The evidence on law firm AI policies is not encouraging. Survey work in 2026 found that 57 per cent of solo practitioners and 55 per cent of small firms have no AI policy at all. A separate survey of more than 1,300 legal professionals found 43 per cent have no formal policy and no plans to write one, and that only 9 per cent work somewhere with a written policy that is actually enforced.
Set against adoption rates of 71 to 86 per cent depending on firm size, that is the governance gap in a sentence. Nearly everyone is using these tools. Almost nobody is governed while doing it.
The reason is usually not indifference. It is that firms imagine the policy has to be a substantial document requiring outside help, and so it stays on the list. It does not. A usable policy is two to four pages and can be written in an afternoon by someone who knows the firm.
Here is the structure.
1. Scope
Who this applies to and what it covers. Say explicitly that it covers everyone: partners, associates, trainees, paralegals, business services staff, contractors and temporary staff. Say that it covers AI features inside tools the firm already uses, not only tools branded as AI. Most firms are using more AI than they think because it arrived inside existing products.
2. Approved tools
A named list. This is the section that does the most work, and the one most often written as a principle instead of a list.
For each approved tool, record what it may be used for, whether client confidential information may be entered, and who to contact with questions. Then state plainly that tools not on the list are not to be used for firm work until approved, and name the person who approves.
Keep the list short at first. A short list that is accurate beats a comprehensive one that is out of date.
3. Confidential information
The core rule, in language people will remember. Something close to: client confidential information may only be entered into tools on the approved list, and only where the approval note says it is permitted.
Explain briefly why, referencing the confidentiality duty. In the United States that is Model Rule 1.6 as applied by ABA Formal Opinion 512. Elsewhere it is the equivalent professional secrecy rule, which in several jurisdictions is stricter.
Include the practical test people can apply at their desk: if you would not email this to an external supplier without a confidentiality agreement in place, do not paste it into a tool.
4. Verification
The non-negotiable section. Every factual assertion, every citation and every calculation produced with AI assistance is verified against a primary source before it leaves the firm.
Name who is responsible: the person whose name goes on the work. Not the person who ran the tool, not the supervising partner in the abstract. The signatory.
State the consequence of getting this wrong, and be specific rather than vague. The sanctions record now runs to more than 2,000 court decisions worldwide, and citing two or three real examples in the policy is more effective than any amount of exhortation.
5. Client disclosure and consent
When the firm tells clients, and when it asks permission. Cover three triggers: where outside counsel guidelines contain AI provisions, which increasingly they do and which are contractual; where client information would be disclosed to a provider; and where the client has asked.
Say who decides in an unclear case, and make it easy to ask. A policy that requires a partner meeting to resolve a routine question will be routed around.
6. Court and tribunal filings
A short section that matters disproportionately. Require that the standing orders of the specific judge are checked, because AI certification requirements vary judge by judge rather than by jurisdiction. Require that any certification is completed accurately. Require that the verification rule in section 4 is applied without exception to anything filed.
7. Prohibited uses
Short and concrete. Typically: no entering client confidential information into unapproved tools; no relying on AI output as final work product without verification; no use for decisions about employment, promotion or hiring without a specific approval, which is also where regulatory exposure is highest under the EU AI Act; no representing AI-generated content as independent human work where that representation matters.
8. Training and literacy
Who must be trained, on what, and how often. For firms with any EU footprint this is not optional: the AI literacy obligation in Article 4 of the EU AI Act has applied since February 2025 and requires demonstrable measures.
Record attendance. The record is the compliance artefact.
9. Questions and reporting
A named person, and an explicit statement that raising a concern about something already done will not be penalised. Firms that punish disclosure do not stop the behaviour, they only stop hearing about it, which is precisely how a fabricated citation reaches a filing.
Making it real
Three things separate a policy that works from one that sits on the intranet.
A named owner and a review date. This area changes every few months. An unowned policy is out of date within two quarters.
It appears in the workflow. In onboarding, in the filing checklist, in the matter opening process. Not only in a folder.
Someone checks. The gap between 43 per cent having no policy and only 9 per cent having an enforced one is the entire difference between writing a document and running a firm. Pick a light but real check: a question in the file closing process, or a periodic sample of filings.
Two pages that people follow beats twenty that nobody reads.
This is a structural guide, not legal advice. Adapt it to the professional conduct rules of your own jurisdiction.
Where the legal industry reads first.
Enjoyed this article? Get the biggest legal industry updates, deals, appointments, insights and expert interviews in your inbox, free.
No spam. Unsubscribe anytime.
