This opportunity was posted more than 30 days ago and no application deadline was provided. You can explore active listings below.

Counsel, Privacy and AI Regulation (EU) C

Organising Institution / Firm

Cohere

Not Specified by Organiser

European Union (Remote-friendly; Offices in London, Paris, Berlin, etc.)

Not Specified

Qualified lawyer in at least one EU member state (German admission preferred); 4+ years legal experience (law firm + in-house at enterprise software company preferred); Deep expertise in EU AI Act, GDPR, DSA, and digital platform regulation; Proven track record managing regulatory risk and building compliance programs; Strong understanding of AI/ML technologies, product lifecycles, and data governance; Ability to translate complex legal concepts into actionable guidance for engineering and product teams.

Full-time Job

Full Opportunity Brief Navigating the Frontier: Why the Cohere Counsel Role Defines the Future of AI Law in Europe The legal profession is undergoing a seismic shift. For decades, the archetype of a technology lawyer involved negotiating software licenses or managing data processing addendums. Today, the frontier has moved. The posting for

Counsel, Privacy and AI Regulation (EU)

at

Cohere —a leader in security-first enterprise AI is not merely a vacancy; it is a blueprint for the next generation of legal practice. With the EU AI Act transitioning from legislative text to enforceable reality, the demand for lawyers who can translate "high-risk" classifications into engineering sprints has exploded. This role sits precisely at that intersection, offering a rare chance to build the compliance architecture for foundation models that power general enterprises.

Insight:





This is not a "privacy counsel" role retrofitted for AI. It is a dedicated AI Regulation mandate. The distinction signals that Cohere treats regulatory strategy as a core product differentiator, not a back-office cost center.

Deconstructing the Mandate: Beyond GDPR into the Algorithmic Accountability Era The job description reveals a scope that extends far beyond traditional DPO (Data Protection Officer) duties. The successful candidate will "convert complex legal requirements and industry standards into actionable technical and operational requirements." This phrasing is deliberate. It implies a daily workflow where you sit with ML engineers and product managers to dissect model training data provenance, evaluate systemic risk under Article 55 of the AI Act, and draft technical documentation for conformity assessments before a model hits the API endpoint.

You are expected to liaison with EU digital regulatory authorities and participate in consultations. This is public policy work embedded inside a product company. For a lawyer trained in the adversarial or transactional trenches, this represents a pivot to regulatory engineering—a skill set currently commanding a massive premium in the London, Paris, and Berlin markets.

The "Trust-by-Design" Imperative Cohere’s framing—"shape the future of trust-by-design for enterprise AI solutions"—is the operational keyword.



Enterprise buyers (banks, healthcare, government) cannot adopt generative AI without verifiable compliance artifacts: Model Cards, Data Sheets, Fundamental Rights Impact Assessments (FRIA), and Third-Party Conformity Assessment certificates. Your output in this role becomes the sales enablement collateral for a multi-billion dollar valuation. That is tangible career capital.

Profile of the Ideal Candidate: The Hybrid Technologist-Lawyer The eligibility criteria are surgically specific. Admission in an EU member state is non-negotiable; German admission is "preferred" likely because Berlin is a key office hub and Germany’s regulatory interpretation (via the BKartA and state DPAs) often sets the tone for EU enforcement. The 4+ year PQE requirement with a blend of law firm rigor and in-house pragmatism suggests they need someone who can draft a watertight DPA (Data Processing Agreement) on Monday and debate tokenization strategies with researchers on Tuesday.

Hard Law Expertise:

EU AI Act (Risk tiers, GPAI obligations, Conformity Assessment), GDPR (Art. 25 By Design, Art. 35 DPIA, Schrems II transfer mechanisms), DSA (VLOP obligations, systemic risk auditing).

Technical Fluency:

Understanding of RAG (Retrieval-Augmented Generation), fine-tuning vs. pre-training data liabilities, model inversion attacks, and differential privacy.

Operational Muscle:

Building compliance programs from zero-to-one (workflows, risk registers, automated monitoring), not just maintaining existing ones.

Stakeholder Translation:

The ability to tell a VP of Engineering "No, we cannot ship this feature without a FRIA" in a way that preserves the relationship

📌 Counsel, Privacy and AI Regulation (Madrid)
🏢 Cohere
📍 Madrid