Your Lawyers Are Using AI, And Your Legal Department Has No Policy (Here’s Why It’s A Problem)

Let me ask you something uncomfortable:

How many AI tools is your legal team using right now?

Do they use AI for legal research? Contract review? E-discovery? Document drafting? Case strategy?

Does your legal department have a policy governing how lawyers can use AI?

If you’re like most organizations, the answer to the first question is “probably several” and the answer to the second is “no.”

The people responsible for governing AI across your entire company have no governance for their own AI use. And it’s creating exactly the risks they’re supposed to be preventing.

Why Legal Teams Think They’re Exempt

I see this constantly. Legal departments that demand strict AI governance for every other department… while their own lawyers are pasting confidential information into ChatGPT with zero oversight.

Lawyers assume their legal training makes them qualified to assess AI risk. It doesn’t. Understanding contracts doesn’t mean you understand algorithmic bias or data handling.

They’re using “professional” legal AI tools from established vendors, so they figure it must be safe and compliant. Often it’s not.

They’re stretched thin managing AI governance for the entire company. They haven’t had time to prioritize their own house.

Honestly, lawyers are used to being the smartest people in the room. Admitting they need governance for their own tools feels like admitting weakness.

The truth is, teams are making the same AI mistakes as everyone else. The consequences are just more ironic.

The Five Ways Legal Teams Are Creating AI Risk

1. They’re Feeding Confidential Information Into AI Tools Without Understanding Where It Goes

Your lawyer is drafting a motion. They use an AI tool to help with research and writing.

They paste in client names and case facts. Confidential business information. Attorney work product. Privileged communications.

They assume the tool keeps it confidential. But do they actually know?

Questions most lawyers can’t answer:

If your legal team doesn’t know the answers, they’re potentially waiving privilege, violating confidentiality obligations, and creating data security risks. And they’re doing it hundreds of times a day.

2. They’re Creating Work Product Without Knowing If It’s Privileged

Attorney-client privilege protects confidential communications between lawyers and clients. Work product doctrine protects materials prepared in anticipation of litigation.

But what happens when AI creates the work product?

Courts are starting to ask hard questions. If AI drafted the document, is it still protected? If the AI was trained on non-privileged material, does that taint the output? If multiple clients’ data trained the model, is there a conflict? If the AI provider can access your inputs, is the privilege waived?

Most lawyers have no idea how their AI tools affect privilege. They’re assuming it’s protected because they’re lawyers using legal tools.

That assumption may be wrong.

3. They’re Making Decisions Based on AI Outputs They Don’t Understand

Your lawyer asks an AI tool: “What’s the strongest precedent for this argument?”

The AI provides cases. The lawyer cites them.

Plot twist: The cases don’t say what the AI claimed. Or they’ve been overturned. Or they don’t exist at all.

This has already happened. Multiple lawyers have been sanctioned for citing fake cases generated by AI.

But it’s not just about hallucinated cases. It’s about AI-generated contract language that doesn’t actually say what you think it says. AI research that misses critical distinctions or updates. AI analysis that reflects biases in training data. AI recommendations that don’t account for jurisdiction-specific rules.

If your lawyers are using AI outputs without fully verifying them, they’re creating malpractice risk.

4. They’re Using AI in Ways That May Violate Ethics Rules

Every jurisdiction has rules of professional conduct for lawyers. Many now have guidance on AI use.

Common requirements: duty of competence includes understanding AI tools you use. Duty of confidentiality requires protecting client information in AI systems. Duty to supervise applies to AI just like junior associates. Duty of candor means you can’t submit AI-generated content without verification.

Are your lawyers trained on these requirements? Do they even know they exist?

Most don’t. They’re using AI tools with no awareness of the ethical obligations.

5. They’re Setting Terrible Examples for the Rest of the Company

Here’s the message legal sends when they use ungoverned AI:

“AI governance is for other people, not us. We’re special.”

Then they wonder why the engineering team ignores governance policies.

If legal isn’t following AI governance principles, why would anyone else?

The Legal AI Tools Your Team Is Probably Using (Without Governance)

Let’s get specific about where the risk is:

Legal Research AI (Westlaw AI, Lexis+ AI): Summarizes cases, suggests relevant precedents, answers legal questions. But how does it select which cases to surface? Does it have biases in what it prioritizes? What client information are you inputting to get results?

Contract Review AI (LawGeex, Kira, eBrevia): Reviews contracts, identifies issues, suggests revisions. But how was it trained? Does it catch all the issues a human lawyer would? What happens to contracts you upload?

Document Drafting AI (Harvey, CoCounsel): Generates legal documents, clauses, and memos. But is the output actually correct and current? Does it reflect jurisdiction-specific requirements? Are you creating work product that’s not protected?

E-Discovery AI (Relativity, Reveal, Everlaw): Analyzes documents, identifies relevant materials, predicts privilege. But how accurate is it? What’s the error rate? What happens if it misclassifies something?

General AI Tools (ChatGPT, Claude): Everything lawyers can think to ask it. But is your team using free consumer versions or enterprise accounts? Do you have contracts that protect confidentiality? Are you training your lawyers on proper use?

Most legal teams have no inventory of AI tools in use and no policies governing them.

What Legal AI Governance Actually Looks Like

If you want to govern legal AI properly (like you should), here’s what it requires:

Step 1: Inventory Your Legal AI Use

Survey your legal team. What AI tools are you using? What are you using them for? What information are you inputting? How often?

You can’t govern what you don’t know exists.

Step 2: Assess Risk for Each Tool

For every AI tool your legal team uses, evaluate the risks.

Confidentiality risk: Where does data go? Is it retained or used for training? Who can access it?

Privilege risk: Could using this tool waive privilege? Does the vendor have access to work product?

Accuracy risk: How reliable are the outputs? What’s the error rate? What verification is required?

Ethics risk: Does the use comply with professional conduct rules? Are there competence or supervision issues?

Step 3: Create Legal-Specific AI Use Policies

Your policy needs to address which AI tools lawyers can use, what approval is needed for new tools, what types of AI are prohibited, what contractual terms must be in place, what information can’t be input, and when AI use must be disclosed.

Step 4: Train Your Lawyers

Training needs to cover how legal AI tools actually work, risks specific to legal AI use, professional conduct obligations, verification requirements, and when to escalate concerns.

This isn’t optional. Professional conduct rules require competence in the technology you use.

Step 5: Monitor and Audit

Ongoing governance means regular reviews of what tools are being used, audits of how they’re being used, checks that policies are being followed, and updates as tools and regulations evolve.

If you’re not monitoring, you don’t have governance.

The Uncomfortable Questions to Ask Your Legal Team

Here’s how to know if you have a problem:

Ask your General Counsel: “What AI tools are our legal team using, and do we have policies governing their use?”

If the answer is “I’m not sure what everyone’s using” or “we don’t have formal policies yet,” you have ungoverned legal AI.

Ask your lawyers: “Show me the data handling agreement for the AI tools you use.”

If they can’t produce it, they don’t know where confidential information is going.

Ask about verification: “How do you verify AI-generated legal research or drafting before relying on it?”

If the answer is vague or inconsistent, they’re creating malpractice risk.

Why This Matters Beyond the Legal Department

Ungoverned legal AI isn’t just a problem for legal. It affects the whole company.

You can’t govern what you don’t model. If legal uses AI without governance, other teams will too. “If it’s good enough for our lawyers, it’s good enough for us.”

When legal teams waive privilege or violate confidentiality through careless AI use, the company loses critical protections.

If your lawyer misses something because they relied on flawed AI, the company gets sued. The client doesn’t just sue the lawyer, they sue the company, too.

And honestly? Legal teams are leading AI governance company-wide. If they can’t govern their own AI use, why should anyone trust their guidance?

Stop Being Hypocrites About AI Governance

I’m not saying legal teams are bad at their jobs. They’re incredibly competent at law.

But AI governance isn’t law. It’s a new discipline that requires understanding technology, data handling, algorithmic risk, and operational implementation.

And you can’t tell everyone else they need AI governance while ignoring it for your own department.

Schedule a 30-minute Legal AI Governance Review where we’ll:

We’ve worked with dozens of legal departments to implement AI governance that actually works, not just for the company, but for legal itself.

Because when your legal team is the one creating AI risk, who’s going to govern them?

Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor

brian@visionaiconsult.com | 877-424-7853