AI Governance for Law Firms
Find the AI your firm is already using. Then prove you're governing it.
Your clients are starting to add AI terms to their outside counsel guidelines. Your malpractice carrier is starting to ask at renewal. Most firms can't answer either question — because nobody has ever asked their own people what they use.
No credit card. No software to install. Nothing to monitor.
§1 AI SYSTEMS IN USE · 24
| ChatGPT | Elevated |
| Otter.ai | High |
| Harvey | Moderate |
| Microsoft Copilot | Moderate |
| “Scheduling bot” | Pending review |
§3 POLICY
§7 OUTSTANDING
- 01Review Otter.ai vendor terms
- 0213 acknowledgments outstanding
- 03Classify “Scheduling bot”
The problem
Three questions most firms can't answer
Ask your partners which AI tools the firm uses and you'll get a short list. Ask your paralegals and you'll get a longer one.
- 1
What AI is the firm actually using?
Not the tools you bought — the tools people use. Personal ChatGPT accounts, the transcription bot in the video call, the AI built into software you already pay for.
- 2
What client information is going into it?
Which matters, which data, whose accounts. This is a Rule 1.6 question before it is a technology question.
- 3
Can you show someone that you're managing it?
Not say it. Show it — with dates, versions, and names.
How it works
Five steps, about a week
- 1
Ask everyone
Send every person in the firm a one-click link. No login, no account. They tell you what they use, what they put into it, and whether it touches client matters. The survey opens with an amnesty note, because people who fear discipline don't tell you the truth.
- 2
Build the register
Answers resolve against a catalogue of hundreds of known tools, so “ChatGPT”, “Chat GPT” and “GPT-4” become one record instead of three. Anything unrecognised goes to a review queue — never discarded.
- 3
Score the risk
Every tool is scored on what data goes in, whether it influences decisions, whether clients see it, whose account it runs on, and whether a human reviews the output. The formula is fixed and explainable. No black box, no AI guessing.
- 4
Set the rules
Publish an AI policy from a law-firm template, assign it, and collect acknowledgments with timestamps. Assign training and record completions with renewal dates. Approve tools, restrict others, and give everyone a list of what they're actually allowed to use.
- 5
Prove it
Generate a governance report covering your AI estate, your risk distribution, who acknowledged what, who's trained, your vendor reviews, and your open issues. Save it as a PDF and send it.
Watch a two-minute overview
The difference
We know what your workflows are worth. Nobody else does.
Most governance tools can tell you that somebody uses ChatGPT.
This one can tell you that ChatGPT is being used for contract drafting — a workflow you've already scored as requiring partner sign-off, worth $42,800 a month in recovered time — by three people on personal accounts, with no documented human review.
That's the difference between an inventory and a decision. Because the platform started as a workflow audit, every AI tool connects to the actual process it runs, with the value and the risk already attached.
Privacy by design
We don't monitor your people
No browser extension. No prompt capture. No reading anyone's screen, inbox, or keystrokes.
Surveillance makes people hide what they're doing, which destroys the only thing that makes this work: an honest answer. So we ask instead, and we tell people up front that declaring something won't get them in trouble.
Everything in the system is a record someone created on purpose.
Professional responsibility
Supervision is already your obligation
Model Rules 5.1 and 5.3 make partners and supervising lawyers responsible for the conduct of the lawyers and nonlawyers they supervise. ABA Formal Opinion 512 applies that squarely to generative AI, alongside confidentiality under Rule 1.6, competence under Rule 1.1, and candour about fees under Rule 1.5.
Supervising something you haven't inventoried is difficult to evidence.
This platform produces the record: what the firm uses, what it decided, who was told, who acknowledged it, and when.
We're a tool vendor, not your ethics counsel. The platform documents what your firm does — it doesn't certify compliance with any rule, and it isn't legal advice. Have your policy reviewed by whoever handles your firm's professional obligations.
The evidence
One document answers all of it
When a client's outside counsel guidelines ask about AI. When your carrier asks at renewal. When a partner asks what the firm's exposure is. When something goes wrong and you need to show what was in place beforehand.
The AI Governance Report includes
| §1 | Every AI system in use, with its risk tier and who uses it |
| §2 | Your employee declaration results and response rate |
| §3 | Policy versions, who acknowledged which, and when |
| §4 | Training completion and renewal dates |
| §5 | Vendor assessments and review dates |
| §6 | Incidents raised, investigated, and closed |
| §7 | A prioritised list of what's still outstanding |
§1 AI SYSTEMS IN USE · 24
| ChatGPT | Elevated |
| Otter.ai | High |
| Harvey | Moderate |
| Microsoft Copilot | Moderate |
| “Scheduling bot” | Pending review |
§3 POLICY
§7 OUTSTANDING
- 01Review Otter.ai vendor terms
- 0213 acknowledgments outstanding
- 03Classify “Scheduling bot”
Who it's for
- 01
- Managing partners
- 02
- Firm administrators and COOs
- 03
- General counsel and risk partners
- 04
- Practice group leaders
Built for firms from 3 to 300. If you have more people than you can poll by walking around, this is faster.
FAQ
Frequently asked questions
Start with the question nobody has asked yet
Find out what your firm is actually using. Everything else follows from that.