Why AI Use Needs Governing Here
Lawyers use AI to summarize documents, draft and translate, and the documents are privileged and confidential by nature. A brief pasted into a consumer AI tool sends client confidences to a vendor the firm has no agreement with, and leaves no record for the conflicts or risk partner.
The Policy a New Client Starts With
A client created with the Legal industry starts with these policy packs:
- Confidential Documents. Warn when confidentiality-marked content is shared.
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
- Sensitive Documents. Contracts, financial statements, HR and medical records, customer lists and credential files may only go to approved AI apps.
Every client also gets the baseline packs: Credentials & Secrets, CMMC — CUI & Export Control, Visibility Baseline, Prompt Injection & Jailbreaks.
Setting It Up
- Approve the legal AI the firm licenses, under its agreement.
- Apply the Confidential Documents pack so confidentiality-marked content asks for a reason first, and contracts only go to approved tools.
- Block document chat and translation tools that aren't approved.
- Give the risk partner the monthly report: what was used, by whom, and what was stopped.
Start every client in observe-only mode for two weeks, so the decisions are made on what staff actually use. The shadow AI audit describes the steps.
AI Apps to Decide On First
- HarveyHigh
- SpellbookHigh
- CoCounselMedium
- Lexis+ AIMedium
- ChatPDFHigh
- HumataHigh
- NotebookLMHigh
- SciSpaceMedium
- AskYourPDFHigh
- PDF.aiHigh
- ChatDOCHigh
- Acrobat AI AssistantHigh
- DeepLMedium
- Google TranslateMedium
- Otter.aiMedium
Questions
Can lawyers use general AI assistants?
With an approved tool and the firm's rules in place, yes. The risk is confidential material going to tools nobody approved, which is what the rules stop.
Are contracts recognized?
Yes. Document classification recognizes contracts, financial statements, HR records and customer lists, and the firm decides which approved tools may receive them.
What about meeting recorders on client calls?
Recorders keep the whole call on the vendor's service. Approve one the firm controls and block the rest.
All industries · The MSP AI governance guide · AI policy template