Artificial intelligence has become a common tool across companies. From human resources departments to customer service, marketing, financial analysis, or process automation, more and more organizations are incorporating AI-based solutions into their day-to-day operations. However, many are doing so without adequately assessing the legal risks involved.
That warning comes from Lawesome, the Bilbao-based law firm specializing in business advisory. As one of its areas of expertise is the anticipation and preventive management of business disputes, understanding that a fundamental part of legal work is to identify risks before they turn into crises, Lawesome warns of a growing gap between the speed of AI adoption and the actual capacity of companies to manage the legal obligations arising from its use.
“The problem isn’t merely developing or buying AI tools. The problem is that many companies are already using them without being fully aware of the regulatory, liability, and supervisory implications they carry,” explains Martin Eguia, Managing Partner at Lawesome.
The progressive entry into force of the European Regulation on Artificial Intelligence (AI Act) will mark a turning point in this area. Although the regulation has begun to unfold, it will be August 2026 when most of its main obligations for companies and organizations using AI systems in Europe come into effect.
Many companies use AI without realizing it
One of the main risks, Lawesome notes, is that many organizations believe they are not using artificial intelligence when, in fact, it is already integrated into the software they use daily: HR platforms, scoring systems, productivity tools, automated assistants, CRMs, or data analytics solutions.
“The use of AI is not limited to grand technological developments. It is often embedded in third-party tools and activated almost invisibly within the company’s internal processes,” notes Martin Eguia.
According to the AI Act, certain uses of artificial intelligence will be deemed “high risk”, particularly those related to decisions that directly affect people, such as personnel selection processes, access to credit, customer evaluation, or the provision of certain services.
In these cases, companies must comply with specific obligations of human oversight, traceability, technical documentation, and risk assessment.
Economic and reputational risk
Non-compliance with certain obligations under the Regulation can lead to substantial economic penalties, which in the most severe cases could reach up to 7% of a company’s global annual revenue.
However, Lawesome emphasizes that the main challenge is not only economic, but also reputational and operational.“When an automated decision causes harm—for example, a rejected candidate or a denied customer—the question won’t be what the algorithm did, but who supervised that decision and how it can be explained,” they note.
In this context, the firm believes that companies should start treating AI not only as a technological or efficiency issue but as a matter of corporate governance and regulatory compliance.
Martín Eguia’s approach rests on a clear conviction: “the best way to resolve problems is to anticipate them with preventive measures.” That’s why he recommends that companies begin identifying which AI systems they currently use, assess their legal impact, and establish internal supervision and control protocols as soon as possible.
The question is no longer whether a company uses artificial intelligence. The real question is whether it is prepared to explain how it uses it and who assumes responsibility when something goes wrong.
