AI governance is becoming table stakes for law firms
Most law firms started using AI before they built any rules around it. Associates draft and summarize with it, litigation teams run document sets through it, and marketing and business development lean on it daily. The adoption moved faster than the governance, and that gap is now where the risk sits. The firms getting ahead of it are treating AI governance the way they already treat security and confidentiality, as part of the trust they ask clients to place in them.
THE EXPOSURE
Why is AI risk different for a law firm?
The most sensitive asset a firm holds is client matter data, and confidentiality and privilege attach to it. When that data goes into an AI tool, the questions that matter are basic and often unanswered: where does the data go, is it retained, is it used to train a model, who at the vendor can see it. A consumer chatbot and an enterprise tool with the right contractual terms are very different things, and plenty of firms have people using both without knowing which is which. For a professional services firm, that uncertainty sits directly on top of its core obligation to protect client information.
CLIENT DILIGENCE
Why are a firm’s own clients now asking about its AI use?
The pressure is increasingly coming from clients. I see it most clearly in diligence. AI use and SOC 2 status have become standard line items on outside counsel questionnaires and LP due diligence requests, alongside questions about what the firm does with client data and whether there is a real program behind its AI use. Over the past year those questions have gotten more specific and more frequent. A firm that cannot answer them cleanly is at a disadvantage in exactly the diligence that wins and keeps work.
THE CREDIBILITY GAP
What happens when a firm advises clients on AI risk but has no program of its own?
Plenty of firms publish sharp thought leadership advising clients on AI risk, and some run board-level trust events for those same clients, while their own internal AI use has no formal program behind it. That gap becomes uncomfortable the moment a client asks the firm to describe its own controls. The credibility a firm earns by advising well on AI is the same credibility it puts at risk by not governing its own use.
CAPACITY
What if the firm does not have the headcount to run a program?
Firm size shapes how hard this is. A large firm may have a CISO, a privacy lead, and a risk function to share the load. Many firms do not. At a smaller or mid-size practice, the people who would run an AI governance program are the same people already running everything else, and there is rarely dedicated headcount for it. The work still has to happen. It just has to happen without pretending the firm has a team it does not have, which usually means being deliberate about scope and bringing in outside help for the parts that need specialist depth. This is where AI governance and SOC 2 readiness support tends to earn its place, by giving a lean team the structure and the expert guidance to stand up something defensible.
OWNERSHIP
Where should AI governance sit inside a firm?
AI use cuts across the whole firm, which means governance has to as well. It is tempting to hand the problem to IT or to the general counsel and consider it owned. Neither can carry it alone. IT understands the tools and the data flows. The GC understands privilege, confidentiality, and professional responsibility. The people actually using AI sit in practice groups, in marketing, in HR, and in operations, and each of them sees risks and use cases the others miss. The firms getting this right run it as a small cross-functional group with clear seats and a clear chair, so the people who own the policy are the people who understand how the firm actually works.
WHAT GOOD LOOKS LIKE
What does an AI governance program that holds up actually include?
A program that holds up starts with visibility. You cannot govern tools you cannot see, so knowing what is actually in use, including the unsanctioned tools, comes first. From there, use gets classified by risk, so that a marketing draft and a privileged matter document are not handled the same way. Accountability stays with a person, since the lawyer signs the work and answers for it regardless of what assisted in producing it. The AI vendors get the same diligence the firm would apply to any other processor of sensitive data, with real attention to retention and training use. And someone owns the whole thing, with a review cadence that keeps pace with how quickly the tools change. Frameworks like the NIST AI Risk Management Framework and ISO 42001 give useful structure for getting there. What matters most is building something the firm can actually run and stand behind.
WHAT THIS MEANS FOR YOUR FIRM
What to do next
If your firm is using AI, and it almost certainly is, the question a client will eventually ask is simple: how do you govern it. Being able to answer that cleanly is becoming part of the cost of doing business in legal services.
- Get visibility into the AI tools actually in use across the firm, including the ones no one formally approved.
- Name an owner and a small cross-functional group to carry the program, rather than leaving it to IT or the GC alone.
Frequently asked questions
Amanda Grady is Solutions Lead for Trust Services at GreenPlaces. She brings over a decade of experience in the technology assurance space at a Big 4 accounting firm, where she helped organizations build and prove out their internal IT controls. She holds a degree in Information Systems Management. Whether the work is SOC 2 readiness, ISO 27001 certification, or AI governance, Amanda’s focus stays the same: building programs that hold up to real scrutiny.
