Head of AI and Technology Risk

• Demonstrable experience in risk, ideally within a law firm or professional services environment.
• Demonstrated experience in technology risk, AI governance, or digital transformation risk.
• A strong understanding of:
  • Confidentiality obligations
  • Existing and emerging AI regulatory frameworks
  • Legal sector obligations and professional standards
• Working knowledge of relevant security and AI governance frameworks, including ISO 27001, NIST, ISO 42001 or the NIST AI RMF.
• Proven ability to partner with senior technology stakeholders.
• Excellent judgment with a commercial and pragmatic approach to risk.
• Strong communication skills with experience advising senior leadership.

• Experience working directly with AI tools, automation programs, or legal tech platforms.
• Knowledge of frameworks such as ISO 27001, NIST, or similar.
• Experience in third-party/vendor risk management.
• Legal or regulatory background (e.g. lawyer, compliance officer) is advantageous.
   

From your first day with us, you will have varied opportunities to continuously grow and develop your skills and knowledge. From formal training, informal coaching and mentoring through to skills-based and technical training and on the job learning.

Hybrid working

This role follows our 'balanced' hybrid working approach and as long as business needs allow, you will be supported to work in a hybrid way in line with the hybrid working policy.

What we offer including our broad range of benefits and working environment

When you join Clifford Chance, you will have access to a broad range of benefits to support you across many aspects of your personal and professional life including financial, wellbeing, lifestyle, and family friendly benefits. For more information on what we offer specifically in the UK, please visit our What We Offer page on our career site. 

The role

We are seeking a senior risk professional to be an independent advisor within our Risk & Compliance function to lead in advising the firm on Technology, AI and Innovation Risk. This role will lead the assessment, governance, and ongoing management of risks and regulatory requirements arising from the firm’s use of emerging technologies, including artificial intelligence (AI), automation, and digital innovation.

The successful candidate will combine strong regulatory and risk expertise with commercial pragmatism and a deep understanding of technology risk in a professional services or legal environment.

• Lead the firm’s approach to identifying, assessing, and mitigating risks associated with new and emerging technologies, including AI tools and platforms.
• Develop and maintain a Technology and AI Risk Framework, aligned to legal sector regulatory expectations and industry best practice.
• Advise senior stakeholders (including CIO, CTO, Innovation teams, and partners) on risk, regulatory and reputational implications of technology adoption.
• Collaborate closely with key stakeholders to ensure that AI Risk oversight complements and supports the firm's information security, data privacy and enterprise risk management frameworks.
• Ensure alignment with firm-wide risk appetite and governance standards.

• Design and implement policies covering responsible AI use, that embed and reflect the firm's compliance policies including:
  • Confidentiality
  • Model risk and explainability
  • Bias and ethical considerations
  • Client confidentiality, professional conduct obligations and legal privilege risks
  • AI security threats (e.g. prompt injection, data poisoning, model and data exfiltration), adversarial testing / AI red-teaming, model inventory and validation
  • Establish approval, review, detection and containment processes for AI tools (including generative AI), covering sanctioned tools and unsanctioned “shadow AI” use in collaboration with IT Risk & Security.
• Establish approval and review processes for AI tools (including generative AI).
• Working with the General Counsel team, ensure appropriate client disclosures where required, including in relation to Outside Counsel Guidelines and client-specific security and AI-use requirements.

• Monitor and interpret global regulatory developments relating to:
  • AI regulation (e.g. EU AI Act and equivalents)
  • Legal sector obligations and professional standards
  • NIS2 / DORA and equivalent operational resilience or cybersecurity regimes where in scope
  • Client-jurisdiction AI, data and security regimes applicable to firm operations or client requirements
• Translate regulatory requirements into actionable internal policies and controls.

• Conduct and advise on risk assessments, as appropriate, for new systems, vendors, and technology deployments.
• Collaborate with IT on:
  • Regulatory and client-obligation mapping for third-party and technology risk
  • Control-adequacy challenge and policy sign-off for information security controls
  • Regulatory notification, AI-incident handling, client disclosure and privilege considerations in incident response
• Ensure risks are documented, tracked, and reported through appropriate governance forums.

• Provide regular reporting to the Executive Risk Committee and Board-level stakeholders on technology and AI risk exposure.
• Maintain risk registers and key risk indicators (KRIs) relating to technology and innovation integrated with the firm’s enterprise and information security risk registers.
   

Your experience