Counsel, AI Governance, Law and Compliance

Working with Us
Challenging. Meaningful. Life-changing. Those aren’t words that are usually associated with a job. But working at Bristol Myers Squibb is anything but usual. Here, uniquely interesting work happens every day, in every department. From optimizing a production line to the latest breakthroughs in cell therapy, this is work that transforms the lives of patients, and the careers of those who do it. You’ll get the chance to grow and thrive through opportunities uncommon in scale and scope, alongside high-achieving teams. Take your career farther than you thought possible.

Bristol Myers Squibb recognizes the importance of balance and flexibility in our work environment. We offer a wide variety of competitive benefits, services and programs that provide our employees with the resources to pursue their goals, both at work and in their personal lives. Read more: careers.bms.com/working-with-us.

Position Summary

The Counsel, AI Governance, Law & Compliance provides day-to-day legal and compliance support for the design, development, deployment, and ongoing oversight of AI systems across the enterprise. Sitting within the AI, Data and Privacy Law and Compliance department and reporting to the Head of AI Governance, Law and Compliance, this role partners closely with Business Insights and Technology (BI&T), Privacy, Data Governance, and business stakeholders to operationalize the company’s global AI governance framework. The Counsel translates evolving AI laws, regulations, and standards (e.g., EU AI Act, OECD Principles, NIST AI RMF, ISO/IEC 42001, CPPA ADMT, China PIPL) into practical guidance, reviews AI use cases for legal and ethical risk, and helps drive responsible AI adoption in a highly regulated life sciences environment.

Key Responsibilities

• Provide legal counsel on AI initiatives across the AI lifecycle, including intake review, risk classification, model development, deployment, monitoring, and decommissioning.
• Conduct and document AI legal risk assessments covering intellectual property, privacy, bias and fairness, transparency, safety, accountability, and third-party risk.
• Support implementation of the enterprise AI governance framework, including model inventory, lifecycle controls, human oversight protocols, and incident response workflows.
• Track and interpret global AI laws, regulations, guidance, and standards, and translate them into actionable policies, playbooks, standards, and training materials.
• Review and negotiate AI-related contractual provisions with vendors, partners, and customers, including data use, model training, indemnities, and audit rights.
• Advise on generative AI and high-risk AI use cases, including R&D, commercial, medical, manufacturing, and enabling functions.
• Partner with Privacy Law & Compliance on intersecting issues such as automated decision-making, profiling, cross-border data transfers, and data subject rights.
• Support engagement with regulators, industry groups, and standards bodies, and contribute to internal thought leadership on responsible AI.
• Help design and deliver AI governance and compliance training for legal, compliance, and business audiences.
• Maintain clear documentation to support audit readiness, regulatory inquiries, and governance maturity assessments.

Qualifications

• JD (or equivalent legal degree) and active bar membership in at least one U.S. jurisdiction required.
• 5-7 years of combined legal experience at a top law firm or in-house.
• Minimum 2 years of substantive experience in AI legal and compliance or  AI governance.
• Working knowledge of key AI laws and frameworks, including the EU AI Act, NIST AI RMF, ISO/IEC 42001, OECD AI Principles, and U.S. federal and state AI guidance.
• Demonstrated ability to translate complex regulatory requirements into pragmatic, business-aligned guidance.
• Strong drafting, analytical, and stakeholder management skills, with the ability to operate independently in a fast-moving, cross-functional environment.
• Sound judgment and discretion in handling novel, ambiguous, and high-visibility issues.

Preferred Skills

• CIPP (e.g., CIPP/US, CIPP/E) and/or IAPP AIGP certification preferred.
• Prior experience in the pharmaceutical, biotechnology, healthcare, or life sciences industry.
• Familiarity with privacy laws and frameworks (e.g., GDPR, HIPAA, CCPA/CPRA, China PIPL) and their intersection with AI.
• Experience …