AI Case Studies  /  Case study

Law Firm AI Adoption Is Outpacing Governance

Individual lawyers have made generative AI a daily habit, but most firms still have no policy behind it. The 2026 data shows how wide that gap has grown and what it costs.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 2, 2026

Legal AI adoption is running well ahead of firm governance. The 8am 2026 Legal Industry Report found that 69 percent of legal professionals now use general-purpose AI, up from 31 percent a year earlier, while only 34 percent of firms have formally adopted it and 43 percent have no AI policy and no plans to write one. New research from the University of Hong Kong's LITE Lab reported the same split among Hong Kong and Singapore firms, naming hallucination risk, data restrictions, and unsanctioned "shadow AI" as the open problems. The firms treating this seriously, including Clifford Chance and A&O Shearman, have published written AI principles rather than leaving usage to individual discretion.

The gap that fits in two numbers

For most of the last two years the story about legal AI was a question of whether lawyers would use it. That question is settled. The 8am 2026 Legal Industry Report, based on a survey of more than 1,300 legal professionals, found that 69 percent now use general-purpose AI tools for work, more than double the 31 percent recorded a year earlier. Legal-specific tools doubled too, to 42 percent. The report put the shift in plain terms: instead of taking decades to reach most practitioners, adoption took about three years.

The problem is what the firms did while their people moved. The same report found only 34 percent of firms have formally adopted AI, 43 percent have no AI policy and no plans to create one, and just 9 percent have a written, actively enforced policy. More than half provide no AI training at all. Set the two figures side by side and you get a roughly 35 point gap between how many lawyers use AI and how many firms actually govern it. That spread, not the technology, is the real risk story for 2026.

What the Hong Kong research adds

The most recent data point sharpens the picture. On June 30, 2026, Law.com reported on new research from the University of Hong Kong's LITE Lab finding that law firms and in-house departments across Hong Kong and Singapore are deploying generative AI faster than they are building the structures to manage it. Contributors to the report named the same three open challenges that show up in the Western surveys: hallucination risk, data restrictions, and shadow AI.

That cross-border consistency matters. This is not a quirk of the American market or a single vendor's talking point. Firms on two continents, working under different regulators, are producing the same pattern. Adoption is bottom up and fast. Governance is top down and slow. The behavior is arriving before the rules.

Shadow AI is the gap made visible

When a firm has no approved tool and no policy, lawyers do not stop using AI. They use it quietly. Thomson Reuters, in its Future of Professionals Report 2026, surveyed 1,816 professionals across 62 countries and found that 34 percent use AI tools their organization has not sanctioned and cannot see. Among professionals who feel their firm is moving too slowly, that figure climbs to 41 percent. The report is blunt about what that means for data exposure and privilege.

The concern is not abstract. Professionals told Thomson Reuters what they need before they will trust a tool: 96 percent said it must safeguard confidential data, 94 percent said outputs must be grounded in authoritative content, and 90 percent said the reasoning must be explainable. A consumer chatbot pasted with a client's settlement terms meets none of those tests. Every unapproved tool a firm does not know about is a privilege waiver waiting for a discovery request. This is exactly the terrain the [pillar on how law firms run on AI](/how-law-firms-run-on-ai) describes from the adoption side, and shadow AI is its shadow cost.

Hallucinations stopped being hypothetical

The governance gap has a courtroom price, and 2026 made it concrete. In April, Sullivan and Cromwell, one of the most established firms on Wall Street, apologized to a federal bankruptcy judge for submitting a filing with inaccurate AI-generated citations. When a firm of that stature files hallucinated authority, the excuse that this only happens to careless solo practitioners no longer holds.

It is also not rare. The AI Hallucination Cases Database maintained by researcher Damien Charlotin, which tracks court decisions worldwide where fabricated AI citations were addressed, had already recorded more than 200 cases in 2026. Each one is a filing where a human either did not verify the model's output or trusted a summary over the primary source. The tool did not cause the sanction. The missing verification step did, and a verification step is a governance decision, not a technical one.

What the firms getting it right actually do

The contrast is instructive. The firms treating AI as an institutional matter are not the ones using it least. They are the ones who wrote something down. Clifford Chance publishes a set of five AI Principles, covering integrity, confidentiality and privacy, responsible use, secure building, and open engagement, as part of a policy framework it introduced in FY24. A&O Shearman has published its own responsible AI guidance built on fairness, lawfulness, safety, and security.

Others show the deployment side of the same discipline. Linklaters rolled out the AI assistant Legora across the firm in late 2025, and Dentons Canada partnered with the AI company AXL in mid 2025. Even firms betting heavily on the tools keep the guardrails visible. Adams and Adams, described as Africa's top intellectual property firm, adopted Harvey AI and still framed the rule plainly: AI has to be babysat. That sentence is the whole governance philosophy in four words.

The regulatory backdrop makes the written policy less optional every month. The ABA's Formal Opinion 512, issued in July 2024, set six duties for lawyers using AI: competence, confidentiality, communication, fees, candor, and supervision, and all of them require human verification of AI output before it goes out the door. By early 2026, dozens of state bars had issued their own AI ethics guidance. A firm with no policy is not neutral on these duties. It has simply delegated them to whoever happens to be drafting.

Why the value gap and the governance gap are the same problem

There is a tempting counterargument: maybe the firms without policies are just moving fast and capturing the upside. The data says the opposite. Thomson Reuters found that 91 percent of professionals believe their organizations are falling short of what AI could deliver, a shortfall it labels the AI value gap. The dividing line was strategy. At firms with a named AI strategy, 66 percent said AI was meeting or exceeding expectations. At firms with no active strategy, that dropped to 22 percent.

Governance, in other words, is not the tax on adoption. It is what turns adoption into value. The firms that wrote the policy, picked the approved tools, and trained their people are the ones getting a return. The firms that let usage happen in the dark get the risk without the payoff. Clients have noticed. Thomson Reuters found 78 percent of corporate buyers call AI-enabled quality improvements important or essential, only 6 percent say most of their providers deliver, and 32 percent have reconsidered or plan to reconsider firms they see as behind. The gap is now a business-development problem, not just a compliance one.

What this means if you are the lawyer, not the firm

Most attorneys reading this do not set firm policy. That is exactly why the gap is an opportunity rather than only a warning. When 43 percent of firms have no policy and more than half offer no training, the individual who can run AI safely, verify every authority, and explain the process becomes the person the firm relies on. Skill here is scarce precisely because institutions have been slow.

The practical move is to build your own governance before the firm builds its. Decide which tool you trust for client-adjacent work and why. Pull every AI-generated citation to its primary source before it reaches a filing. Keep a short record that a human checked it. If you want to turn those habits into a repeatable, court-ready workflow rather than a nervous improvisation, that is the core of what [The Leveraged Attorney](/leveraged-attorney) teaches, and you can compare it against other paths in the [AI case studies library](/ai-case-studies/). The firms will catch up on governance eventually. The lawyers who are already fluent will be the ones they ask to lead it.

Browse all AI Case Studies

Informational analysis for working professionals, not professional advice.