AI Law Practice

Geason Law Offices works with one industry and nothing else. Every engagement we take is with a company whose product, data or revenue depends on artificial intelligence — model developers, application and agent platforms, AI hardware makers, and the investors backing them. That focus is not a positioning statement. It decides how we read a rule, what we ask for in diligence, and which risks we tell a founder to accept and which to repair before the next financing round.

Read by stage, not by subject

The legal questions an AI company faces change with its stage. The same company at seed stage cares about founders’ agreements and IP ownership; at Series A it cares whether its training data survives diligence; when it expands overseas it cares about the contracting entity and cross-border data; when it is acquired it cares whether the chain of title closes. Filing, litigation and contracts are how law firms organise themselves. Stage is the order in which companies actually meet these problems.

The stages are not sealed off. What one stage leaves on paper decides what the next stage can negotiate. An ownership clause in a founders’ agreement can shape a financing valuation three years later; the underlying records from a filing can decide whether an acquisition closes on schedule.

One industry chain, three layers of risk

The legal questions change as you move up the chain.

Foundation layer — compute, models, training data. Exposure starts before there is a product: where the training data came from, whether the licence actually covers model training, whether a large model has completed filing and security assessment, and who carries liability when a base model is fine-tuned by a downstream customer.

Application layer — tools, agents, generated content. Here filing obligations, content labelling, personal information processing and platform responsibility converge. A product that generates content is regulated differently from one that executes tasks on a user’s behalf, and the boundary between the two is still moving.

Terminal layer — devices, robots, embodied systems. Data collection moves to the device, product-safety rules run in parallel with data rules, and the centre of liability shifts toward defects and warnings.

Two cross-cutting workstreams run through all three layers: going global into the EU, the United States and Southeast Asia, and financing or exit, where compliance defects turn into repricing items in diligence.

What we handle

The 30 services are grouped into five business blocks covering formation through exit, with a separate cross-cutting dispute resolution line for handling and loss control once a dispute exists. The full list sits on our services overview.

Formation and operations — Incorporation, Founder Agreements and Equity Structure, Equity Incentives and Option Pool, Commercial Contracts, Employment, Tax.

Intellectual property and data — IP Protection, Overseas IP, Trade Secrets and Non-Compete, Data Compliance, Cybersecurity Multi-Level Protection, Cross-Border Data Transfer.

Compliance and filing — Business Licensing, Algorithm Filing and LLM Registration, AI Content Labelling, Regulatory Investigations and Criminal Risk.

Cross-border and going global — EU AI Act, US and Southeast Asia Regulation, Export Controls, Offshore Structure and Red-Chip Reorganisation, Overseas Employment, Overseas Tax.

Financing, M&A and exit — Equity Financing, Debt Financing, M&A and Equity Exit, IPO and Capital Markets.

Dispute resolution (cross-cutting) — Commercial Disputes and Litigation/Arbitration, AI Infringement and Unfair Competition Response. A dispute can arise at any point, so these sit outside the blocks as a cross-cutting line.

Compliance and filing is one block among five. It matters, but it is not the whole practice: at almost any point between incorporation and exit, an AI company is more likely to meet an equity, contract or tax question first.

Where the rules are moving

Chinese regulation of AI has moved from framework to routine enforcement over the past two years. Algorithm and generative AI filing now arrives in batches with a predictable rhythm, and the practical question is no longer whether to file but how to keep the filing consistent with a product that keeps changing — a pattern visible across the CAC’s successive deep synthesis filing batches.

Content labelling has crossed the same threshold. With the AI content labelling measures in force, the regulator has begun disposing of accounts and services for missing marks, which means labelling is now an enforcement surface rather than a drafting exercise — see the crackdown on unlabelled AI content.

On the data side, the direction is toward documented assessment. Important data processors face annual risk assessment, and cross-border transfers require an export assessment or filing that matches the data actually leaving — see our analysis of the network data security risk assessment measures and the CAC data export Q&A.

For companies selling into Europe, the EU AI Act adds a second timeline on top of the Chinese one. Running both is a scheduling problem as much as a legal one: the same product change can trigger a Chinese filing update and an EU conformity step at different moments.

How we work

We start with the product, not the statute. A first engagement usually begins with a short technical walkthrough — architecture, data flows, model provenance, deployment geography — followed by a written assessment that separates what must be fixed now, what can wait for the next release, and what is simply a business risk the founder should price in. Where a filing is involved, we prepare the submission and the underlying records together, on the assumption that the regulator may ask for either.

For a first conversation, see contact. For background on the firm, see about Geason Law Offices.