The Firm That Never Made a Decision
Somewhere in the last year or two, someone at your firm started using AI. Maybe it was a paralegal summarizing a long document. Maybe it was an associate drafting a first pass at correspondence. Maybe it was you, testing something out on a quiet afternoon.
No one announced it. No one asked for permission. No one said it was off-limits either.
That is how AI adoption actually happens in most small and mid-sized law firms. Not with a policy rollout or a technology committee vote. It just starts, quietly, one task at a time.
The problem is not that your team is using AI. The problem is that no one has made a decision about how.
—
The False Binary Most Firms Accept
When the question of AI finally surfaces at the firm level, most managing partners land in one of two places.
The first is a blanket restriction. No AI tools, full stop. It feels safe. It feels controlled. In practice, it usually just means staff keep using tools quietly and the firm loses visibility into what is happening.
The second is the opposite. No formal policy, no approved list, no guidance. Staff use whatever they find useful and the firm moves fast. Except no one actually knows what data has been shared with which platforms, whether outputs are being verified, or whether the firm has any consistency across the team.
Neither of these is a governance approach. One is avoidance. The other is abdication. Both leave the firm exposed in ways that will eventually need to be cleaned up.
—
What Ungoverned AI Use Actually Looks Like
Here is a scenario worth sitting with.
A managing partner learns that several staff members have been using ChatGPT to draft client correspondence and summarize documents. No one said it was allowed. No one said it was not. When she asks around, she realizes there is no approved tool list, no guidance on what client information can or cannot be shared with a third-party platform, and no way to know what has already been uploaded.
The firm is not anti-AI. They are not reckless. They just never made a decision.
This is what I see regularly with firms navigating AI adoption. The exposure is not usually malicious. It is the result of a gap between the speed of adoption and the speed of decision-making.
In a professional services environment, that gap creates real risk. Client confidentiality obligations do not pause while the firm figures out its policy. Bar association guidance on AI use is developing, but the underlying duties around competence, confidentiality, and supervision are already in place. When staff use consumer-grade AI tools with no guardrails, client data may be processed by platforms with terms of service the firm never reviewed, and outputs may be used without appropriate verification.
None of that requires catastrophizing. It just requires acknowledging that the gap exists and closing it.
—
Why Governance Is an Enabling Function
This is the reframe that matters.
AI governance is not about distrust. It is not about assuming your team will do something wrong. It is about giving people a clear answer so they can move faster without second-guessing.
Right now, staff who want to use AI tools responsibly are often stuck in a quiet uncertainty. They do not know if the tool they are using is approved. They are not sure what client information is safe to include. They are doing their best, but they are working without a map.
A governance framework gives them the map. It says: here are the tools we have reviewed and approved, here is how you handle client data within those tools, here is how you verify output before it goes out the door, and here is who to ask when something is unclear.
That is not restriction. That is structure. There is a meaningful difference.
—
What a Practical AI Governance Framework Looks Like
For a law firm, AI governance does not require a legal tech department or a formal compliance program. It requires four things.
- An approved tool list.
This does not need to be long. Start with the tools your staff are already using and decide which ones the firm is comfortable with based on their data handling practices and terms of service. The goal is a clear, current list that staff can reference.
- Data handling rules.
Define what kinds of information can and cannot be shared with AI tools. Client names, matter details, and confidential documents require different treatment than internal templates or publicly available information. Make the line clear.
- Output verification standards.
AI tools make mistakes. Confident-sounding mistakes. The firm needs a clear expectation that AI-generated work product is reviewed before it is used, not treated as final. This is less about distrust of the technology and more about professional responsibility.
- A named owner.
Someone at the firm needs to be responsible for keeping the tool list current, fielding questions, and updating the framework as AI tools evolve. Without a named owner, the policy becomes a document that sits in a folder and stops reflecting reality.
These four elements do not solve every edge case. From a security standpoint, they do give the firm a foundation to build on and a clear starting point for conversations with clients, insurers, or bar authorities if questions ever arise.
—
The Connection to Existing Obligations
It is worth naming something directly.
AI governance for law firms is not a separate compliance category. It connects to obligations the firm already has.
Client confidentiality is the obvious one. When client data is shared with a third-party AI platform, the firm needs to understand how that data is stored, processed, and retained. That is vendor risk management. The same analysis applies to any cloud tool the firm uses, and AI tools are no different.
Competence is the other thread. Several state bar associations have issued guidance on AI use, and while the specifics vary, the common thread is that lawyers remain responsible for the work product they produce, regardless of how it was drafted. Building verification into your process is not extra work. It is how you protect the standard of work the firm is known for.
—
A Clearer Way Forward
If your firm has not made a formal decision about AI yet, the place to start is not with a policy document. It is with a clear picture of what your staff is already using.
Ask the question directly. You may be surprised by the answer. What you learn will tell you exactly where the gaps are and what kind of structure would actually fit your practice.
From there, the framework builds naturally. Approved tools, data handling rules, verification standards, and a named owner. Practical, clear, and proportionate to where your firm actually is.
AI is a legitimate tool. Your team deserves a framework that lets them use it well.
If you want to think through what that looks like for your specific practice, you can book a conversation at https://diasystems.net/schedule-now/. We can start with what your staff is already using and go from there.
—
What is your firm’s current approach to AI tools? Have you made a formal decision, or is it still evolving? I would be glad to hear where other firm leaders are in this process.