adequate oversight of AI within the company. Programmes are graded by the participants’ level of responsibility and built around practical cases and up-to-date regulatory references. We also deliver training programmes for the professional categories that the legislation identifies as priority recipients — including teachers, healthcare professionals and self-employed professionals — with content calibrated to their operating contexts.
Our training is designed to offer both a general grounding in the principles of the legislation and more specific, technical and operational content, tailored to the Client’s sector and to any special regulations that apply. As part of our ongoing advisory work, we also deliver dedicated training sessions on the correct use and implementation of the documentation and procedures adopted.
All our learning services are modulated and adapted to the specific needs of the Client and can be delivered both in class and at distance; timing, duration and recipients of such sessions are always defined in advance and agreed upon with the Client, with the possibility to arrange single sessions for personnel with specific duties and competences within the company.
We furthermore offer drafting of learning materials (e.g. awareness raising materials, simulations of possible scenarios with fictional characters, legal text easily accessible via hypertext) which can also be uploaded into e-learning platforms including animations, sounds, multiple answers questions and randomized answers.
We also offer a range of “ready-to-go” solutions, thanks to a consolidated collaboration with our technological partner Mediamed Interactive, which allows us to offer to our Clients a product based on the more evolved and widespread training platforms, so that our Clients can enjoy both standard sessions or more tailored sessions.