Founding Legal Counsel

Academic Key; Amsterdam; Hybrid; EUR 90,000 - 150,000; Full time

Job summary

Deeploy seeks a founding Legal Counsel to interpret the EU AI Act and related regimes, turning obligations into actionable product and process requirements. You will own data privacy, AI policy, and the company's compliance posture while collaborating with product and engineering on governance matters.

You will lead enterprise contracting with customers, manage risk, and support the business in a fast-paced startup environment, reporting to the COO.

Qualifications

• Legal education and bar admission preferred.
• Ability to translate regulation into product and policy actions.
• Comfort working with product, engineering, and sales teams.

Responsibilities

• Interpret EU AI Act, GDPR, DORA and related standards for product and contracts.
• Lead enterprise contracting: master agreements, SaaS terms, NDAs.
• Own data privacy, AI policy, and compliance program.
• Manage ISO 42001/27001 audits and documentation.

Skills

Regulatory interpretation

Contract negotiation

Cross-functional collaboration

English proficiency

Education

Law degree

Tools

ISO 27001

EU AI Act

Job description

Founding Legal Counsel At Deeploy, we help organisations roll out AI they can trust. The rules for trustworthy AI are being written right now, and most of them are still ambiguous. As our first legal hire, you'll be the person who reads the regulation, decides what it means in practice, and builds that judgment into both our product and our company. This is not a back-office contracts seat. At an AI governance company, legal judgment sits close to the product and to every enterprise deal. You'll report to the COO and work closely with the wider C-level, who stay actively involved and hold end responsibility in their areas. You drive the legal function day to day, you're not left to carry it alone. Why Deeploy? AI is being rolled out everywhere, but most of it is a black box. Deeploy exists to change that. We build the technical foundation that makes AI responsible: helping companies detect, understand, and prevent the harms caused by misaligned AI systems before they impact the real world. We're an AI-native team. That means we don't just build for AI, we aim to be a frontrunner in our own work. We're constantly rethinking how we operate, and we expect everyone on the team to be part of that evolution. What you will do Regulation into practice (the core of the role) Track and interpret the EU AI Act and the regimes around it (GDPR, DORA, sectoral rules, ISO standards, NIST frameworks), and turn obligations into concrete product and process implications. Form clear, defensible positions where official guidance is thin, working with external partners where it helps. Feed that interpretation into the roadmap, so our product reflects how the regulation actually lands. Commercial contracts Own enterprise contracting together with sales: master agreements, SaaS terms, SLAs, data processing agreements, partner and referral agreements, and NDAs. Support deal velocity with large, regulated customers without dropping rigour. Risk, privacy and certifications Own our data, privacy and AI policy and the compliance behind it. Identify, mitigate and document our own cyber, AI and privacy risks. Lead the annual ISO 42001 and ISO 27001 audits and own the management-system documentation, partnering with security and engineering on the technical controls. Thought leadership and go-to-market Help shape posts, talks and material aimed at legal and compliance audiences, strengthening our standing with that crowd. Act as a credible domain voice for prospects' and customers' legal teams, explaining how the regulation works and how Deeploy fits, supporting their decision without becoming their counsel. Strategic matters Work alongside C-level as in-house counsel on the bigger annual topics: funding, EU programmes and grants, investor and board matters, drawing on outside counsel where it's warranted. Who we're looking for This role sits at an unusual intersection: sharp enough to form a defensible view on regulation that barely has precedent, practical enough to get an enterprise contract over the line, together with the team, in a startup environment. Must-haves 4-8 years of legal experience, ideally gained in or alongside tech. Experience in the tech sector, working with startups, scaleups or in another way working in a tech environment. Technically literate and comfortable working directly with product and engineering, to shape our product and it supports our customers. A genuine interest in AI and its risk landscape (privacy, cyber, AI governance), beyond \"just\" using the AI tools. Strong on novel regulation: able to read something ambiguous and form a clear, defensible position, also without every standard yet published. Comfortable owning several workstreams at once as the first and only lawyer, with C-level actively involved and backing you. Ready to step into a startup, trading structure and certainty for ownership and pace. You're enterpreneurial, take ownership and focus on results. A solid legal background; the exact qualification matters less than the capability. Working proficiency in English, Dutch is a plus. Nice-to-haves Experience in a startup or fast-paced scale-up. Familiarity with the EU AI Act and adjecent regulation. Experience running ISO 42001 / 27001 or comparable certification programmes. What this role is, and what it is not It is a builder role. You create the legal function, you don't maintain one that already exists. Legal currently sits with founders and some external support from law firms. It is broad and hands-on, with regulatory interpretation first and commercial contracts a close second. It is not a pure contracts seat, and not a compliance-checklist role. It is not outside counsel for our customers. You support our product and go-to-market as a domain expert. You report to the COO and sit close to every part of the business, with C-level holding end responsibility in their domains (commercial with the CEO, product with the CTO, certification with the CTO and COO, risk with the CEO and COO). Wha