Andrey Voronin is an AI lawyer and digital counsel for companies that build or buy artificial intelligence. He advises founders, general counsel, and product teams on EU AI Act compliance, AI governance, GDPR for AI systems, training-data IP, and contracts that have to survive a buyer, an investor, or a regulator.
He was born in Moscow in November 1981 and graduated in Jurisprudence from the Moscow City Institute of Management. Independent practice began in late 2007. By 2026 that is more than eighteen years of legal work, shifting from commercial disputes into Data, IT, Fintech, Web3, and AI product counsel.
The practice is built for teams who ship models, not memos. He works in the language of a data scientist and a product owner: pre-trained versus fine-tuned models, weights, transformer stacks, prompts, logs, embeddings, and vendor APIs. The question is never only “is this legal.” It is who owns the dataset, who is the provider or the deployer, which risk class applies under the Artificial Intelligence Act, and what evidence the file must hold.
Core work as an AI attorney, AI legal counsel, and AI compliance lawyer:
• EU AI Act risk classification (prohibited, high-risk, limited, minimal) and general-purpose AI / GPAI overlay
• AI governance frameworks, internal AI policy, shadow-AI rules, human oversight
• GDPR for AI: DPIA, lawful basis for training data, prompt and log retention, cross-border transfers
• Generative AI legal advice: output ownership, labeling, hallucination liability
• Model and dataset IP, contractor assignment, open-source license map
• AI vendor MSA, DPA, and AI addendum review
• Investor diligence on AI assets before Seed and Series A
• High-risk AI documentation outlines and Annex IV evidence checklists
Matters published on ai-lawyer.tech include EU AI Act claim defense without a fine, synthetic-data rights before a funding round, enterprise AI acceptable-use policies, and generative-content copyright disputes closed without trial.
He is the author of the 2016 book on consumer rights in technically complex goods. That early work on devices and software defects is the base of the current practice as legal counsel for AI startups. Engagements run from a fixed classification sprint to a six-month AI risk retainer. Delivery in English.
Work Terms
How we work
Most mandates run remotely. The Moscow and Budva offices are used when a closing, a bank, or a regulator needs someone on the ground. English is the working language for international files.
What to send
Short product description, user flow, data types, model and vendor list (OpenAI, Anthropic, own weights, fine-tunes). Existing terms, DPA, and privacy notice if you have them. Do not send source code or datasets until a confidentiality term is in place.
Delivery
Fixed-price packs where the output is defined: EU AI Act classification report, AI policy pack, vendor redline, GDPR-for-AI DPIA, governance framework, investor AI diligence file. Standard sprints: 4–20 business days. A 45-minute walkthrough call is included on classification work. Multi-market or high-risk systems are quoted after a short strategy session.
Fees
Platform gigs and sprints are quoted in USD and fixed in the statement of work. Larger retainers follow the signed contract. Foreign clients may pay through a foreign entity. Extra hours on a retainer are billed only after written approval.
Not included unless booked separately
Official EU database filings, notified-body conformity assessment, courtroom advocacy in a third country, or a full Annex IV technical file.
Confidentiality
Client code, training data, and financials stay inside the file. We decline work that would conflict with an active mandate.
Response
Active file: two business days. Retainer clients get a named lawyer and a note when the EU AI Act, GDPR, or related AI rules move.