AI governance for in-house legal teams: five minimum controls
A team that has been running generative AI for six months asks to scale it, and nobody in the room can say what the rules are. That is the ordinary case, not the bad one. Use among US in-house respondents went from 23 to 52 percent in a year in the Association of Corporate Counsel's 2025 survey, while Thomson Reuters' 2025 report found 52 percent of organisations across industries still had no policy at all. The gap between those two surveys is where this starts.
Before a team scales, I want five controls on one page.
First, data handling. Write down what may enter a prompt: client identities, personal data and privileged material each need a rule, set before anyone opens a chat window.
Second, accountability. Every AI-assisted output has a named owner. The model drafts; a lawyer signs and answers for it.
Third, human review. Tie review depth to the impact and reversibility of the output, not to whether it leaves the team. High-impact or hard-to-reverse work passes a qualified reader who can reject it; a later spot check does not meet that bar.
Fourth, logging and records. Log the metadata and review trail: which tool, which version, who approved. Set a retention period and a deletion rule rather than storing full prompts by default. Memory is not a record when a regulator asks how a document was produced.
Fifth, error handling, and here the instinctive order is backwards. When an AI-assisted output fails, the first three moves are to roll it back, clear the session and rotate the key; each destroys the record you will need to explain what happened. Preserve first: the prompt and the output you chose not to retain by default, the model version, the logs. Then contain. And name, on the same page, who may switch the workflow off and who tells the business.
These five are the floor for a pilot, not the finished house. None of it needs a new platform or a committee: one page, linking out to each control, signed first by the general counsel. What none of the five settles is what an agent may reach while it reads a document a stranger wrote.
Published · Last updated
Sources
Next: KVKK standard contracts: what the first full year's 2,497 notifications say →