The shadow AI audit.

In modernizing a firm, leadership tends to focus on the software it intends to buy. The more pressing reality is the software its people are already using.

Shadow AI, the unsanctioned use of AI tools by attorneys and staff, without the knowledge, vetting, or approval of IT or firm leadership, is an immediate operational reality for mid-market firms. Because these tools need zero installation and run in any browser, individual adoption has radically outpaced institutional governance.

A shadow AI audit is one of the first diagnostic steps we run during Practice Codification. It's a practical, non-punitive discovery process designed to align firm operations with regulatory compliance.

The root of universal adoption

Shadow AI isn't driven by malice or a wish to breach protocol; it's driven by professional utility. Lawyers, paralegals, and administrative staff face intense daily pressure to optimize output, meet deadlines, and lower client costs. When a professional discovers that a personal account on a consumer model, or a browser grammar extension, can summarize a voluminous deposition or draft a reply in seconds, adoption is instantaneous.

Because these tools are cloud-based and reached through a simple browser, they leave no footprint in the firm's hardware or software inventories. Managing partners frequently assume this is a junior-level issue, but senior practitioners are just as likely to lean on personal accounts to clear administrative or analytical backlogs. The gap between what a firm's official policy permits and what its workforce actually practices is near-universal.

A sober assessment of firm risk

Addressing shadow AI doesn't require an alarmist posture, but it does require a sober understanding of specific exposures, risks uniquely magnified by a law firm's fiduciary and ethical standard of care:

• Confidentiality and privilege waiver. Free or default consumer tiers often operate under terms that let the provider retain inputs to train future public models. Feeding client narratives, trade secrets, or litigation strategy into them can constitute a material confidentiality breach, or a waiver of privilege.
• Inconsistent work product. When attorneys use unvetted tools with disparate, unmanaged prompting habits, the firm loses its grip on a uniform standard of care, introducing real risk of unrecognized hallucinations, faulty statutory summaries, and flawed citations.
• Malpractice and insurability. Professional indemnity insurers increasingly evaluate a firm's documented internal data controls. Operating without a verified baseline of where client data is routed creates significant, indefensible exposure if a client demands an audit, or a leak occurs.

Exposing the invisible: how to find it

The audit replaces institutional assumptions with empirical facts. It is a collaborative fact-finding mission, not a disciplinary investigation, and it follows three practical avenues.

1 · Network and endpoint diagnostics

IT conducts a forensic review of outbound traffic, looking for high-volume transmission to known public AI endpoints, API gateways, and web-based PDF tools.

2 · Browser-extension audits

A central review of unmanaged extensions across firm-issued laptops routinely uncovers active AI writing assistants, translation widgets, and note-taking bots that scrape screen data automatically.

3 · Anonymous structured inquiries

We issue targeted, anonymous surveys to practice groups, and the framing matters. Instead of "Are you violating policy by using unauthorized AI tools?" we ask, "What external tools do you rely on to format text, condense long files, or draft initial correspondence?" Instead of "Have you uploaded client data?" we ask, "What operational bottlenecks make your daily billing or drafting tasks most frustrating?" The first set produces silence; the second produces the truth.

From prohibition to configuration

The data from a shadow AI audit points to one conclusion: blanket bans don't work. Blocking URLs or issuing prohibitory memos merely drives the behavior underground, frustrating high performers who recognize the need for leverage and pushing them onto personal devices to do firm work.

The right response is to move from prohibition to structured governance. The audit reveals exactly what utility staff are reaching for. If it shows that 40% of corporate associates are quietly using a consumer chatbot to summarize contracts, the directive is clear: give them an approved, secure, enterprise-grade alternative.

By deploying tools with strict data-isolation, where no input is retained for model training, and configuring them to mirror the workflows staff have already adopted, compliance becomes the path of least resistance. You secure the firm's data boundary not by building a wall, but by building a safer, more efficient channel.

← Back to insights