AI for Law Firms: What Works and What Gets You Sued

AI for law firms is mostly a confidentiality question wearing a productivity costume. The capability argument was settled two years ago: the models draft, summarise and extract well enough. What decides your stack is what happens to client data after you paste it, and who verifies the output before it reaches a court.

I train professional-services teams on this, and the firms that get value share one habit. They picked three narrow jobs, wrote a verification rule for each, and refused to widen until the rule held.

Where AI for law firms actually pays#

Drafting routine documents. Engagement letters, client updates, standard clauses, first drafts of correspondence. The model produces something structurally correct in seconds; a lawyer edits substance instead of typing boilerplate. This is the highest-volume win in most firms.

Summarising long documents. Depositions, disclosure bundles, long contracts, case files. A summary with page references turns three hours of reading into forty minutes of checking. Insist on the references. A summary you cannot trace back is a rumour.

Intake and triage. New enquiries answered in minutes instead of days, sorted by practice area and urgency, with the obvious non-fits handled politely. This is the one that shows up in revenue, because unanswered enquiries are lost matters you can count.

Research triage. Finding the area to look in, not the authority to cite. Use it to narrow, then use the real database to confirm.

The rule that matters more than the tool#

Every filing, every citation and every factual claim gets verified by a human who opens the source.

This is not caution for its own sake. Lawyers in several jurisdictions have been sanctioned for filing briefs containing case citations the model invented: correct format, plausible names, no such case. The failure mode is specific and it is dangerous precisely because the output looks right.

Write the rule down, put a name against it, and make it a step in the workflow rather than an instruction in a training deck. Systems survive; good intentions do not.

Choosing tools without breaking confidentiality#

Ask three questions of any vendor, and get the answers in writing:

1. Is our input used to train your models? For legal work the answer must be no.
2. How long is it retained, and where? Retention windows and data residency decide whether a tool is usable in your jurisdiction at all.
3. Who can see it? Sub-processors, support staff, everyone.

The practical consequence is that free consumer tiers are usually out and enterprise or API tiers are usually in. That is a budget conversation, not a capability one. If you are still choosing a model, Claude vs ChatGPT compares them on the things that matter for document work, and Claude for small business covers the setup for a small team.

What a realistic first quarter looks like#

Weeks 1 and 2. Pick two jobs: intake replies and one document type you produce constantly. Write the verification rule for each.

Weeks 3 to 6. Run them with one lawyer and one paralegal. Time the before and after on real matters, not demos.

Weeks 7 to 10. Write the house standards: what may be pasted, what must be verified, what never leaves the firm. Two pages, not twenty.

Weeks 11 and 12. Train everyone else on the two working jobs and nothing else. Add the third only when the first two run without you.

The firms that fail do the opposite: they buy a platform, announce it, and hope adoption happens. AI literacy training is the piece that makes the difference, because a tool nobody trusts gets used badly or not at all.

What it does not do#

It does not give legal advice. It does not know your jurisdiction's current position. It does not know which of two plausible readings your judge prefers. It has no duty to the court and no professional indemnity.

It also does not replace paralegals in any firm I have seen. The work shifts toward judgement and away from first-pass review, which is a better use of a trained person and a worse story for a software vendor.

The three documents every firm needs first#

An acceptable use note. One page. Which tools are approved, what may be pasted into them, what must never leave the firm, and who to ask when it is unclear. Firms that skip this end up with associates using whatever they have at home, which is the outcome the policy existed to prevent.

A verification checklist. Attached to the workflow, not to a handbook. Every citation opened, every quoted fact traced, every figure checked against the source document. Signed by the person who did it.

A client disclosure position. Decide in advance what you tell clients about how their matter is handled, rather than deciding it in the middle of an awkward call. Some firms disclose proactively and find it is a selling point with commercial clients. Others say nothing and are asked anyway.

Write all three before the first licence renews. They take an afternoon and they are the difference between a firm using AI deliberately and a firm discovering it has been using it all along.

Measuring it honestly#

Track non-billable hours and response time to new enquiries. Both are countable, both move within a quarter, and neither requires you to pretend a model wrote the winning argument.

If the number that moves is headcount, you measured the wrong thing. If the number that moves is hours returned to fee-earning work, the system is working.

The short version#

Start with intake and drafting. Verify everything that leaves the building. Choose tools on their data terms first and their demo second. Train people properly rather than announcing a licence.

If you want this set up with your team and the house standards written for your practice, that is what my AI training packages cover, and the AI consultant for small business page is where I do this work for professional-services firms.