An AI-based recruitment tool is not a technology question with legal footnotes attached. It is at once an employment law question, a data protection question and, in many cases, a high-risk AI system under the AI Act. The same holds for the credit assessment at the bank, the model that sets the insurance premium and the AI feature a SaaS provider builds into its service. The AI Act and the GDPR have moved the boundaries between practice areas, and that changes what legal specialist expertise means in practice. This is why we are now recruiting 30 lawyers: ten specialist areas across Stockholm, Gothenburg and Malmö.
From 2023 to ten specialist areas
Lawgent was founded in 2023 with a clear direction: to build a law firm around the EU’s regulation of AI, IT and technology, for companies where law, data and European regulation meet in the same question.
The academic grounding has stayed with us throughout. We work with professors and universities, in Sweden and elsewhere in Europe, and we also teach at law schools. That is not a side activity but part of how we build competence: fields such as the AI Act and digital regulation develop faster than case law can settle, and proximity to research is then a precondition for advice that holds.
We already have a presence in Stockholm, Gothenburg, Malmö, Uppsala and Linköping. The next step is to staff the three largest cities with specialists across all ten areas. The reason is simple: the AI Act and the GDPR reach employers, suppliers, boards and financial institutions wherever they sit, and the expertise required has to be close to the clients. Covering the country is also a way of connecting the Swedish work to the European networks we already operate in.
Why the requirements are changing
Take the AI-based recruitment tool as an example, because it shows the problem more clearly than any discussion of principle.
The employer introducing the tool must first determine what it actually is. The AI Act classifies systems for recruitment and selection as high-risk, and anyone deploying such a system takes on obligations of their own: human oversight, logging, and information to workers and their representatives before the system is put into use. At the same time the GDPR applies to the processing of candidate data, with requirements of legal basis, proportionality and transparency, and with limits on decisions based solely on automated processing under Article 22. On top of that sits Swedish employment law: the Discrimination Act where selection is algorithmic, and the Co-Determination Act when a new system is introduced into the business.
Three sets of rules, three different logics, one single procurement. A lawyer who only knows employment law does not see the classification question. One who only knows data protection does not see the duty to negotiate. So we are not looking for generalists who know a little about AI. We are looking for specialists who are secure in their own field and who can hold the other tracks together in the same analysis.
The ten roles
Employment law, AI Act and GDPR
This role covers employers’ employment law questions where technology, data and personnel decisions meet: the introduction of AI support in recruitment, digital monitoring of productivity, internal rules for employees’ use of generative AI. The intersection is sharp, because the AI Act classifies systems for recruitment, promotion, termination, task allocation and monitoring of workers as high-risk, and in addition prohibits emotion recognition in the workplace with narrow exceptions. The work means turning that into concrete advice for HR and management, not into a memorandum on the state of the law.
IT law, AI Act and GDPR
Here the work involves SaaS and cloud services, IT agreements, digital platforms and AI-based services, together with the regulatory frame around them: the GDPR, the AI Act, the Data Act and cybersecurity regulation. The decisive question is often who carries responsibility in the AI value chain. An actor that takes an AI model into its own service, changes its purpose or sells it under its own name may move from deployer to provider, with considerably more extensive obligations. The role requires enough understanding of the technology to know what a service actually does with data.
Commercial contract law, AI Act and GDPR
Customer agreements, supplier agreements, distribution agreements, licences and general terms. Many of the clients in this role are not tech companies but manufacturers, service businesses and trading companies that buy in or build AI into their operations. The point of the intersection is that the AI Act places different obligations on providers and deployers, and those obligations cannot be contracted away. The agreement must instead make sure the parties get the information, documentation and support they need in order to meet them.
Intellectual property, AI Act and GDPR
Generative AI has made several of the basic questions of intellectual property urgent again: who owns what a model produces, may protected works be used as training data, what happens to trade secrets when employees work in external AI tools. The AI Act ties explicitly into copyright through the requirements on providers of general-purpose AI models to have a policy for complying with EU copyright law and to publish a sufficiently detailed summary of the training content. The role requires the ability to give clear advice on risk and options for action even where the law is still developing.
Compliance and regulatory, AI Act and GDPR
This is the operational role in the set. The work consists of mapping which AI systems an organisation actually uses, risk-classifying them under the AI Act, carrying out a gap analysis against existing data protection work and producing a plan for what is to be done, by whom and in what order. It also covers data protection impact assessments and, where required, fundamental rights impact assessments, as well as training to meet the AI Act’s requirement of AI literacy among staff. The task is to build one shared governance effort for both frameworks instead of two parallel processes.
Senior lawyer, corporate law and M&A
The role means own responsibility for acquisitions, divestments, investments and restructurings, advising owners, management and boards directly. What separates it from a traditional transactional role is that you are expected to see when a target’s business model rests on AI systems, training data or personal data processing that does not hold up regulatorily, and to translate that into demands in the negotiation. An unclassified high-risk system is not a footnote in the due diligence report but a question of price, warranties and insurability. The penalties under the AI Act and the GDPR can reach a share of global annual turnover, which makes the exposure relevant to the buyer after closing.
Senior lawyer, dispute resolution
Disputes in the general courts and in arbitration where technology is part of the substance: defects and delays in IT and AI deliveries, liability when a system has produced faulty decision material, damages claims under the GDPR and supervisory proceedings before the Swedish Authority for Privacy Protection. The AI Act is not a liability rule in itself, but it creates the yardstick against which liability will often be measured. The requirements on risk management, logging, human oversight and documentation become the basis for assessing negligence and breach of contract, while the new Product Liability Directive expressly covers software. The role requires the ability to work with technical experts and to use system logs as evidence.
Senior lawyer, financial services and FinTech
The clients are banks, credit institutions, payment companies, insurers and FinTech firms, and the questions concern authorisations, conduct of business rules, customer protection and the relationship with the Swedish Financial Supervisory Authority. The intersection is unusually concrete: the AI Act classifies AI systems for creditworthiness assessment of natural persons and for risk assessment and pricing in life and health insurance as high-risk, with a requirement for a fundamental rights impact assessment. The Court of Justice of the EU has moreover held that the production of a credit score can constitute an automated decision under Article 22 GDPR. The question is rarely whether a framework applies, but how several frameworks are to be satisfied in the same process.
Senior lawyer, tech transactions
Large IT and outsourcing agreements, cloud migrations, licensing of AI models and access to models via API. These agreements run for many years and involve several suppliers, which makes governance, exit and regulatory obligations questions that have to be thought through already at signing. The AI Act requires providers of high-risk systems and their sub-suppliers to set out in a written agreement what information, capabilities and technical support are to be provided. In large technology deals that becomes a set of negotiation issues affecting price, liability and governance, not an annex written last.
Senior lawyer, governance and compliance
The client here is the board, the CEO or the management team, and the work sits in the structure above the processes: allocation of responsibility, delegation, reporting and decision material. The AI Act presupposes an organisation able to identify AI systems, classify them, ensure AI literacy and allocate responsibility for compliance, which is fundamentally a governance question. NIS2 and DORA in addition place express responsibility on management bodies for the handling of IT and cybersecurity risk. Added to that is the GDPR’s accountability principle: the company must be able to demonstrate compliance, not merely assert it.
How the recruitment process works
All 30 positions are full-time with hybrid working and a single location per advertisement. Applications are made through Nordic Investin Group’s shared career portal, where the application is supplemented with a number of questions about your background and your specialist area. Please note that the job advertisements are in Swedish.
Selection is made against evaluation criteria set in advance that are the same for every applicant to a role, followed by structured interviews. That applies to all ten areas, and it is also why we assess specialist expertise on the basis of what you have worked with rather than the number of years. Five of the roles are senior positions. Because Lawgent is a juristbyrå rather than an advokatbyrå, the advokat title is not used in these positions.
Apply for the role and the city that fit
Choose your specialist area and your city in the list above and submit your application directly through the advertisement.
All open positions are collected at jobs.nordicinvestin.se.
If you do not find a role that fits, you can register your interest through Connect and state which area you are interested in. We will be in touch when something matching opens.
