Banner artwork by / LawVu
Most legal teams I talk to can’t reconstruct an AI-assisted decision. In fact, most respond to AI risk the same way they respond to legal risk: with a policy — acceptable use guidelines, an approved tools list, and a training deck. While they're all reasonable steps, not one of them produces a record.
A policy may tell you what you’re supposed to do, but the policy has no way of knowing the steps that were taken because the work becomes invisible the moment it enters the chatbot. And I've come to think of this as the same problem legal has always had with fragmented systems.
For years, the cost of scattered tools, inboxes, shared drives, and spreadsheets meant slower answers, duplicated effort, and institutional knowledge that lived in someone's head. And now, the use of fragmented AI tools raises the stakes considerably, because in most cases, they are as inefficient as they are ungovernable.
Banning the tools isn’t the answer
That gap between how much AI legal teams are using and how much of it can be accounted for is referred to as “shadow AI,” though the term is often discussed with negative connotations; shadow AI is rarely a discipline problem. And that’s why banning the tools does not solve the problem.
The reason why someone reaches for an ungoverned tool is because it is either faster, or because there isn't a better approved option. A ban removes neither reason; it just pushes the same work further out of sight. And no, a stricter policy won't fix this either. Instead, it comes down to creating an environment in which the sanctioned path is the most efficient and the record is created automatically.
Instead, it comes down to creating an environment in which the sanctioned path is the most efficient and the record is created automatically.
From policy to infrastructure
This is the difference between governance with a policy and governance with infrastructure. Where a policy describes intent, infrastructure captures what happens and what happened: which system touched a matter, what data it drew on, and who reviewed the output and when. That record becomes the byproduct of how work already moves through the organization, rather than a separate compliance exercise layered on top of it, or dependent on individuals remembering to maintain it.
Bill Deckelman, Chief Legal Officer at Andersen, recently shared in the 2026 Future of In-house Legal Report, “Transformation still depends on the work many teams avoid. Cleaning and structuring data. Defining processes clearly. Building consistent workflows. Without that foundation, even the most advanced tools will underdeliver.” Deckelman adds that “The appeal of AI creates the illusion of speed, but the underlying work remains disciplined and often unglamorous. AI does not remove the need for operational rigor. It amplifies whatever foundation exists.”
One connected foundation
Consider how differently the same scenario plays out in each setup: a lawyer asks an AI tool to summarize the risk position across twenty vendor contracts before a renewal cycle. In a fragmented setup, that request might touch a public chatbot, a downloaded spreadsheet, and an email thread. And if someone asks six months later which contracts were reviewed, the honest answer would be a guess.
In a connected platform, the same request runs against the matters and contracts already living in the one system, and the record of what it saw, and who signed off exists simply because that's how the request had to be made. There’s nothing to remember to capture, because the system does it by design.
This is part of why, at LawVu, we think about governance as something a connected legal operating system should produce automatically, not something a legal team has to build and maintain on top of a collection of disconnected tools.
Intake, matters, contracts, spend, and AI-assisted work all in one place make the record possible. Because if your record of AI-assisted work exists only because someone remembered to create it, you’ve established a fallible filing habit, not a system of record.
That’s why I believe most organizations are asking themselves the wrong question. Rather than “Do we have an AI policy?” the question should be whether what your policy describes can be reconstructed six months later. A document states intent, whereas infrastructure produces records.
If that gap is one you recognize, see how LawVu LegalOS produces the record automatically – intake, matters, contracts, spend, and AI-assisted work in one connected system.
Disclaimer: The information in any resource in this website should not be construed as legal advice or as a legal opinion on specific facts, and should not be considered representing the views of its authors, its authors’ employers, its sponsors, and/or ACC. These resources are not intended as a definitive statement on the subject addressed. Rather, they are intended to serve as a tool providing practical guidance and references for the busy in-house practitioner and other readers.
