Your Law Firm Approved an AI Tool. What Happens Next?

Your firm reviewed an AI platform, evaluated its security, and approved it for employee use. But approval alone doesn't mean the risks are being managed.

Artificial intelligence is becoming part of everyday legal work. Attorneys and staff may use AI to summarize documents, assist with research, prepare drafts, or organize information.

For law firms, these tools offer opportunities to improve workflows and reduce time spent on certain administrative tasks.

But introducing an approved AI platform also creates new questions.

Who is allowed to use it? What information can employees enter? Which activities require attorney review? How will the firm know whether employees are following the rules?

Those questions matter because selecting an appropriate platform is only one part of responsible AI adoption.

According to the Thomson Reuters 2026 Future of Professionals Legal Report, 34% of surveyed law firm professionals reported using AI tools their organizations had not authorized.

That finding highlights a challenge firms cannot address through vendor selection alone.

An approved AI tool doesn't automatically mean approved AI use.

The next step is establishing the policies, permissions, responsibilities, and oversight needed to use that technology appropriately.

Why AI Governance Doesn't End With Vendor Approval

On October 14, 2026, the American Bar Association held a program titled How to Vet AI Tools for Your Legal Practice.

The program addressed evaluating AI vendors, assessing security and confidentiality, identifying potential risks, and determining whether tools fit actual legal workflows.

These are important considerations before introducing new technology.

But what happens after a firm completes that review?

An AI application may have appropriate security features and contractual protections, yet employees may still use it in ways that create unnecessary exposure.

For example, an employee might enter confidential client information into a workflow that has not been approved.

A staff member might rely on AI-generated research without adequate verification.

Or an application might have access to more documents and information than a particular employee needs.

These are examples of implementation and governance risks rather than necessarily deficiencies in the AI platform itself.

Law firms need processes that address how technology is used, not simply which products have been approved.

The American Bar Association's Formal Opinion 512 on Generative Artificial Intelligence Tools reinforces the importance of considering professional responsibilities when using generative AI.

These include competence, confidentiality, communication with clients, and supervision of employees and other personnel.

Specific requirements depend on the circumstances, applicable professional-conduct rules, and relevant jurisdiction.

For firm leadership, the practical takeaway is that AI adoption needs ongoing oversight.

The First 30 Days After Approving an AI Tool

The following five steps provide a practical framework for firms introducing an approved AI application.

The 30-day structure is a suggested implementation roadmap, not an ABA-mandated timeline.

Step 1: Define Exactly What the Tool Is Approved to Do

A law firm may approve an AI application because it meets certain security, functionality, and business requirements.

But approval should not automatically extend to every possible use of that application.

For example, a firm might approve a tool to summarize nonconfidential administrative documents while requiring additional review before it is used with confidential client information.

Other activities may involve different levels of risk.

A document-drafting assistant may introduce considerations different from those of an application connected to client matter files or capable of interacting with other systems.

Questions your firm should answer:

• Which AI applications are approved for business use?
• What specific tasks are employees permitted to perform?
• Which uses require additional authorization?
• What information may employees enter or upload?
• Are certain matters, data types, or workflows excluded?
• Who can approve an additional use case?

These decisions should be documented in a way employees can understand.

An AI Acceptable Use Policy can help establish clear expectations for approved platforms, permitted activities, and the handling of sensitive information.

The goal is not to make AI unnecessarily difficult to use.

It's to help employees understand where the boundaries are before they begin relying on the technology.

Step 2: Review Access Permissions and Client Information

Many AI applications can interact with other software, documents, or information repositories.

Depending on the platform and configuration, this may include cloud storage, email, document-management systems, or other business applications.

Those connections can improve productivity.

They can also make existing access-control weaknesses more consequential.

Consider a hypothetical law firm whose document-management environment contains files from multiple clients and matters.

If an AI application can retrieve information based on a user's existing permissions, overly broad access rights may allow information to appear in workflows where it is not appropriate.

The firm should understand what the application can access and whether those permissions align with employee responsibilities.

Questions your firm should answer:

• Which systems can the AI application access?
• What client information may be available through those connections?
• Are employee permissions limited to appropriate information?
• Does the application use individual or shared accounts?
• Are integrations and access permissions documented?
• How will access be changed or revoked when responsibilities change?

An approved AI platform does not eliminate the need for appropriate identity and access management.

It makes understanding those controls even more important.

Step 3: Establish Requirements for Reviewing AI-Generated Work

AI-generated content can appear accurate and authoritative even when it contains errors.

That is particularly important in legal work, where attorneys may rely on research, case citations, contract language, or other information that requires professional judgment.

AI tools can support the preparation of legal work, but appropriate verification remains essential.

ABA Formal Opinion 512 addresses lawyers' professional obligations when using generative AI, including competence and supervision.

Firms should determine which AI-assisted activities require review and who is accountable for the final work product.

Questions your firm should answer:

• Which AI-generated materials require attorney review?
• Who is responsible for checking factual and legal accuracy?
• Are there procedures for verifying citations and legal authorities?
• How should employees handle uncertain or unsupported outputs?
• Are expectations different for administrative work and client-facing legal work?

For example, AI-generated internal meeting notes may require different oversight from AI-generated legal research intended to support a court filing.

The appropriate level of review depends on the activity and the potential consequences of an error.

Human oversight should be defined before AI-generated content becomes part of the firm's regular workflow.

Step 4: Make Sure Employees Understand the Rules

A written AI policy provides little protection if employees do not understand how it applies to their work.

Training should connect policy requirements to the situations attorneys, paralegals, and administrative employees encounter.

Employees should know which applications are approved, what information can be used, when additional review is necessary, and how to request authorization for new activities.

Consider an employee who finds an AI application that appears more useful than the firm's approved platform.

If the employee doesn't understand the approval process or doesn't have a practical way to request another tool, they may be more likely to experiment independently.

The Thomson Reuters finding that 34% of surveyed law firm professionals used unauthorized AI tools demonstrates why this issue deserves attention.

That figure describes reported usage in the survey, not a confirmed rate of security incidents.

Questions your firm should answer:

• Have employees received guidance on approved AI applications?
• Do they understand restrictions on confidential information?
• Are expectations tailored to different roles?
• Is there a process for requesting new tools or use cases?
• Do employees know how to report a potential mistake or concern?

Training should make responsible AI use easier to understand and follow.

An effective governance program supports useful technology adoption while establishing appropriate safeguards.

Step 5: Establish Ongoing AI Oversight

AI governance shouldn't end when employees finish their initial training.

Applications change. Vendors introduce new capabilities. Employees discover additional use cases. Permissions and integrations may expand.

A tool that was appropriate for one task when approved may later be used for activities that require additional evaluation.

Firms need a process for recognizing those changes.

Questions your firm should answer:

• Who is responsible for reviewing AI usage and governance concerns?
• How are new applications and use cases evaluated?
• Are relevant security and data-handling controls periodically reviewed?
• What happens when an employee uses an unauthorized application?
• How are policy exceptions documented and addressed?
• When should the firm reassess an approved tool?

Ongoing reviews can help identify discrepancies between written policies and actual practices.

Depending on the technology and controls in place, firms may also use technical safeguards to support approved-tool restrictions, access management, and sensitive-data protections.

These controls should be evaluated for their coverage and limitations.

The objective is to establish visibility into AI-related risks and a practical process for addressing them as the firm's use of technology evolves.

What Should Your Firm Be Able to Demonstrate After 30 Days?

At the end of an initial implementation period, firm leadership should have more than a record showing that a product was purchased and approved.

It should have a clearer understanding of how the tool is being used and managed.

These are practical examples, not a universal legal or regulatory checklist.

The appropriate controls and documentation will depend on the firm's activities, technology environment, and professional responsibilities.

A smaller law firm may approach these activities differently from a large firm with dedicated information-security and risk-management teams.

What matters is whether the firm has a reasonable process for making and documenting AI governance decisions.

Three Warning Signs Your AI Governance Program Needs Attention

Even when a firm has an AI policy, certain conditions may suggest that its governance processes deserve another look.

Employees Can't Explain Which AI Tools Are Approved

If employees are unsure which platforms they may use, the firm's policies may not be clearly communicated or consistently maintained.

This can create confusion about permitted activities and the handling of sensitive information.

Approval Is Treated as Permission for Every Use Case

An AI platform may be appropriate for certain activities without being suitable for every type of information or legal workflow.

Firms should maintain a process for reviewing material changes in how approved technology is used.

Nobody Is Responsible for Ongoing Oversight

Without defined ownership, new AI applications, integrations, and employee practices may develop without consistent review.

Assigning responsibility helps connect cybersecurity, professional obligations, and operational decision-making.

These warning signs do not automatically establish that a firm has violated an ethical obligation.

They can, however, identify areas where stronger governance may reduce unnecessary risk.

How Can Law Firms Evaluate Their Current AI Governance?

A firm doesn't need to wait for a security incident or an employee mistake to review its AI practices.

A useful starting point is comparing written policies with the tools, permissions, and workflows currently in use.

Leadership can begin by asking:

1. Do we know which AI applications employees are using?
2. Have we documented what those applications are approved to do?
3. Do we understand which client information and business systems they can access?
4. Are employees familiar with our AI acceptable-use requirements?
5. Have we defined when AI-generated work requires human review?
6. Who is responsible for evaluating new AI use cases and addressing identified concerns?

If the answers are unclear, an AI governance review may help identify gaps between the firm's policies and actual practices.

For organizations preparing to expand AI use, evaluating governance early can also help inform decisions about additional applications, employee access, and data protection.

How AvTek Supports Responsible AI Adoption for Law Firms

Law firms need a practical approach to AI adoption that supports productivity while protecting confidential information and managing technology-related risks.

AvTek Solutions offers AI Governance Services designed to help organizations understand and manage their AI environments.

These services include:

• AI Risk Assessments: Evaluating current AI usage and identifying potential cybersecurity, data, compliance, and business risks.
• AI Acceptable Use Policies: Developing guidelines for employee AI use and appropriate information handling.
• Approved AI Tools and Usage Standards: Helping establish which platforms are authorized and how they may be used.
• Data Protection and Privacy Guidance: Supporting safeguards that reduce unnecessary exposure of sensitive information.
• Roles and Responsibilities: Defining accountability for approvals, policy maintenance, and governance decisions.
• Ongoing AI Governance Guidance: Reviewing AI usage, policies, and emerging risks as an organization's AI adoption develops.

For law firms, these activities can help connect decisions about AI applications to the cybersecurity and governance practices supporting daily operations.

An assessment does not replace attorney oversight or determine whether every use of AI satisfies applicable legal ethics requirements.

It can help identify technology and governance gaps that firm leadership should evaluate alongside its professional responsibilities.

Responsible AI Adoption Starts After the Approval Decision

Selecting an AI platform is an important step.

But lasting governance depends on what happens next.

Employees need clear expectations. Information access needs appropriate controls. AI-assisted work needs suitable human oversight. And firm leadership needs a process for identifying and managing risks as the technology changes.

The goal isn't to slow innovation or make employees afraid to use useful tools.

It's to establish the safeguards and accountability needed to incorporate AI responsibly into everyday legal work.

Approving an AI tool is a decision. Governing how it's used is an ongoing responsibility.

Has Your Law Firm Evaluated What Happens After AI Approval?

If your firm has begun adopting AI but hasn't evaluated the security controls, policies, and governance processes supporting everyday use, an assessment can help establish a clearer picture.

Talk with AvTek about an AI Security and Governance Assessment.

Understand how AI is currently being used, identify potential risks, and determine practical next steps for protecting sensitive information while supporting responsible adoption.