The professional obligations problem
Law firms face an AI governance challenge that most enterprise organisations do not: the use of AI tools is not just a technology governance question, but a professional conduct question. The rules of professional conduct that govern legal practice, confidentiality, competence, supervision, candour to the tribunal, apply with full force to AI-assisted legal work. They do not bend to accommodate new tools.
This creates a governance requirement that is more demanding than standard enterprise AI policy. A general business using an AI tool that produces incorrect output loses time and potentially money. A law firm using an AI tool that produces incorrect output may expose a client to adverse legal outcomes, breach its professional obligations, and face regulatory sanction. The consequences of inadequate AI governance in legal practice are direct, serious, and personal to the practitioner.
Privilege and confidentiality
The most immediate concern for most legal practitioners is privilege. Legal professional privilege protects confidential communications between a lawyer and client made for the dominant purpose of legal advice or litigation. The question AI creates is whether entering privileged client information into a third-party AI tool constitutes a disclosure that waives privilege.
The answer depends on the tool architecture, the terms of service, and the jurisdiction. AI tools that transmit inputs to third-party servers for processing, retain inputs for model training, or store data in ways that could be subject to discovery may create privilege risk. Enterprise AI tools with appropriate data processing agreements, data residency controls, and explicit commitments not to use inputs for training present a different risk profile.
Governance requires categorising the sensitivity of information before it enters any AI tool. Client matter information, facts, instructions, strategy, draft advice, should only enter AI tools that have been specifically assessed for privilege and confidentiality risk. General research queries that do not contain client-identifying information or privileged content present a different risk level.
The hallucination problem in legal practice
AI hallucination, the confident generation of plausible but false information, is a known limitation of all large language models. In most business contexts, hallucination is a quality problem. In legal practice, it is a professional conduct problem.
Multiple practitioners across several jurisdictions have faced sanctions, adverse costs orders, and professional conduct complaints after filing court documents containing AI-generated citations to cases that do not exist. The AI tools did not flag uncertainty, they generated complete, correctly formatted citations to non-existent judgments with apparent confidence.
This is not a marginal risk. It is a documented, recurring failure mode of AI tools used for legal research. Governance requires that any AI-generated legal research, case citations, statutory references, regulatory guidance, be independently verified against primary sources before use. This is not optional additional diligence. It is the minimum required to meet the competence obligations of legal practice.
Supervision obligations
Professional conduct rules in most jurisdictions require that legal work product be adequately supervised, regardless of who or what produced the first draft. AI-assisted work product does not change the supervision obligation, it changes the nature of the supervision required.
Supervising AI-generated legal work requires a practitioner who understands both the legal content and the limitations of the AI tool used. A junior practitioner reviewing AI output they cannot critically evaluate is not adequate supervision. Governance must ensure that AI-assisted work product is reviewed by practitioners with the substantive expertise to identify errors, omissions, and misapplications of law, not merely practitioners who can check formatting.
Disclosure obligations
Some jurisdictions and courts have introduced or are considering requirements to disclose AI use in court filings and legal documents. Even where not mandatory, disclosure may be appropriate in certain contexts: particularly where AI has played a substantial role in drafting documents filed with courts or provided to clients as advice.
Governance should establish a clear policy on AI disclosure: when it is required, when it is appropriate as a matter of professional practice, and how it is documented. Waiting for mandatory disclosure requirements before establishing a policy is not adequate governance.
What a legal sector AI governance framework requires
A governance framework adequate for legal practice must address, at minimum: an approved AI tools list distinguishing between tools suitable for client matter work and those restricted to general research; data classification rules specifying what categories of information may be entered into which tools; mandatory verification requirements for AI-generated research and citations; supervision requirements specifying the seniority and expertise required to review AI-assisted work product; and a disclosure policy covering when AI use must or should be disclosed to courts, clients, and regulators.
Firms that have not yet established this framework are not simply behind best practice. They are operating without the controls necessary to manage a risk that has already materialised, with documented consequences, in legal practices across multiple jurisdictions.
