Q&A: No AI policy? Your staff already wrote one

Plenty of tech tools don't come with a policy. Why is having no AI policy a problem?

The difference is that legal organizations handle sensitive and confidential information that lawyers have a professional obligation to protect, so it is important not to assume that people “just know” how to use AI tools. 

Every week, I talk with lawyers who have various levels of AI sophistication, and many aren’t aware of some of the pitfalls or prepared to train the more junior lawyers and staff they supervise on best practices. Many express concern that they don’t know more or have insight into how others in their organization are using AI, but they aren’t sure where to start and keep putting it off.

You can take steps to lock down your systems, but that won’t stop someone from using AI on a personal device or address use of AI by your vendors, clients or other third parties you interact with. 

I heard you call this sort of use “Shadow AI” on the Move 37 podcast. Can you talk a little bit about what that means, and how widespread you think it is?

Shadow AI is when people in your organization are using AI without specific permission or the training and guardrails they need to use it responsibly. 

These usually aren’t bad actors; many of them are simply using tools that are available to them in the absence of direction. 

In every legal job I’ve ever had, people were pressed for time and, since the pandemic, many people are increasingly being asked to do more with less. If any business has not actively addressed whether and when it is appropriate to use AI, and there is more than one person working in that business, it is very likely AI is being used to streamline tasks.

A lot of firm leaders see AI as an IT project. Is that the right way to look at it?

Not really. Deciding how your firm is going to use AI, and addressing current use of AI, requires leadership and supervision. Lawyers are already obligated to supervise the people working under them, and AI doesn’t change that, but it does add another place where supervision has to happen. The questions that matter most aren’t technical, but are things like:

IT and vendors can help with the tools, but firm leadership needs a clear view of where the firm is headed and has to own those answers. The leaders don’t need to be technologists to do this well. They need the same judgment they already use to run their firms.

In a previous job, you served on a corporate policies team, where a policy has to work for thousands of people, doing all sorts of different tasks. What did that teach you about writing an AI policy that a whole firm can follow? No matter the size of the team, and no matter their role.

One thing we focused on was what actually belongs in a corporate policy, versus procedures designed for implementation or aspirational goals that don’t set forth behavioral dos and don’ts. 

And if you want people to actually follow policies, you need to keep them as simple as possible and written in plain English. 

If a managing partner wanted a first-draft AI policy by the end of the month, what are the must-have sections?

I would start with the basic guardrails the firm needs for its risk tolerance and make sure the firm is also getting visibility into where lawyers and staff are already using AI, in parallel with developing a written policy. At a minimum, a first draft should cover:

The firm also needs to be clear on who owns the policy, how people will be trained on it, and how it will be reinforced. That last piece is critical to make sure the policy is more than words on a piece of paper.

So what you are saying is a policy alone isn’t enough? 
The most beautifully written policy won’t protect the licenses of a firm’s lawyers if no one has read it or truly understands why the rules exist. 

Many firms have historically relied on top-down mandates where people are simply expected to follow a new set of rules. My time in-house showed me how other businesses handle change management, and how much it matters to bring people along on an initiative as big as teaching and reinforcing AI guardrails. 

Clients are an important part of this too, especially since many firms are addressing AI to meet client expectations. Corporate clients in particular are getting impatient with not understanding how AI use by their firms is directly benefiting them, in terms of costs, efficiency or enhanced quality. I encourage firms to communicate proactively with clients about how their approach will affect delivery of services, rather than waiting for clients to ask.

I’m guessing this part is also not something you can hand off to IT.

I think the key, more than which role or title owns AI responsibilities, is making sure someone actually owns it and there isn’t a situation where everyone thinks someone else is doing the job. 

It doesn’t necessarily have to be a technical expert, but I’d advise against picking someone based on bandwidth alone if they aren’t invested in the initiative or prepared to deal with what will probably remain a very fluid area for the foreseeable future.

Fluid as in, firms should expect to update their policy as the tech changes?

Because this area is evolving so rapidly, I would plan to check in at least two to three times a year to see if the policy still fits the tools the firm is using and reflects what the firm has learned about what is working well and what isn’t. You may not need a rewrite each time, but you want to keep your policy from becoming stale.

If a firm leader does one thing this week to try and bring shadow AI use out into the open, what should it be?

Block time on their calendar to focus on next steps. Depending on how far along the firm is, the next steps might include scheduling a conversation with their office manager or IT staff to start getting visibility into where AI is already being used in their firm, or sketching out that basic list of AI dos and don’ts. 

For firms that are further along, it might be time to revisit whether they need more training and reinforcement on policies that were already rolled out, or to focus on the client communications piece. No matter what those next steps are, committing specific, uninterrupted time, rather than feeling overwhelmed and saying “I’ll get to that later,” is going to be the best way to move forward.

What’s something currently on your radar that’s shaping how you’re thinking and working right now?

I really enjoyed the book “Unprecedented: Designing a Human-Centered Law Firm When Everything Is Changing”, by Jennifer A. Leonard. She walks through the history that shaped the legal industry into what it is today, major trends that are pushing firms to innovate and practical ideas for moving into this new era. She frames it all around a fictional firm retreat, which makes the content memorable and easily digestible.

Thursday's newsletter: Accused of murder by a TikTok tarot reader
The most recent Q&A: Networking vs. netsocializing vs netselling
In the vault: Every firm growth and marketing lesson we've published for small firms this year