ChatGPT Outages Expose Law Firm AI Tool Concentration Risk

By the time the July 25 ChatGPT outage hit, the practical question for a law firm was no longer whether ChatGPT was “down today.” It was whether the firm had quietly allowed one general-purpose AI provider to sit inside research, drafting, review, summarization, voice, and API-dependent workflows without treating that dependency like infrastructure.

The July record is not clean enough to support a theatrical claim that every disruption was a full platform outage. It is strong enough to support a more useful risk finding: in one month, ChatGPT users saw at least seven disruption events or disruption signals, depending on whether short elevated-error periods and third-party reports are counted alongside OpenAI’s formal incident history. OpenAI’s status history captures formally reported incidents; Downdetector captures user-reported disruption signals that may be shorter, noisier, or outside OpenAI’s incident threshold.[1][2]

The July 25 event deserves special treatment because it was not merely another instance of a busy consumer product wobbling under load. CBS News reported that OpenAI attributed the outage to an upstream ISP failure, and the outage affected login, conversations, voice mode, and API access simultaneously.[3] For a firm using ChatGPT through a browser, custom GPTs, voice workflows, and internal API connections, that is not one inconvenience. It is one dependency chain failing in several places at once.

That upstream-provider detail is the part a risk committee should not slide past. It undercuts the comforting version of the problem, in which the firm only needs to ask whether OpenAI’s own engineering is mature enough. The dependency is broader than the vendor name on the procurement memo. It includes network providers, cloud services, authentication systems, model-serving infrastructure, and whatever undisclosed third-party components sit between the associate’s request and the returned answer.

Nor was unreliability discovered only after the fact. Polymarket’s July 2026 market priced a 60% probability of five or more ChatGPT outage days in July 2026.[4] A prediction market is not an incident log, and it should not be treated as proof of actual downtime. But as a pressure signal, it matters: market participants were already pricing repeated disruption as plausible while law firms were still largely talking about AI tools as optional helpers.

The Dependency Was Already There

A firm can survive an outage of a tool no one uses. That is not the posture many legal organizations now occupy. The ABA 2024 Legal Technology Survey, as compiled by HAQQ Research, put ChatGPT at 52% lawyer use-or-consideration, compared with 26% for Thomson Reuters CoCounsel and 24% for Lexis+ AI.[5] Those figures do not prove effective use, safe use, or daily use. They do show where professional attention has concentrated.

Bloomberg Law’s June 2026 survey reported that 83% of lawyers use AI at work, while also finding that efficiency gains lag the scale of adoption.[6] That combination is uncomfortable. If AI use is widespread but not yet reliably productive, firms may be absorbing both sides of the transition cost: workflow dependence when tools are available, and manual rework when they fail.

The concentration issue is narrower than the familiar debate over whether lawyers should use AI. A firm may have a careful verification protocol for hallucinations and still have no operational answer when the tool used to draft the first chronology, summarize the production set, or convert meeting notes into a client update becomes unavailable at 3:00 p.m. The hallucination problem asks whether the output is wrong. The outage problem asks whether the matter can still move, whether supervision can still be documented, and whether the client can be billed honestly for the workaround.

That distinction is easy to miss because ChatGPT entered many firms through individual lawyer behavior rather than infrastructure planning. It was tried in browser tabs, then tolerated in policies, then embedded into recurring work. Somewhere between those stages, an “assistant” became part of the production line.

A Four-Hour Failure Is Not Just Four Lost Hours

HYCU’s resilience analysis models a four-hour ChatGPT outage at a 100-attorney firm, using a $1,145 average hourly billing rate, as approximately $458,000 in direct lost-revenue exposure.[7] That number should be handled carefully. It is a modeled benchmark, not a verified average loss across law firms, and actual exposure depends on which workflows are interrupted, whether lawyers can shift to other billable work, and how the firm treats rework time.

Even with that caveat, the model does useful work because it forces the conversation into the right register. A four-hour outage is not only “people could not use ChatGPT.” It may mean a review team loses its first-pass summarization process, a litigation associate cannot complete a draft built around AI-generated issue mapping, a knowledge lawyer cannot update a practice note on schedule, or an internal tool using the API returns errors to everyone who thought they were using a firm system rather than OpenAI directly.

The billing question then becomes unattractive. If a lawyer spends an extra hour recreating work manually because a preferred AI tool failed, who bears that hour? If the client receives it, what exactly is the billing narrative? If the firm writes it off, where is that cost tracked? If no one tracks it, the firm has not eliminated the outage cost; it has buried it in realization, margin, or associate capacity.

Token prices are only a small part of dependency cost. The more durable cost is the combination of verification time, interruption time, tool-switching time, training time, and risk premium when the workflow is designed around one provider. That is why total cost discussions about legal AI need to include dependency and verification, not only model pricing or subscription fees. For a related cost discussion, see Why OpenAI API Pricing Misleads Legal Professionals.

Competence Includes Knowing What Happens When the Tool Is Gone

ABA Formal Opinion 512, issued in July 2024, tied generative AI use to existing professional duties, including Model Rule 1.1 competence and the obligation to understand the benefits and risks associated with relevant technology.[8] Most discussion of that opinion has focused on confidentiality, supervision, fees, and verification of AI output. Those are real obligations. But competence also has an operational dimension: a lawyer cannot supervise a workflow the lawyer cannot describe, interrupt, substitute, or verify.

The ABA’s February 2026 warning on AI dependence in legal practice sharpened that concern by addressing overreliance directly.[9] Dependence is not only psychological or intellectual. It can be procedural. If a team’s ordinary process assumes the AI tool will be available for intake summaries, deposition preparation, contract comparison, or draft restructuring, then an outage is part of the competence environment, not a vendor footnote.

Existing guidance still leaves a gap. It tells lawyers not to trust AI output blindly. It does not yet give firms a mature standard for AI-tool unavailability: how many alternate providers are enough, which workflows require fallback procedures, when an outage must be escalated, how workaround time should be billed, or how a firm should document that a responsible lawyer remained in control when the automated layer failed. A practical compliance program under Formal Opinion 512 should now answer those questions, not only tell lawyers to check citations. For a broader implementation framework, see How to Build an ABA Formal Opinion 512 Compliance Playbook.

Courts have already shown limited patience for AI-related failure when the problem is false authority or defective verification. NPR reported in April 2026 that sanctions tied to AI use totaled $145,000 in the first quarter of 2026, including a single Oregon order of $109,700.[10] Those sanctions are not outage cases, and they should not be treated as if they are. They matter because they show the allocation of responsibility: courts sanction lawyers and parties, not the model.

That allocation should shape outage planning. If an AI tool becomes unavailable and the team rushes, skips verification, misses a deadline, files a defective draft, or bills the client for avoidable churn, the defense will not improve much by pointing to the vendor’s status page. The lawyer remains responsible for the work, the supervision, and the explanation.

The sanctions trajectory for hallucinations is a useful warning, but it is not the same risk. Hallucination discipline is about checking what the machine says. Concentration-risk discipline is about keeping the legal workflow functional when the machine says nothing at all. For the former problem, see AI Hallucinations in Legal Practice: The Sanctions Trajectory.

The Cloud Analogy Is Brief, but It Is Damning

Law firms already understand that client files should not sit in a single unbacked repository. They ask cloud-storage questions about access controls, backup, restoration, data location, incident response, and vendor continuity. They may not always ask them well, but the category is recognized. No one has to explain from first principles why losing access to client documents for a day is a risk-register event.

AI-assisted work has not received the same discipline. Many firms can name their document-management-system backup plan faster than they can name the fallback for an unavailable AI research or drafting workflow. That mismatch is harder to defend as AI use moves from experimentation to ordinary practice.

The upstream-failure pattern is not hypothetical. In November 2025, BBC News reported that a Cloudflare outage disrupted services including X and ChatGPT, illustrating how a third-party infrastructure failure can propagate across platforms that users experience as separate products.[11] July 25 repeated the same lesson in a form more directly relevant to law-firm AI use: a provider outside the visible legal-tech stack can still stop the work.

What Redundancy Actually Requires

Multi-provider redundancy does not mean every lawyer needs three chatbots open at all times, or that every AI task deserves identical backup capacity. It means the firm has named the workflows where AI unavailability would create legal, financial, or client-service exposure, and has decided in advance what happens when the primary provider fails.

• Map AI use by workflow category: legal research, drafting, document review, deposition preparation, contract analysis, knowledge management, client intake, internal automation, and verification support.
• Assign fallback options by category: a second AI provider, a legal-specific platform, a manual process, a research-services team, or a decision that the work pauses until access returns.
• Define supervision rules: who approves use of the fallback, who checks the output, and what documentation is required when the team changes tools midstream.
• Set billing rules for workaround time: which time is billable, which time is written off, and when the client must be told that a tool failure changed the work plan.
• Review disclosed upstream dependencies during procurement: authentication, hosting, network, model, API, and data-processing dependencies should be part of vendor review where available.
• Test the plan periodically: a fallback procedure that no one has run is not meaningfully different from no procedure at all.

Tool selection should follow workflow risk, not brand enthusiasm. A firm may decide that a general-purpose model is acceptable for first-pass drafting but not for citation-sensitive research. It may use a legal-specific platform for research, a separate provider for contract analysis, and a manual verification process for final authority checks. The point is not to buy redundancy for its own sake. The point is to avoid discovering during an outage that the backup plan is a partner asking an associate to “just work around it.” For a workflow-based evaluation approach, see How to Choose AI Tools for Your Law Firm in 2026.

The firm also needs a record. Not a glossy AI policy that says lawyers remain responsible for their work, but an operational record that identifies the dependency, the affected workflows, the owner, the fallback, the testing interval, and the escalation path. If the outage affects a deadline-sensitive matter, the file should show how the team preserved supervision and why the chosen workaround was reasonable.

There is a useful procurement distinction here. A vendor’s statement that it has strong uptime or enterprise controls is relevant, but it does not eliminate concentration risk. The firm is not only buying features. It is accepting an operational dependency. If that dependency touches client work, the risk belongs in the same governance conversation as document systems, e-discovery platforms, cloud repositories, and docketing tools.

The Risk Register Entry

A disciplined entry would not say “ChatGPT is unreliable.” That is too broad and too easy to dismiss. It would say something closer to this: the firm uses one dominant AI provider across multiple legal and operational workflows; July 2026 showed repeated disruption signals and formal incidents, including a July 25 outage affecting login, conversations, voice mode, and API access simultaneously; at least one major outage was attributed to an upstream ISP failure; the firm has not tested substitutes for all affected workflows; outage-related rework may create billing, supervision, deadline, and client-service exposure.

That entry does not require panic. It requires ownership. Someone must know which matters depend on which AI tools, which fallbacks are approved, and how the firm will explain the workaround if the client, a court, a partner, or an insurer asks later.

The final standard is not that every firm must abandon ChatGPT, or that every AI workflow needs equal backup capacity. The standard is more modest and harder to evade: a firm that would never keep client files in a single unbacked cloud repository should not let legal research, drafting, review, or verification workflows depend on one AI provider without naming that dependency as a competence and financial risk.

References

1. OpenAI Status History, OpenAI.
2. ChatGPT Downdetector page, Downdetector.
3. OpenAI ChatGPT outage: Is ChatGPT down?, CBS News.
4. # of ChatGPT outage days in July 2026, Polymarket.
5. Legal AI Statistics 2026, HAQQ Research.
6. Analysis: 83% of Lawyers Use AI, but Efficiency Gains Lag, Bloomberg Law, June 2026.
7. What Resilience Means for Modern AI-Powered Law Firms, HYCU.
8. Overview of ABA Formal Opinion on Generative Artificial Intelligence, SimpleLaw.
9. Warning Signs of AI Dependence in Legal Practice, American Bar Association, February 2026.
10. Penalties stack up as AI spreads through legal system, NPR, April 2026.
11. Cloudflare outage took down X and ChatGPT, BBC News, November 2025.