Description

A focused course, tailored for you

The In-House AGC Commerce-Platform Privacy and AI Playbook

Ship merchant-facing AI features and cross-border data flows without sitting on every product launch waiting for legal review.

Every new merchant-facing feature lands on the AGC desk with the same open questions about privacy, AI governance, and cross-border data, and the answers are reconstructed from scratch each time because the standing artefacts are not in place.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

An Associate General Counsel inside a multi-merchant commerce platform is not running a single-company privacy programme. Each merchant is an independent controller, the platform is processor for some flows and joint controller for others, and the boundary shifts feature by feature. A new AI-assisted listing tool touches training-data provenance, model-card disclosure, Quebec Law 25, the Colorado AI Act, the EU AI Act limited-risk tier, and the merchant DPA's derived-data clause all at once. A new cross-border payments capability touches PCI DSS 4, PSD3, and the data-localisation rules in three jurisdictions where the platform onboarded merchants in the last quarter. A new merchant-analytics dashboard touches the joint-controller question that the privacy team has not finished documenting. Without a standing library of checklists, templates, model cards, DPIA shells, and merchant-DPA addenda, each launch becomes its own legal project. The product organisation experiences this as a slow legal function. The legal function experiences it as a flood of recurring questions that should have been pre-answered. The course is the toolkit for pre-answering them.

What you walk away with

A standing privacy review checklist tuned to merchant-facing feature launches that product counsel and product managers can self-serve on for routine cases.
A model-card template and AI-feature DPIA shell that satisfies the EU AI Act limited-risk transparency duty, Colorado AI Act consumer-facing disclosure, and Quebec Law 25 automated-decision notice with one artefact set rather than three.
A merchant-DPA addendum library covering derived data, training-data use, sub-processor onboarding, and cross-border transfer mechanisms for the jurisdictions the platform currently operates in.
A joint-controller versus processor decision tree that the privacy team and product counsel apply to every new feature before scoping legal review, so the boundary question is answered up front not at the end.
A cross-border transfer assessment that survives a regulator request, with SCCs, transfer impact assessments, and data-localisation handling for the platform's current jurisdiction mix.
A standing artefact library that means a merchant-side AI feature launch moves through legal review in two weeks rather than eight.

The 12 modules

Module 1. The commerce-platform legal stack and where the AGC sits in it

Maps the legal-function workload at a multi-merchant SaaS commerce platform across privacy, AI governance, merchant agreements, payments, content moderation, and product launch review. Names which artefacts an Associate General Counsel owns directly, which the General Counsel signs off on, and which the Data Protection Officer or outside counsel partners on. Sets the boundary for the rest of the course and the implementation playbook.

Module 2. Processor versus joint controller in a multi-merchant platform

Works through the boundary question that decides every downstream artefact. Identifies which platform flows are pure processing for the merchant controller, which are joint-controller flows under GDPR Article 26, and which are platform-as-controller for derived data. Produces the decision tree that product counsel and the privacy team apply at feature scoping, with worked examples for merchant analytics, fraud signals, and AI-assisted listings.

Module 3. Merchant DPA architecture and the addendum library

Anatomy of a commerce-platform merchant Data Processing Addendum: derived-data clause, training-data carve-out, sub-processor onboarding, audit rights, breach notification SLA, and termination data return. Walks through the addendum library a multi-merchant platform needs for AI feature consent, expanded sub-processor lists, cross-border transfer mechanism changes, and jurisdiction-specific overlays. Includes a model master DPA and four signature-ready addenda.

Module 4. Cross-border transfer mechanisms and the transfer impact assessment library

Maps the platform's current transfer geometry: SCCs for EU and UK personal data, ICDTA for the UK, ANPD-blessed mechanisms for Brazil, and the patchwork of Quebec, Colorado, and APAC localisation rules. Walks through a transfer impact assessment that survives a regulator request, with the source documents a commerce platform actually generates, and the standing TIA template the privacy team reuses per jurisdiction onboarding.

Module 5. Privacy review for merchant-facing feature launches

The standing privacy review checklist for a feature that touches the merchant-shopper surface. Covers data-minimisation, lawful basis stacking when the platform is processor for the merchant and controller for derived signals, consent UX for merchant onboarding, and the artefacts product counsel needs to attach to the launch ticket. Calibrated so routine launches self-serve and only edge cases reach the AGC desk.

Module 6. AI governance for merchant-facing models

Covers the AI feature stack a commerce platform actually ships: assisted product descriptions, image enhancement, search ranking, fraud risk scoring, and conversational shopping. Walks through the model card template, the training-data provenance record, and the AI-feature DPIA shell that simultaneously satisfies the EU AI Act limited-risk transparency duty, the Colorado AI Act consumer-facing disclosure, and the Quebec Law 25 automated-decision notice. Produces one artefact set instead of three.

Module 7. Payments, PSD3, PCI DSS 4, and the marketplace facilitator question

Anatomy of a payments launch in a multi-merchant platform: the merchant-of-record question, marketplace facilitator obligations across US states, PSD3 strong customer authentication updates, PCI DSS 4 scoping for the platform's tokenisation architecture, and the merchant agreement clauses that allocate liability for chargebacks and reversals. Produces the AGC's standing payments-feature review checklist.

Module 8. Consumer protection and content moderation as legal-function workload

Maps consumer-facing obligations the platform inherits from the merchant relationship: dark-pattern rules under the FTC, EU consumer rights directive, Quebec Consumer Protection Act updates, Digital Services Act trader traceability for marketplace flows, and the takedown infrastructure that satisfies both seller-protection and notice-and-action duties. Names which artefacts the AGC owns versus the trust-and-safety team owns.

Module 9. Breach response when the platform is processor for thousands of merchants

Walks through the incident response architecture that holds up when a single platform incident becomes a notification obligation for every affected merchant under GDPR Article 33, Quebec Law 25, the Canadian PIPEDA breach reporting standard, and US state attorney-general timelines. Produces the standing breach notification template the platform sends merchants, the merchant communication playbook, and the regulator-facing chronology the AGC certifies.

Module 10. Working with product counsel, security counsel, and the DPO

The operating model that keeps the legal function fast: which questions product counsel resolves at the launch ticket, which trigger AGC review, which trigger the DPO and which trigger the GC. Includes the intake template product managers fill in, the legal review SLA the function publishes back to product, and the escalation patterns when a feature has cross-functional implications across privacy, payments, and consumer protection.

Module 11. Regulatory engagement and the platform-as-respondent playbook

Prepares for the regulator interactions a multi-merchant platform draws: ICO and CNIL inquiries on cross-border transfers, ANPD on data-localisation in Brazil, FTC merchant-protection inquiries, Colorado AG AI Act notices, and Quebec CAI inspections. Walks through the document hold, the chronology the platform supplies, the privilege boundary for outside counsel, and the standing response templates the AGC team maintains.

Module 12. Twelve-month roadmap for the AGC function

Sequences the artefact build so the legal function compounds rather than fire-fights: which artefacts to build in months one through three, which in four through six, which in seven through twelve. Names the metrics the AGC reports to the GC each quarter, the staffing decisions that follow from the artefact-build progress, and the moment the function moves from reactive review to standing toolkit.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Merchant-facing AI feature stuck in legal review for six weeks: modules 5, 6, 9.

Cross-border data flow into a new jurisdiction the platform just onboarded: modules 4, 10.

Regulator inquiry citing the platform's role as joint controller for derived signals: modules 2, 11.

Merchant DPA addendum negotiation with an enterprise merchant who is pushing back on derived-data and training-data clauses: modules 3, 6, 7.

What you get with this course

The standing privacy review checklist for merchant-facing feature launches.
The model card template, training-data provenance record, and AI-feature DPIA shell tuned for commerce platforms.
The master merchant DPA plus four signature-ready addenda covering AI consent, sub-processor changes, cross-border transfers, and jurisdiction overlays.
The processor versus joint controller decision tree with worked examples for merchant analytics, fraud signals, and AI-assisted listings.
The transfer impact assessment template and four worked jurisdiction TIAs.
The breach response architecture, merchant notification template, and regulator-facing chronology.
The intake template, legal review SLA, and escalation patterns for working with product counsel, security counsel, and the DPO.
The hand-built implementation playbook tailored to the specific commerce-platform legal stack rather than a generic in-house template.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: account in the Art of Service learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Week one to two: work through modules 1 to 4 to lock the boundary question and the DPA architecture.

Week three to four: modules 5 and 6 produce the standing privacy review checklist and the AI feature artefact set.

Week five to six: modules 7 to 9 produce the payments review checklist, consumer protection map, and breach response architecture.

Week seven to eight: modules 10 to 12 produce the operating model, regulator engagement playbook, and the twelve-month roadmap.

Before and after

Before

Every merchant-facing feature launch becomes its own legal project. Privacy review, AI governance, DPA addendum language, and cross-border assessment all get reconstructed from scratch. Product experiences a slow legal function. The AGC experiences a flood of recurring questions that should have been pre-answered. Launches that should take two weeks take eight, and the function spends its time defending the timeline rather than building the standing toolkit.

After

Routine merchant-facing launches self-serve through a standing privacy review checklist and an AI feature DPIA shell that product counsel applies at scoping. Edge cases reach the AGC desk with the boundary question already answered. The merchant DPA addendum library covers the recurring negotiation points. Cross-border transfer assessments and breach response templates exist as standing artefacts. The legal function moves from reactive review to a published toolkit, and merchant-AI feature launches close in two weeks rather than eight.

What happens if you do not address this

The product organisation routes around legal review when the queue is too slow, which creates the artefacts the legal function would have written for itself, but written by people without the privacy-and-AI training to do them correctly. The platform ships features under DPIAs that will not survive a regulator request, signs merchant DPAs whose derived-data clauses do not match what the AI features actually do, and discovers the joint-controller boundary the wrong way when a regulator names the platform a co-respondent. The AGC function is then in remediation rather than build, and the merchant trust narrative takes the hit.

Who it is for

In-house commercial and privacy counsel at a multi-merchant SaaS commerce platform, typically Associate General Counsel or senior counsel level, responsible for privacy, AI governance, merchant agreements, and product launches that touch the merchant-facing surface. Comfortable with privacy frameworks but not staffed to write every artefact from scratch for every launch. Reports into a General Counsel and partners with product, security, and a Data Protection Officer if the platform has one.

Who this is NOT for. Outside privacy counsel at a law firm advising multiple platform clients. Pure litigation counsel without product-launch responsibility. AGCs at single-brand consumer retailers where there is no merchant layer between the platform and the end shopper. Compliance generalists at a non-platform SaaS where every customer is a controller in the same way.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly four to six hours per week across eight weeks, ideally split between the AGC and one privacy or product counsel partner so the standing artefacts get reviewed inside the function as they are produced.

Why $199 is the right number

Outside privacy counsel produces individual artefacts at law-firm rates, but the artefacts arrive as one-off deliverables rather than a standing library the function reuses. In-house legal training programmes from the major bar associations cover the doctrinal updates but do not produce the artefact set a multi-merchant commerce platform actually needs. This course produces the standing toolkit and the implementation playbook tuned to the commerce-platform context, at a price that does not require a procurement cycle.

FAQ

Does this cover specific jurisdictions or is it generic?

The implementation playbook is hand-built around the platform's current jurisdiction mix. Course modules cover GDPR, UK GDPR, Quebec Law 25, Colorado AI Act, EU AI Act limited-risk tier, ANPD Brazil, and the US state privacy and consumer-protection patchwork as default coverage, with the playbook layering whichever specific jurisdictions matter most to the platform.

Is this for the General Counsel or for the Associate General Counsel?

Aimed at the AGC and senior counsel level who own the artefact production. The General Counsel sees the outputs as standing artefacts the function operates from, but does not need to read the modules to use them.

Does the implementation playbook get signed off as legal advice?

The playbook is a structured artefact toolkit, not formal legal advice. It is built so the in-house legal function reviews, adapts, and adopts the artefacts under its own sign-off, with outside counsel review where the function's risk tolerance requires it.

What if the platform's AI feature pipeline shifts after the playbook is delivered?

The model card and DPIA shells are templates rather than fixed instances, so a new AI feature class plugs into the same artefact spine. The cross-border assessment library updates each time a new jurisdiction is onboarded, using the standing TIA template.

How is the course delivered?

Written modules in the Art of Service learning environment, downloadable templates and worked examples for every module, and the hand-built implementation playbook delivered alongside course access.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.