The AI Governance Gap Is an Active Legal Risk in 2026

The important question about AI in legal work in 2026 is no longer whether lawyers will use it. They already do. The harder question is why so many firms still treat that use as informal experimentation when the output can reach a court, a client, a regulator, a privilege log, or a billing entry.

The adoption numbers are no longer marginal. 8am’s 2026 Legal Industry Report says 69% of legal professionals use generative AI for work tasks, while only 9% work at firms with an enforced written AI policy; the same report says 54% of firms have no AI training plans and 43% have no AI policy and no plans to create one.[1] Other survey reporting points in the same direction: Clio’s 2026 work found 79% of legal professionals using AI tools in daily work, while related survey synthesis reported that 60% of firms lack AI usage guidelines and only about 40% provide AI training.[2]

One vendor survey should never carry an institutional-risk argument by itself. 8am sells to the legal market, and its respondent base may not perfectly represent every firm segment. But the problem is not one isolated finding. 8am, Clio-related reporting, ABA-adjacent survey synthesis, and Bloomberg Law coverage all point to the same structural pattern: lawyers are using the tools faster than firms are defining, training, enforcing, and auditing the conditions of that use.[1][2][3]

The Gap Is an Accountability Problem, Not a Software Preference

A law firm can tolerate a certain amount of uneven technology adoption. Some lawyers try a new research interface before others. Some practice groups automate intake sooner than others. That is ordinary operational variation. The present gap is different because generative AI use can alter the evidentiary, ethical, and confidentiality posture of legal work before a supervising lawyer, conflicts team, client, or court sees the result.

The weak point is the middle layer. A partner may approve an AI strategy. A vendor may demonstrate a secure workspace. But a junior lawyer cleaning up a filing at night, a paralegal summarizing a deposition transcript, or a business development lawyer drafting a client alert may be the person making the actual input decision. If the firm has not specified approved tools, prohibited data, review obligations, disclosure triggers, and billing treatment, the user becomes the control environment.

That is a poor design even when everyone is careful. It is worse when the institution praises efficiency while leaving the associate, staff attorney, or legal ops manager to guess which tools are safe, which outputs require verification, and which client matters require separate approval.

Privilege Is Where Informal Use Stops Looking Harmless

The public conversation around legal AI still spends a disproportionate amount of time on fake citations. Those incidents matter, but they are not the only serious failure mode. Confidentiality and privilege can be damaged before a hallucinated case ever appears in a brief.

United States v. Heppner, decided in the Southern District of New York in February 2026, is the kind of ruling risk committees should read closely. Reporting on the decision describes the court as warning that AI-generated documents may lose attorney-client privilege when the tools used lack contractual confidentiality guarantees.[4] The narrower point is not that every AI-assisted document loses privilege. The point is that tool choice, contractual protections, and confidentiality architecture can become privilege facts.

That matters because privilege review is not performed in the abstract. Someone later has to explain where client facts went, who had access, whether the vendor used inputs for training, what contractual restrictions existed, and whether the lawyer had authority to enter the information at all. A firm without approved-tool controls may discover the privilege issue only after the document is demanded, challenged, or described in discovery.

The immediate governance lesson is narrow but important: confidentiality is not satisfied by telling lawyers to “be careful.” It requires knowing which systems are permitted for client information, what the vendor promises, what the firm logs, and who can approve exceptions. For research workflows specifically, that control question is developed in Closing the Governance Gap for AI Legal Research.

Hallucinated Filings Are a Supervision Failure Before They Are a Technology Failure

The court record on AI-fabricated legal content is now too large to treat as a curiosity. A Haqq.ai and HEC Paris database had tracked more than 1,313 court proceedings involving AI-fabricated content as of April 2026, including 496 involving licensed attorneys.[5] That count should be read carefully. It is a database of documented proceedings involving AI-fabricated content, not a statement that every proceeding produced sanctions or that all uses were identical.

Even with that caution, the pattern is serious. Bloomberg Law has reported sanctions in the Sixth and Seventh Circuits for AI-hallucinated filings through March 2026.[3] Those sanctions are not simply reminders that generative AI can invent authority. They show what happens when output enters the litigation channel without a verification requirement that is clear, assigned, and enforced.

The Sullivan & Cromwell bankruptcy-filing episode is a different failure mode. Thomson Reuters reported that the firm apologized for AI-generated errors in bankruptcy filings during the 2025–2026 period, a fact that drew attention partly because the institution involved is not a marginal or unsophisticated actor.[6] Large-firm resources do not eliminate the need for workflow controls. They can even obscure the problem if the organization assumes its general quality systems will catch AI-specific defects without naming them.

A useful filing rule is not “AI may be used” or “AI may not be used.” It is more precise: if an AI system contributes to legal authority, factual representation, record citation, quotation, chronology, or characterization of evidence, the responsible lawyer must know what was checked, against what source, by whom, and before which filing deadline. Without that, the firm has not reduced risk; it has merely delayed the moment when the risk is assigned to a name on the signature block.

ABA Formal Opinion 512 Reads Like a Map of the Missing Controls

ABA Formal Opinion 512, issued in July 2024, did not create a special ethics universe for generative AI. It applied familiar duties to a new operating reality: competence under Model Rule 1.1, confidentiality under Rule 1.6, communication under Rule 1.4, supervision under Rules 5.1 and 5.3, candor under Rule 3.3, and reasonable fees under Rule 1.5.[7]

Those duties line up almost exactly with the governance gaps shown in the surveys. If fewer than half of firms provide training, competence becomes individualized guesswork. If firms lack usage guidelines, confidentiality depends on personal tool selection. If supervision duties apply but no one knows which associates or staff are using which systems, supervising attorneys are managing a process they cannot see. If AI reduces time spent on a task, fee reasonableness becomes a billing-policy issue rather than a private time-entry habit.

The fee issue deserves more attention than it usually receives. A lawyer who uses AI to accelerate a task may still add significant professional value through judgment, review, strategy, and accountability. But a firm cannot leave each timekeeper to decide privately how AI-assisted work appears on a bill. That is why billing treatment belongs in the same governance conversation as confidentiality and verification. A more detailed treatment of that issue belongs in Generative AI Billing Policies for Law Firms.

The supervision problem is similarly practical. Practice group chairs and matter partners need to know whether AI use is permitted for a matter, whether the client has restricted it, whether the tool is approved, and whether output review is documented. The duty cannot be discharged through a policy PDF that no one enforces.

Firm Size Changes the Shape of the Risk, Not the Existence of It

Solo and small firms face a visible policy gap. Clio’s 2026 Solo & Small Firm Report found that 57% of solo firms and 55% of small firms have no AI policy.[2] For those firms, the issue may be capacity: no dedicated risk officer, no legal ops team, and no separate technology committee to turn informal practice into enforceable procedure.

Large firms have a different exposure. Bloomberg Law reported that 78% of attorneys at large firms in its 2026 survey of about 40 firms had completed AI training.[3] That is a materially better training posture, but training completion is not the same as policy compliance, matter-level approval, client-specific restriction tracking, or auditability. The larger the firm, the more likely it is that AI use is distributed across research, diligence, drafting, marketing, knowledge management, and business services.

The practical difference is this: smaller firms may lack formal controls altogether; larger firms may have controls that are too general to reach the actual workflow. Neither condition is solved by saying the firm is “using AI responsibly.” That phrase has to be translated into tool lists, matter restrictions, logging, training, review, escalation, and consequences.

Regulators and Bars Are Moving From Awareness to Obligation

Bar regulators are no longer treating AI competence as an optional professional-development topic. New York adopted a mandatory AI-specific CLE requirement in Q3 2025, making it a useful signal that at least some jurisdictions are moving from general awareness to formal obligation.[8] The requirement does not, by itself, solve firm governance. It does make it harder for lawyers and firms to claim that AI use is too novel to be managed.

For firms with cross-border work, the EU AI Act adds a different kind of pressure. High-risk system compliance obligations are scheduled for August 2026, with potential fines described as reaching up to €35 million or 7% of global annual turnover.[9] As of July 2026, the precise treatment of many legal AI systems under high-risk classifications remains an evolving question, particularly as member state regulators clarify scope. But that uncertainty is not a reason to postpone an inventory. It is the reason an inventory is needed.

The EU point is not limited to firms headquartered in Europe. A legal organization that uses AI in HR, critical infrastructure-adjacent work, regulated client services, or systems deployed into EU contexts may need to know what the system does, what data it uses, how it is monitored, and who is accountable for its operation. A firm that cannot answer basic internal questions in July 2026 will not become more compliant by waiting until a product owner or regulator asks for them in August.

What Control Actually Has to Reach

An AI policy that lives only at the level of aspiration will not meet the risk. The work has to reach the places where lawyers and staff make actual choices: what instruction to give a tool, which transcript to upload, which generated paragraph to keep, which citation to trust, which client to notify, and which time entry to submit.

• Approved tools: users need to know which systems may receive client information and which are limited to non-confidential use.
• Matter restrictions: client instructions, protective orders, regulatory limits, and jurisdictional obligations need to be visible before work begins.
• Verification standards: filings, citations, factual summaries, quotations, and record references need source-level review before external use.
• Supervision records: responsible lawyers need a way to know when AI materially contributed to work product they approve.
• Billing treatment: timekeepers need instructions on how AI-assisted work affects descriptions, time recorded, and client communication.
• Incident escalation: users need a non-punitive path to report a hallucinated citation, accidental upload, or client restriction problem before it becomes a filing defect or privilege fight.

That is not a complete policy template, and it should not be mistaken for legal advice. It is the minimum shape of a control environment. Firms that need to build the underlying framework can go deeper in Building a Law Firm AI Policy: 8 Essential Components, while tool-specific risk assessment is illustrated in Four Risk Categories for AI Deposition Summary Tools.

The Risk Has Already Moved Into the Workstream

The governance gap is uncomfortable because it exposes a mismatch between benefit and burden. Firms want the productivity story. Clients may want lower cost and faster turnaround. Vendors want adoption. But when an output is wrong, confidential material is mishandled, privilege is challenged, or a bill is questioned, accountability lands on lawyers and institutions that may never have built the controls they needed.

In 2026, unmanaged AI use in legal work is no longer a future transformation issue. It is a current control failure with documented consequences in privilege analysis, court sanctions, professional responsibility duties, training mandates, and regulatory deadlines. The firms that still treat governance as an innovation preference are misclassifying the problem. AI has already entered the workstream; the question is whether the institution around it is competent enough to bear the risk.

References

1. 2026 Legal Industry Report, 8am, 2026.
2. By the Numbers: What Surveys Show About Law Firm AI Adoption, North Carolina Bar Association, May 2026.
3. Law Firms Adopt AI Tools at Unheard-of Pace as Enthusiasm Grows, Bloomberg Law.
4. A 2026 Mental Model for Generative AI in Legal Practice, Stites & Harbison.
5. Legal AI Trends 2026, Legartis.
6. Legal Market Report 2026 Analysis: AI Bubble, Thomson Reuters.
7. The Key Legal Issues with Gen AI, Thomson Reuters.
8. Will AI Render Lawyers Obsolete?, New York State Bar Association.
9. An AI and Legal Tech Forecast for 2026, Relativity.