AI and SaaS counsel for Silicon Valley
Counsel for the companies building what’s next.
Outside general counsel to the AI and SaaS companies building in Silicon Valley and beyond.
Liam J. Penwell is a California-licensed attorney who serves as outside general counsel and product counsel to AI and SaaS companies across Silicon Valley and nationally. He has worked at law firms, in-house at a global investment adviser, and in private practice. He advises on product, privacy, AI governance, regulatory compliance and generative AI. He negotiates the MSAs, DPAs and security terms that close enterprise contracts, and turns each negotiated outcome into templates, playbooks and fallback positions for sales and deal teams. He works directly with founders on product and business decisions where the governing law is unsettled, and builds each decision into the product’s design and contract terms. As the founder of his own companies, he has owned and licensed intellectual property for two decades, and he delivers senior counsel on a startup’s timeline. He lectures and writes on AI, intellectual property and technology regulation.
Get in Touch
Practice areas for AI and SaaS companies.
Outside General Counsel for Startups
Most early-stage companies have no lawyer on staff. Penwell Law serves as standing outside general counsel to AI and SaaS founders and their teams. The practice works embedded with product, engineering and sales, reviews features and go-to-market plans at the design stage, and states the trade-offs with each risk recommendation. The work covers customer and vendor contracts, privacy, the AI governance documentation enterprise buyers request, security terms and incident response, and equity and the first raise, for companies with U.S. and international customers. Recurring matters become standard forms and self-serve guidance for the business team.
SaaS Contracts, MSAs & DPAs
A startup’s revenue contracts set its liability, data and IP exposure for years after signature. Penwell Law drafts and negotiates SaaS and platform terms, API and data-licensing provisions, work-for-hire and content-rights agreements, and the MSAs, order forms, and security and data terms that unlock enterprise sales. Penwell Law also serves as first-line counsel to product and engineering teams, translating legal requirements into product guidance. For consumer AI products, the work includes output-reliance disclaimers, acceptable-use policies, age-gating and non-affiliation language.
Privacy & Data Protection
For an AI company, the hard privacy questions concern what the model was trained on and what the company can defend before a regulator. Penwell Law treats privacy as a product question and handles data mapping, data processing agreements, consent and notice frameworks and DPIAs under CCPA/CPRA, GDPR and U.S. state privacy statutes, and cross-border transfer mechanics under the GDPR. For machine-learning products, the work extends to training and inference data: provenance of training sets, secondary-use limits, and automated decision-making and profiling obligations under the California Privacy Protection Agency’s regulations and other state laws.
AI Governance & Regulatory
AI companies now meet regulation that did not exist three years ago, and enterprise buyers and investors ask for governance documentation before they sign or invest. Penwell Law prepares AI use policies, model and vendor risk assessments, and audit-ready documentation mapped to the NIST AI Risk Management Framework and ISO/IEC 42001. The work covers EU AI Act risk classification and general-purpose AI obligations, U.S. state AI and transparency statutes, and FTC consumer-protection exposure for AI claims. In California, it covers the AI Transparency Act (SB 942, as amended by AB 853) and its provenance and disclosure duties, AB 2013’s training-data disclosures for generative AI, and the California Privacy Protection Agency’s automated decision-making regulations.
Generative AI, Training Data & IP
Copyright questions that once belonged to entertainment law now arise in building AI products. Penwell Law advises generative AI companies on fair-use analysis for model training, training data licensing and catalog licensing, ownership of model outputs, and synthetic-voice and digital-replica questions under state right-of-publicity statutes. Enforcement work covers content provenance, infringement exposure, DMCA Section 512 notice-and-takedown strategy, and the cease-and-desist and settlement work that resolves disputes before litigation. Penwell Law reviews web scraping programs source by source before they run, against robots.txt, site terms, the Computer Fraud and Abuse Act and California Penal Code section 502, and documents each dataset’s chain of custody for buyer diligence.
Corporate, Equity & Fundraising
Entity formation, founder vesting, the option plan and the 83(b) election come first in a company’s life. Each is costly to change later. Penwell Law handles formation and governance, board consents and minutes, equity grants and the cap table, SAFEs, convertible notes and priced rounds with their investor rights, investor side letters, and the securities questions of a first raise. Penwell Law builds the data room before diligence begins, so a missing consent does not delay a term sheet. At SoftBank Investment Advisers, Liam J. Penwell cleared investments and divestments to close under the Investment Advisers Act, Securities Act, Exchange Act, Dodd-Frank and UK Financial Conduct Authority rules.
Deal-side compliance counsel at SoftBank Investment Advisers, adviser to the $100 billion+ Vision Funds under SEC and UK FCA regulation, clearing investments in the world’s leading technology companies to close.
Biography
Liam J. Penwell
Founder and Managing Attorney, Penwell Law. Burlingame, California.
Liam J. Penwell advises AI and SaaS companies in Silicon Valley as outside general counsel, commercial, and product counsel, taking on the legal work a software company generates from its first customer to enterprise scale. The center of the practice is commercial contracting: master services agreements, order forms, data processing agreements, cloud and SaaS subscriptions, and vendor and procurement contracts, negotiated against enterprise buyers’ paper and then converted into templates, playbooks and escalation paths so a sales team closes routine deals without escalation to legal.
On the AI side of the practice, he counsels on the questions a product raises before its first enterprise contract: what data a model may lawfully train on and under what license, who owns model output, how output reliance and third-party rights are allocated in consumer terms. This includes what an enterprise buyer’s AI addendum may demand in no-training commitments, sub-processor disclosures and indemnities for AI features. He advises on AI governance under the NIST AI Risk Management Framework and ISO/IEC 42001, on the EU AI Act as compliance exposure for California companies selling into Europe, on FTC Act Section 5 as applied to AI claims, and on California’s AI statutes, including the AI Transparency Act (SB 942, as amended by AB 853) and the training-data disclosure requirements of AB 2013. In investment diligence he has evaluated the data and model policies and responsible-AI practices of AI companies for legal and regulatory risk. His privacy work runs from privacy-by-design review, data protection impact assessments under the GDPR and risk assessments under the California Privacy Protection Agency’s 2026 regulations, through CCPA/CPRA and GDPR compliance programs, data processing agreements, and incident response under Civil Code section 1798.82.
His intellectual property practice covers copyright and technology licensing, content-licensing and partnership agreements and work-for-hire terms; open-source and third-party license compliance for code, model weights and datasets; trademark clearance and enforcement under the Lanham Act; trade-secret protection under the California Uniform Trade Secrets Act and the Defend Trade Secrets Act; and DMCA notice-and-takedown and repeat-infringer programs for platforms hosting user content. He has resolved copyright claims brought by national rights holders through negotiated settlement without requiring litigation.
At SoftBank Investment Advisers he owned regulatory diligence and compliance sign-off for the investment and divestment deal stream, negotiated subscription agreements, side letters and co-investor NDAs, and helped build the firm’s capital-markets compliance process, information-barrier protocols and regulatory filing checklists. He has served as lead counsel in federal administrative hearings before Administrative Law Judges, and began his legal career at a San Francisco entertainment law practice handling intellectual property and commercial matters in state and federal court.
He has taught as an adjunct lecturer for fifteen years, most recently Music Law and Business at the San Francisco Conservatory of Music, a course built on copyright, trademark, contract negotiation, entity formation and the AI-and-copyright questions. He writes on AI regulation, copyright, data, and privacy.
- J.D., Northwestern California University School of Law
- Admitted, State Bar of California
- GenAI for the Legal Profession: Power User Edition, Berkeley Law Executive Education
- Pyramind Institute, Music Business and Production
Before the bar Liam spent two decades in music and audiovisual production as a producer, studio owner and event operator, founding Diamond Sonic, a San Francisco production company whose clients included Google, Uber, LinkedIn, Salesforce and Twitter. As Liam Shy his music appears in Microsoft and Insomniac Games’ Sunset Overdrive for Xbox; as Mountain Of Youth he performed at Coachella in 2016. At nineteen he wrote and passed a municipal law, signed by the Mayor of San Francisco, now Governor of California.
Writing
Liam writes on the legal questions behind building and shipping technology: AI governance, privacy, and content rights. Read the blog →
Latest: Your Crawler Needs an Alibi
Common questions
Frequently asked questions.
Who is Liam J. Penwell?
Liam J. Penwell is a California-licensed attorney (State Bar No. 339157) who serves as outside product, commercial, and IP counsel to 30+ technology and creative companies across Silicon Valley and the Bay Area. He brings two decades of owning and licensing intellectual property, and regulatory compliance experience inside a global investment adviser.
What kind of lawyer does an AI startup need?
An AI startup needs counsel across its full range of legal work: customer contracts and DPAs, privacy under CCPA/CPRA and GDPR, AI governance documentation for enterprise buyers, training-data and output-rights questions, and the equity and investor documents of a first raise. Penwell Law serves as outside general counsel to AI and SaaS companies in California and nationally.
Does Penwell Law serve as fractional or outside general counsel?
Yes. Penwell Law serves as fractional or outside general counsel to founders and their teams, most often as a standing relationship, and also takes scoped projects such as a contract stack, a data processing agreement or an AI governance program.
What does outside product counsel do for an AI startup?
Outside product counsel handles the legal side of what an AI startup ships: platform and developer terms, SaaS and data licensing, privacy under CCPA/CPRA and GDPR, and the training-data, model-output and right-of-publicity questions specific to generative AI. The work runs from design review to launch.
Does Penwell Law work with early-stage startups?
Yes. Penwell Law advises early-stage startups on entity formation and governance, equity and investor agreements, and securities compliance for a first financing round.
What industries does Penwell Law serve?
Penwell Law serves any company with a technology nexus. The core of the practice is AI and SaaS: generative AI products, enterprise software and cloud platforms, data and computer-vision companies, developer tools and APIs, and two-sided marketplaces. It extends to fintech and consumer applications, education technology, and content, media and entertainment businesses whose main assets are intellectual property. Clients range from solo founders through funded startups to established companies buying or licensing technology, based in Silicon Valley and across the United States.
Can Penwell Law advise on the EU AI Act and GDPR?
Yes. Penwell Law counsels U.S. companies on EU AI Act risk classification and general-purpose AI obligations, GDPR data protection, and Digital Services Act trust-and-safety duties, as compliance exposure for products sold from California into Europe.
Where is Penwell Law located?
The practice is based in Burlingame, California, in the San Francisco Bay Area, and works with clients across Silicon Valley and nationally. It advises on California and federal law.
Start the conversation.
Contact
Based in Burlingame, California, working with clients and teams across Silicon Valley, the Bay Area, and nationally.
Inquiries