Law Firms Urged to Build Stronger Defenses Against AI Risks
Most law firms lack AI policies despite widespread AI use and growing risks.
Why it matters: As law firms adopt AI, they face vulnerabilities and regulatory uncertainty that threaten client confidentiality and compliance, making robust risk management essential.
- 79% of legal professionals use AI, but over half have no or unknown AI policies.
- Only 3% of organizations achieve expected AI productivity or cost savings.
- Critical AI vulnerabilities can lead to credential theft and administrative breaches.
- Experts urge assigning defined purposes and strict controls to autonomous AI agents.
According to Clio, 79% of legal professionals use AI in some capacity, yet more than half of law firms either lack an AI usage policy or their staff are unaware of any. This gap creates serious risks amid a rapid AI adoption wave.
Gartner research, cited by TechRadar, reveals only 3% of organizations meet productivity or cost reduction goals from AI. Despite this, 85% of leaders plan to increase AI spending through 2027, signaling rising exposure to AI-related risks.
Security flaws have also emerged in AI infrastructure. For example, the LiteLLM AI gateway had vulnerabilities allowing users administrative control and credential theft. These issues were corrected in version 1.83.9, as reported by ITPro, but highlight the dangers of insufficient AI safeguards.
Cyberattacks are evolving with AI. The CyberCartel hacking group used AI agents such as Anthropic's Claude and SpaceX's Grok to automate attacks on over 400 Latin American financial institutions, including banks and payment apps. Anthropic has since blocked their access to Claude, per Tom's Hardware.
Infosys highlights that autonomous AI agents pose new governance challenges because they can access enterprise systems and act with minimal human oversight. They recommend each AI agent have a defined business purpose, accountable owner, unique identity, managed lifecycle, and narrowly scoped access. Agent-to-agent interactions should operate with constrained authority, according to TechRadar.
As Celine Ginther notes in the Clio report, "Effective governance is what takes a firm from scattered experimentation to confident, firm-wide use." Law firms must build robust protective walls around AI to mitigate risks, protect client confidentiality, and meet emerging regulatory standards.
By the numbers:
- 79% — legal professionals using AI in some capacity
- More than 50% — legal professionals unaware of AI usage policies at their firms
- 3% — organizations meeting AI productivity or cost savings goals
- 85% — leaders planning to increase AI spending in 2027
What's next: Growing political pressure to regulate AI is prompting calls for legal and policy frameworks to clarify liability and compliance, especially as lawsuits against AI developers increase.