Ask most business teams what happens when legal gets involved in a product launch, and you’re likely to hear some version of the same answer: “Legal slows things down,” or “Legal is where good ideas go to be told no.”
At Axiom, we typically find this complaint describes a failure of method rather than a failure of lawyers.
On a recent webinar, Beyond Product Lawyers: How Strategic Counsel Are Modernizing the In-House Legal Function, Axiom Chief Customer Officer David Pierce sat down with Gina Giró i Aguirre, Product Counsel at Logitech, and Kimberly Jee, VP - Product, IP & Litigation at Attentive, to discuss smart risk frameworks, the skills product counsel need that law school never taught, and how to build self-service tools that scale legal without scaling headcount. The through line of the conversation was that the product counsel who matters most is the one who tells the business how to get where it’s going, not whether it may go there at all. Getting to that answer takes a real legal risk assessment, and it needs to be done early enough to change the design.
Here’s what that looks like in practice.
What’s a Legal Risk Assessment?
A legal risk assessment is a structured review of the legal exposures a business decision creates, ranked by likelihood and consequence and paired with the steps that would reduce them.
The word that matters in that definition is structured. Every experienced lawyer forms instincts about what feels risky. Instinct doesn’t travel well; it can’t be delegated, and it doesn’t give a product manager anything to act on. A legal risk assessment turns that instinct into something a cross-functional team can argue about, prioritize, and design around.
It’s also worth naming what a legal risk assessment is not meant to produce. It will not get a product to zero risk. As one of the panelists put it, you’re never going to eliminate all the risk for the teams you support, and a lawyer who tries is not being a strategic business partner because innovation requires taking risks. The real questions are which risks, and on what terms?
Why Legal Risk Assessments Matter before a Product Launch
Timing is most of the value. The same privacy issue costs almost nothing to solve during architecture discussions and a great deal to solve after launch, when the fix means re-engineering, renegotiating contracts, or explaining yourself to a regulator. A legal risk assessment run at the design stage is a design input. The same assessment run the week before launch is a veto, and everyone in the room knows it.
That’s why one of the panelists described a deliberate shift in her own role. She used to be the downstream approver at the end of the process. Now she’s present where decisions actually get made: product approval gates, leadership meetings, the engineering Slack channels. She attends framing and vision product gate meetings where no legal approval is required at all, because being in the room when the concept forms is worth more than reviewing the result.
Getting there requires knowing the business well enough to be useful in those rooms. Not at an engineer's depth, but enough to follow how the product actually works, who the customers are, what the competitors are doing, and where the revenue comes from. Both panelists said the same thing about how you build that knowledge: Don’t be afraid to ask. If asking in the room feels wrong, send the engineer an informal Slack message afterward. They’ll appreciate it.
What Legal Risks Should Product Counsel Assess?
The categories vary by industry, and the discipline of naming them separately is what keeps an assessment from collapsing into a vague sense of unease. Across most product launches, the risk factors worth working through include:
- Regulatory and compliance risk: Which legal landscapes does this product touch, and are any of them in motion? What about data protection, advertising and marketing rules, sector-specific regulation, and the growing patchwork of AI-specific requirements?
- Data and privacy risk: What is collected, where does it go, who can reach it, and how long does it persist? This is where product architecture and legal exposure meet most directly.
- Contracts, compliance obligations, and third-party dependencies: What have you already promised customers, partners, and vendors, and does this launch keep those promises?
- Intellectual property risk: This includes freedom to operate, third-party rights, and what you are able to protect on your own side.
- Security risks: These can include attack surfaces, access controls, and incident exposure, particularly where a feature moves sensitive data into new places.
- Operational risks: Can business operations can actually support what’s being launched, including support capacity, internal controls, and the durability of the business practices the launch depends on?
- Reputational damage and customer trust: This is the category most often left out of a formal assessment and most likely to determine whether an executive greenlights something. A choice can be lawful and still be one your customers hate.
Naming the category matters because the answer changes with it. A pure compliance question has a legal answer. A trust question is a business judgment that belongs to the business, informed by legal.
Frameworks for Legal Risk Assessment for a Product Launch
Two frameworks came out of the panel, and they work well together.
Smart Risk Framework
The first is a smart risk framework. Before you can advise on any specific launch, your team needs internal alignment on what a smart risk actually is at your company and how it impacts the business. Without that shared definition, every assessment restarts from zero and every lawyer on the team gives a slightly different answer.
Risk-Reward Matrix
The second is a risk-reward matrix built around the actual architectural options, and one of the panelists described a case that shows why this beats a memo.
Her team was developing an AI-powered camera tracking feature and hit a classic cross-functional impasse. Maximizing tracking accuracy required heavy data processing, which carried significant privacy liabilities that her privacy team flagged, along with meaningful bandwidth overhead for engineering.
The rigid version of legal risk management would have been a refusal, citing the privacy exposure. Instead, she got into the weeds of the product architecture, and together with the privacy team, she built a structured risk-reward matrix mapping the real trade-offs between edge data processing and cloud data processing. The team's original proposal was cloud processing, which was costly and carried more privacy risk. So they challenged the team to change the architecture: Shift the primary AI compute onto the local device, keep the live video data entirely within the local perimeter, and route only anonymized, aggregated metadata to the cloud, subject to privacy team approval.
The architecture change made the privacy risk acceptable. Legal got there by getting into the product architecture rather than by standing outside of it, which is the difference between prioritizing risks and simply reporting them.
Turn legal constraints into sustainable solutions with the right architecture.
The One-Way vs. Two-Way Door Approach to Legal Risk Assessment
The most portable idea from the panel was also the simplest one. Before advising on a risk, ask whether the team is walking through a one-way door or a two-way door.
A two-way door can be walked back. The feature can be disabled, the term renegotiated, the data deleted, the policy revised. Reversal may be a big task or a small one, and estimating which is part of the assessment, but reversal is available.
A one-way door can’t be walked back. Data that leaves your perimeter cannot be recalled. A public commitment cannot be unmade. Some regulatory positions, once taken, are extremely difficult to abandon.
The insight the panelists offered is that genuine, one-way doors are rare. Most decisions that feel irreversible in the moment turn out to be recoverable at some price. That reframing matters, because it tells a legal team where to spend its scrutiny. Two-way doors deserve a fast answer and a documented rationale. One-way doors deserve everything you have.
This is also the most useful question to hand a business partner, since they can ask it themselves before they ever come to you.
Making the Assessment Scale
An assessment that only exists in a lawyer's head does not scale, and the fastest way to become a bottleneck is to insist on personally touching everything.
The panel's practical answer was to build the tools that let the business handle its own low-risk decisions: self-service checklists, playbooks, contract templates, early-stage risk frameworks, and standing office hours held monthly with the different stakeholders you support, so people remember you exist and know they can come to you.
One panelist described what happened when she did this, and it’s counterintuitive enough to be worth stating plainly. The business came to her more often, not less. The remedial questions about what to put in which blank disappeared into the self-service tools, and what came to her instead were the more conceptual and more interesting product and engineering questions that actually needed a lawyer.
That is what a mature risk management strategy looks like. The routine work is automated or delegated, the repeatable judgments are written down, and legal's remaining time goes to the small number of decisions where the risk mitigation strategies genuinely require legal judgment.
Frequently Asked Questions
What is a legal risk assessment?
A structured review of the legal exposures created by a business decision, ranked by likelihood and consequence, paired with the mitigations that would reduce them. For a product launch, it covers regulatory, privacy, IP, contractual, security, operational, and reputational risk.
How do you conduct a legal risk assessment?
Identify the risk factors by category, assess likelihood and severity for each, determine which are reversible, map the realistic alternatives including their architectural and commercial trade-offs, and recommend the path that reaches the business goal with acceptable risk. Document the reasoning so the same question does not get re-litigated later.
What legal risks should companies assess before launching a product?
Regulatory and compliance obligations, data privacy, contractual commitments to customers and partners, intellectual property, security risks, operational readiness, and reputational damage or loss of customer trust.
When should a legal risk assessment be conducted during product development?
As early as the concept and architecture stage. Assessments run close to launch tend to function as vetoes, since by then the cost of changing course is high enough that legal is delivering bad news rather than shaping a decision.
What is product counsel's role in a legal risk assessment?
To understand the product deeply enough to identify real exposures, translate them into terms the business can act on, and co-create a path forward. Effective product counsel operates as a partner inside the product process rather than as an approver at the end of it.
How can product counsel reduce legal risk without slowing innovation?
By engaging early, proposing architectural or design alternatives rather than refusals, distinguishing reversible decisions from irreversible ones and scaling scrutiny accordingly, and giving the business self-service tools for low-risk decisions so legal's attention goes where it is genuinely needed.