The legal question is not simply what AI regulation exists.

When a company uses artificial intelligence to sell, recommend, contract, provide customer service, personalize, classify, make decisions or communicate with consumers, the legal issue does not begin or end with whether there is a regulation specifically called “AI regulation.”

The fundamental question is whether the company is complying with the body of law already applicable to the particular activity: consumer rights, contractual obligations, disclosure duties, data protection, advertising, competition, intellectual property, liability, security, sector-specific requirements, administrative and judicial procedures, and other applicable legal rules and principles.

Valid self-regulation does not mean self-regulation without limits

A company may develop internal policies, controls, approval procedures, risk matrices, human-supervision protocols and criteria for using AI. All of these can be useful. But internal rules do not replace the law.

From the Protsumer perspective, corporate self-regulation can only be considered legally valid when it remains within the applicable legal framework and helps make that framework effective in reality.

Therefore, an internal policy authorizing conduct prohibited by law does not make that conduct lawful. An internal policy limiting rights recognized by law cannot displace those rights. And an internal procedure that ignores a legal duty does not eliminate that duty.

The issue is not simply about adding more regulation

A central position of the Protsumer approach is that the practical challenge of commercial AI is not solved merely by accumulating new rules. There is also a capability problem: knowing how to identify the relevant body of law, understand how its elements interact, determine which rights and duties are involved, and turn them into concrete decisions.

Therefore, when facing a new commercial use of AI, the first question for a legal team should be what law already applies and how it must be complied with in the concrete situation.

This does not mean that new regulation can never be necessary. It means that the existence or absence of technology-specific regulation does not eliminate the legal obligations that already govern the business activity and the relationship with consumers.

Example 01 — AI recommends products to consumers

A platform uses AI to recommend products based on each consumer’s digital behavior. The system identifies patterns and presents personalized offers.

The legal analysis should not be limited to asking whether a specific rule authorizes or prohibits “using AI to recommend products.” The legal team needs to examine, among other things, what information the system uses, what is communicated to the consumer, how commercial terms are presented, whether personalization may create misleading practices, what data processing occurs, what segmentation criteria are used, and what rights the consumer may exercise.

Legally valid self-regulation can then translate into internal rules concerning data use, campaign review, transparency, legal approval of certain uses, decision documentation and mechanisms for correcting practices that create undue legal risk.

Example 02 — AI generates consumer advertising

A company uses generative AI to create thousands of advertising variants directed at different consumer segments. The system may produce different messages depending on the user’s profile, timing or behavior.

The legal challenge is not merely to determine whether the tool is technically secure. The legal team must be capable of determining which commercial claims are permissible, what information must be substantiated, what rules apply to promotions, how misleading communications can be avoided and what controls are needed before content reaches consumers.

A human-review policy, a library of approved claims, evidence standards, limits on certain commercial promises and correction procedures can constitute valid legal self-regulation when they are designed to effectively comply with applicable law.

Example 03 — AI makes decisions affecting consumers

Suppose a company uses an automated system to classify requests, prioritize customer service, determine certain commercial conditions or identify transactions requiring additional review.

The relevant legal question is not simply whether the algorithm “works.” The team must identify what decision it produces, what consequences it has, what information it uses, what rights may be affected, what explanations or review mechanisms may be required, what controls exist and how a legally problematic decision can be corrected.

Here, valid self-regulation requires translating legal rights and duties into decision architecture: use criteria, approval levels, human review where appropriate, documentation, complaint mechanisms, correction and learning.

Example 04 — A commercial AI chatbot interacts with consumers

A company implements an AI assistant that answers consumer questions, explains products, receives requests and guides users toward particular decisions.

If the system provides incorrect information, omits a relevant condition, misunderstands a request or promises something the company cannot deliver, the legal issue does not disappear because the answer was generated by a machine.

The legal team must define what the system may answer, which matters must be escalated to a person, what information must remain current, how responses are controlled, how incidents are recorded and how errors affecting consumers are corrected.

The real difficulty: complying with the whole through the whole

In practice, the most sophisticated legal challenge is often not finding an isolated rule. It is determining how the body of law must be applied to a concrete technological and commercial situation.

A single AI system may simultaneously involve consumer rights, business duties, personal data, contracting, advertising, intellectual property, liability and sector-specific regulation. The legal team needs to connect those elements into one operational legal response.

Legal freedom as the foundation of self-regulation

Business activity exists within a space of legal freedom. That freedom allows companies to create products, provide services, use technologies, innovate and interact with consumers, but it does not eliminate the limits established by the legal order.

From the Protsumer perspective, legally self-regulating AI means managing that space: identifying what may be done, what must be done, what may not be done and what conditions must be satisfied for a particular activity to be legally viable.

Valid self-regulation is therefore a way of exercising legal freedom consistently with consumer rights and the company’s legal duties.

Preventively and correctively: the complete lifecycle

Legal capability concerning commercial AI must operate before, during and after a risk situation.

Why legal teams are decisive

Valid legal self-regulation cannot depend only on technology, formal compliance or corporate documents. It requires professional legal capability.

In-house legal teams need to translate law into product, technology, marketing, operations, contracting and consumer-service decisions. Law-firm legal teams need to analyze these new scenarios and help clients develop legally viable solutions. Authorities, from a different institutional perspective, need the capability to understand how existing law applies to new forms of commercial and technological activity.

The common question is the same: legal teams must not only know the rules. They need the capability to apply them correctly to real, complex and changing situations.

Protsumer: developing the capability that makes law work in reality

Protsumer starts from a practical premise: legal knowledge creates professional value when it becomes collective capability to make decisions and act lawfully.

For this reason, the Protsumer Model is not simply about studying AI or accumulating regulatory information. It develops teams’ capability to understand the whole of the applicable law, identify rights and duties, analyze scenarios, determine limits, build legally viable alternatives, manage risk, resolve disputes and learn from experience.

This capability can be developed within in-house legal teams, law-firm legal teams and, from a different institutional perspective, legal teams within authorities that must apply law to new commercial and technological realities.