The right balance starts with an honest premise: AI expands the threat landscape and exposes existing governance gaps. For law firms, client confidentiality, matter level data handling, and SRA obligations now sit under the same lens as identity and access controls.

The strategy shouldn’t simply be a binary “deploy or block” approach. It should be to adopt within a well governed environment where safe, ethical use is the default with the right support structures to aid people through the change. In legal, governance has a particular shape: clear policies on what may be processed by which tool, alignment with engagement letters and outside counsel guidelines and full observability over AI use across the organisation. Recent UK court rulings on AI-generated citations are a reminder that supervision is a professional duty, not a technical preference.

Cyber sits alongside this. Firms need data classification, risk-based access, audit logging and identity controls as a foundation. Without them, AI governance becomes paperwork.

Are firms getting it right? It’s mixed. The ones moving successfully start with a small, well-governed footprint, measure value, then scale. The ones struggling either rush to tools without a strategy, or stall until shadow AI fills the vacuum – and with it, uncontrolled exposure of client data and risk.

AI breaks that equation structurally. The cost of processing a million documents with AI is a fraction of the cost of having associates do it manually and it is a fraction that does not scale with document volume the way human labour does. The concern about AI widening the gap, that only the largest firms will access the best tools, misunderstands how legal technology is priced. Enterprise legal AI is sold as a subscription, often with a usage-based component.

A more pragmatic path is to scale AI capability through existing, proven vendors rather than trying to build that strategic vision top-down before they’ve earned the confidence to do so. This is faster, lower-risk, and lets the evidence accumulate in a way that can actually inform bigger decisions later.