About this role
Preparing for this role? See the best AI tools for compliance teams, practise with ready-made prompts for compliance teams, read Best AI for Regulatory Compliance in 2026 and take the free 30-day AI challenge.
This role can be office-based in Freiburg, Germany/ San Francisco, USA or remote-first, with a requirement to be in the office one full week per month.
About Black Forest Labs
We’re the team building the foundational layer for visual intelligence: multimodal models trained jointly on images, video, audio, and action to see, generate, and understand the world.
Our founding team pioneered latent diffusion and Stable Diffusion, the breakthroughs that made generative AI accessible to millions. With FLUX, we're pushing into generative media at scale, machines that act in the physical world, and emerging applications in computer use.
Our FLUX models top public benchmarks and run in production in some of the world's biggest platforms. We're a small, fast growing research lab competing with the largest companies in the world. From our labs in Freiburg to San Francisco, we're building what comes next.
Why This Role
Every FLUX release, API feature and enterprise offering requires legal oversight. Black Forest Labs’ (BFL) frontier technologies raise questions where there is no established precedent – especially as we push further into video, perception and physical AI.
We’re hiring a Privacy & Product Counsel to find solutions and help drive our product teams forward. You’ll sit in our Legal, Policy & Assurance (LPA) team and be embedded with research, product and engineering, shaping how BFL builds and ships.
This is a hands-on role for someone who wants to build a privacy function at the frontier of AI and robotics.
What You’ll Work On
Product counselling. Be the go-to lawyer for product teams on new models, API features and innovative products, from first spec to launch, giving clear, risk-calibrated advice that keeps us shipping.
Marketing. Partner with our Growth, Marketing and DevRel teams to review launch announcements, model cards and campaign copy so that our claims about FLUX are accurate. Advise on privacy matters relating to product marketing, analytics, commercial and creator partnerships, and advertising claims.
Privacy by design. Own BFL’s GDPR programme across the model lifecycle: training data, fine-tuning, inference, logging and retention. Run point on DPIAs and privacy documentation as required.
Customer commitments. Partner with GTM on DPAs, zero-data-retention and no-training terms, security questionnaires and enterprise negotiations – and work with the team to ensure that what we promise matches what we do.
International transfers and vendors. Manage EU–US transfer mechanisms (SCCs, the EU–US Data Privacy Framework and TIAs), and run privacy diligence on sub-processors and AI tooling.
US privacy. Track and implement obligations under US state privacy laws (CCPA/CPRA and peers) and emerging AI-specific state legislation.
Regulatory interface. Prepare BFL for engagement with data protection authorities, and handle data subject requests, complaints and incidents, including breach assessment and notification.
Policy and documentation. Draft and maintain privacy notices, internal policies, records of processing and the privacy elements of compliance documentation.
Scale the function. Build playbooks, templates and training so the rest of BFL can handle routine privacy questions without you.
What We’re Looking For
5–8 years’ PQE as a qualified lawyer in an EU/EEA jurisdiction or the UK, with a substantial focus on data protection and product counselling
Experience at a technology company, in a top-tier law firm’s privacy or tech practice, or both – ideally including time in-house advising product teams directly
Deep, practical command of the GDPR (and the German BDSG), the ePrivacy framework and international transfer rules, plus a working knowledge of how other relevant EU regulations, such as the EU AI Act, interact with them
Familiarity with US privacy and AI law (CCPA/CPRA, BIPA, and state AI and deepfake statutes)
A track record of advising on AI, ML or data-intensive products: you understand training pipelines, inference and feature releases well enough to ask engineers the right questions
Comfort giving direct, pragmatic advice under uncertainty – you can turn a novel legal question into a clear recommendation and workable product guidance
Strong drafting skills across DPAs, privacy notices, DPIAs and commercial privacy terms
Excellent written and spoken English; you can explain complex issues to researchers, executives and regulators alike
An ownership mindset and low ego: you’re comfortable in a fast-moving, high-growth environment where you build processes, not just follow them
While not required, it’s an added plus if you also have:
Experience with generative AI, computer vision or media products – particularly involving biometric data, likeness rights or synthetic media
Direct experience engaging with data protection authorities or the EU AI Office
CIPP/E, CIPT or equivalent certification
German language skills
An interest in adjacent areas such as security and trust & safety
How We Work Together
We’re a distributed team with real offices that people actually use. You’ll be based in Europe or the US and work from your home location, with one week each month spent with us in Freiburg / San Francisco to stay connected with the team.
Everything we do is grounded in four values:
Obsessed. We are a frontier research lab. The science has to be right, the understanding deep, the product beautiful.
Low Ego. The work speaks. The best idea wins, no matter who said it. Credit is shared. Nobody is above any task.
Bold. We take the ambitious bet. We ship, we do not wait for conditions to be perfect.
Kind. People over politics. We treat each other with genuine warmth. Agency without empathy creates chaos.
Closing
If this sounds like work you’d enjoy, we’d love to hear from you.
Compensation
EU: €150,000 - €200,000 + equity
US $200,000 - $250,000 USD
Note: We may use AI-assisted tools to help organize applications. All hiring decisions are always made by our team.
This is a remote role. Applicants must be located in: Germany.
