Moving from scattered experimentation to a structured approach legal teams can actually adopt.

Ask a law firm CIO or corporate legal leader whether the organization has rolled out AI, and the honest answer may depend on where they look.

The official AI project is still in planning. The policy is still under review. The training plan isn’t finished. But users are already experimenting. A partner is testing a legal research tool with AI features. An associate is using a public tool to clean up a first draft. A practice group is piloting a new workflow. In a smaller firm, one administrator is trying to set policy while also supporting users. In a larger firm, IT, KM, records, risk, innovation, and practice leadership are all working through pieces of the same problem.

That is the challenge: AI use can spread before an organization has a clear operating model for it.

This is what’s often called shadow AI — when attorneys and staff begin using AI tools faster than organizations can govern them.

In one firm, “AI rollout” means a formal pilot led by IT and KM. In another, it means three partners using different tools, an associate pasting language into a public AI site, and a firm administrator trying to decide what to block. Both firms have an AI adoption issue. Only one realizes it.

Consider this scenario: a 200-lawyer firm runs a careful three-month generative-AI pilot with one practice group. When leaders pull actual usage data at month four, attorneys across three other groups are already using public AI tools on live matters — they heard about the pilot and assumed the firm was “doing AI now.” The pilot didn’t lead adoption. It trailed it.

In a corporate legal department, the same problem may surface when lawyers or teams begin using embedded AI capabilities before Legal, Security, Privacy and Legal Operations have aligned on how they should be used.

This does not mean the organization has failed. It means the next step matters.

For legal organizations, successful AI adoption is not just about choosing a tool. It is about helping people understand what is approved, what is risky, what is useful, and how AI fits into the way legal work is actually done. Without that clarity, AI programs can stall before they scale. Worse, users may form habits the organization later has to unwind.

The problem is not curiosity. It is unmanaged behavior

Curiosity is healthy. Attorneys and staff are under pressure to work faster, find information more efficiently, reduce repetitive tasks, and improve client service. It makes sense that they want to know what AI can do.

The issue starts when curiosity moves faster than guidance.

What Is Shadow AI Use in Law Firms?

If users don’t know which tools are approved, they choose whatever is easiest to access. If they don’t understand how AI output is created, they either rely on it too quickly or dismiss it entirely. When practice groups experiment on their own, firms end up with duplicated pilots, inconsistent training, and no shared view of what is working.

That is not just a technology problem. It is a delivery problem.

The firm believes it is preparing for a controlled launch, while users are already forming habits around tools, prompts, shortcuts, and workarounds. Some of those habits are harmless. Some are useful. Some create risk. The firm needs to know the difference before expanding access.

Legal AI Adoption Audit: 6 Questions to Ask First

Before a firm expands AI access, it should take inventory. This does not need to become a six-month assessment. It should be a focused review that helps the right people understand what is already happening. In a large firm, that may include IT, KM, risk, innovation, training, and practice leadership. In a smaller firm, it may be the managing partner, firm administrator, IT lead, and a few key practice leaders.

A practical audit should answer six questions.

1. Where is AI already being used?

Look beyond the main AI platform being evaluated. Include public AI tools, legal research products, Microsoft and productivity tools, document automation, vendor add-ons, practice group pilots, innovation experiments, and informal attorney usage.

A firm cannot manage what it has not identified.

2. Which tools are approved, restricted, or prohibited?

Users need a clear answer to what they can use and where the boundaries are. If that guidance is vague or buried in a policy, people will make their own decisions based on convenience or peer behavior.

A simple model is often enough: approved for firm use, approved only with public or test data, restricted pending review, or prohibited for client information.

3. What information can be used with AI?

Firms need practical guidance on client data, privileged material, confidential information, internal work product, public information, and test data.

Users should not have to interpret a policy in the middle of a deadline. They need plain answers to common scenarios: Can I summarize a client agreement? Can I use a closing checklist? Can I ask AI to rewrite a client email? Can I analyze documents from a live matter? Does the answer change if the tool is approved by the firm?

4. Do users understand what AI can and cannot do?

Most users have seen impressive demos. That does not mean they understand the limits.

They need to know when AI is helping them work with existing material, when it is generating a likely answer, when source review is required, and when professional judgment controls. This is especially important in legal work, where a confident answer is not the same thing as a correct one.

5. Which workflows are appropriate to start with?

The first workflows should be narrow enough to support, easy enough to review, and useful enough that users care.

Good early candidates often involve repeatable work with a defined content set: matter ramp-up, internal status summaries, finding prior work product, comparing against approved templates, reviewing a set of documents for themes, or preparing a first-pass chronology. These are practical because the user can check the output against known material.

6. Who owns adoption after go-live?

Access is only the starting point. Someone needs to own feedback, training updates, policy questions, usage review, support paths, and decisions about what comes next.

That ownership cannot sit with one group alone, even in smaller firms. Someone needs to own the platform, someone needs to own policy, someone needs to make workflow decisions, someone needs to support training, and someone needs to decide what matters most for the firm. In a large firm, those responsibilities may sit with different teams. In a smaller firm, the same person may wear several of those hats. Either way, the roles need to be clear.

Why Legal AI Literacy Training Matters

One of the easiest mistakes to make is assuming users already understand the basics.

Many do not.

A lawyer may know AI can summarize a document but still not know whether the summary is based on the right document set. A legal assistant may know AI can draft language but may not know what information is safe to include. A practice group may want AI to search matter materials but may not understand how permissions, document quality, naming conventions, or matter structure affect the answer.

When that understanding is missing, users usually fall into one of three patterns: they avoid the tool because they do not trust it, rely on the output too quickly because they do not understand its limits, or use it inconsistently because no one has explained the rules in practical terms.

Basic AI literacy does not mean teaching lawyers to become technologists. It means giving users enough context to make good decisions. They should understand what the tool is designed to do, what content it can access, how permissions apply, why prompts and context matter, why output must be reviewed, and where to go with questions.

That education needs to be practical enough to hold up when someone is working late, under pressure, and trying to decide whether AI can help with the task in front of them.

Training has to follow the work

A general AI overview is useful, but it will not change behavior on its own. People adopt tools when they can see how the tool helps with work they already do.

That is why training should be organized around workflows, not just features.

For a litigation team, that may mean using AI to prepare a first-pass matter summary, identify key documents, create a chronology, or pull themes from a defined document set.

For a transactional team, it may mean comparing a draft against an approved template, checking a provision against client standards, or finding similar language from prior deals.

For firms without a formal KM function, it may be as simple as helping attorneys find examples of how the firm handled a similar issue, client request, clause, or motion. In larger firms, that same concept may become part of a broader knowledge strategy.

For business services teams, it may mean creating internal handoff notes, summarizing status updates, reviewing billing narratives, or reducing manual document review.

The goal is not to launch every use case at once. The goal is to start with workflows where the content is appropriate, the output can be reviewed, and the benefit is clear.

That is how users build confidence. It is also how the firm learns what support, policy clarification, and additional training are needed.

AI is only as good as the content it can reach

For legal teams, AI is only as useful as the content it can work with and only as safe as the controls around that content.

Legal work depends on matter context, precedent, client restrictions, document permissions, retention rules, and confidentiality obligations. In larger firms, that may also include ethical walls, complex security models, and formal information governance programs. In smaller firms, the controls may be simpler, but the obligation to protect client information is the same.

This is why the document management system has an important role in legal AI strategy. The DMS is where much of the firm’s work product, matter history, security model, and governance structure already live. When AI works within that environment, users are better positioned to ask questions of the firm’s own materials while staying within the controls the firm already depends on.

The point is not to make AI another disconnected destination. The point is to bring AI into the systems and workflows where legal work is already managed.

Go-live is not the finish line

A firm can enable AI for hundreds or thousands of users and still have no real adoption. Access alone does not prove value.

Before go-live, firms should decide how they will evaluate whether the rollout is working. The measures do not have to be complex. A smaller firm may track which users are trying the tool, what questions they ask, and whether it saves time on a few agreed workflows. A larger firm may track adoption by office, practice group, role, or matter type.

In either case, useful measures include which workflows are gaining traction, whether users return after training, what questions are being raised, whether guidance needs to be clarified, and whether the tool is reducing effort in specific tasks.

The most useful feedback often comes after the first few weeks. That is when users move past the initial demo effect and start applying AI to real work. Firms need a process for capturing that feedback, updating training, refining guidance, and deciding which use cases are ready to expand.

AI implementation should be treated as an ongoing delivery process, not a one-time launch event.

Where firm leaders should start

For firms already in motion, the next step does not need to be complicated. It does need to be deliberate.

Start with three actions.

1. Identify the current state.

Document where AI is already in use, which tools are approved, which pilots are active and where informal experimentation is happening.

2. Define the rules of engagement.

Clarify approved tools, data-use expectations, review requirements, restricted or prohibited uses, and escalation paths. Make the guidance practical enough to apply without interpreting policy language.

3. Train around real workflows.

Move beyond broad demos. Start with controlled workflows where the content is known, the output can be reviewed, and the organization can tell whether the work improved.

These steps help firms of any size move from scattered experimentation to a program users can understand, leaders can support, and the firm can improve over time.

Legal AI success starts before scale

The legal organizations that succeed with AI will not necessarily be the ones with the most AI tools. They will be the ones that choose their tools and use cases intentionally, apply them where they add value and scale what works.

They will know where AI is already being used. They will define what is allowed. They will teach the basics before expecting advanced use. They will connect training to real workflows. They will ground AI in firm-managed content. And they will measure what happens after go-live.

Legal AI adoption stalls when firms assume access is enough.

It isn’t — and the cost shows up as wasted licenses, abandoned workflows, and lawyers who decided early on that AI couldn’t help them.

The path to meaningful adoption starts with delivery readiness: clear expectations, prepared users, practical workflows, and a plan for turning early experimentation into better work.

For firms already exploring AI, the question is not only what the technology can do. It is whether the firm is ready to help people use it responsibly, consistently, and in the flow of their work.

Coming next in the series

Article two will pick up here on how to choose the first legal AI use cases. Which workflows earn user confidence early, and which ones quietly stall adoption? Tune in to learn more.