How Law Firms Are Using AI in 2026, Workflow by Workflow

The current problem with ai in the law is not that lawyers are refusing to use it. It is that use has moved faster than the controls around it. One 2026 legal-industry survey reports that 69% of legal professionals use general-purpose generative AI, up from 31% in 2025, while another reports that 79% use AI in some form but only 21% of firms have firm-wide deployment.[1][2] Those figures do not measure the same thing: the 8am survey skews heavily toward solo and small firms, while the ABA survey has broader firm-size representation. Still, the direction is hard to miss. Individual experimentation is common; governed deployment is not.

The policy gap is just as visible. In the 8am survey, 43% of firms reported having no AI policy and no plans to create one, and 54% reported no responsible-use training and no plans to provide it.[1] That is the uncomfortable operating environment: lawyers and staff are already testing tools on real work, while the firm may still be deciding whether AI belongs in a committee agenda.

A workable answer starts smaller than a grand AI strategy. Each workflow needs to be tied to a tool category, a human review point, and a professional-responsibility duty. If those three pieces are missing, the firm is not really deploying AI. It is letting people experiment and hoping the verification trail can be reconstructed later.

Document Review Is Where AI Looks Familiar, Until Privilege Enters

Document review is the least surprising place to find AI. Litigation teams have lived with technology-assisted review, clustering, email threading, near-duplicate detection, and analytics long enough that AI-assisted review does not feel like an alien workflow. The newer layer is generative assistance: summarizing document sets, flagging potentially privileged material, identifying issue patterns, and helping reviewers move faster through first-pass decisions.

That familiarity can make the risk easier to underestimate. A review platform with contractual confidentiality protections, access controls, audit logs, and a defined review protocol is not the same operational object as a consumer chatbot pasted into by a hurried associate. The ethics question is not simply whether AI touched documents. It is who had access, what data left the firm’s controlled environment, what the provider contract says, and whether a lawyer supervised the resulting coding or privilege decision.

The Heppner v. United States privilege issue gives that boundary a hard edge. As summarized in the GC AI ethics materials, the February 2026 S.D.N.Y. ruling treated use of consumer AI without contractual confidentiality guarantees as destroying privilege.[4] That should not be stretched into a claim that every enterprise legal AI system waives privilege. It does mean the firm must be able to distinguish approved systems from unapproved systems before anyone uploads client material.

For document review, the governance file should answer four questions before rollout: what categories of client data may be processed; whether the provider uses prompts or documents for model training; who reviews privilege calls; and what audit trail records changes to coding, issue tags, and privilege determinations. If no one can answer those questions, the tool may be useful, but the workflow is not ready for production.

Legal Research Now Carries a Verification Tax

Legal research is one of the most attractive AI workflows because the payoff is immediate: faster orientation, better issue spotting, and a draft path through unfamiliar authority. Thomson Reuters reported 74% use for legal research in its 2025 GenAI in Professional Services materials.[3] The tool market is also more varied than one label suggests. Legal teams may use Lexis+ AI, Protégé, CoCounsel, Westlaw AI-Assisted Research, Harvey, or a general-purpose system such as ChatGPT, depending on the task, budget, and risk tolerance.

Tool fit matters because the research job is not always the same. A lawyer looking for a controlling state-law standard needs something different from a lawyer building a first-pass map of arguments in a new regulatory area. For a deeper comparison by practice setting, see Which AI Legal Research Tool Fits Your Practice?. The operational point is simpler: the firm should decide what kind of research question each tool may answer, not merely whether the tool is allowed.

The sanctions record has changed the cost of casual use. Mata v. Avianca produced a $5,000 sanction in 2023; Lacey v. Washington County produced a $31,000 sanction in 2025; and Couvrette v. Wisnovsky produced a $110,000 sanction in 2025 after filings included 15 nonexistent cases and 8 fabricated quotations, according to the GC AI ethics synthesis.[4] The pattern is not that judges dislike AI. The pattern is that courts are losing patience with lawyers who file unverified authority.

That turns legal research into a two-track workflow. AI may help generate search terms, identify possible issues, summarize known authority, or test whether an argument has obvious weaknesses. It should not be the last system touched before a citation enters a brief. Every case, statute, quotation, pin cite, procedural posture, and parenthetical needs verification against a reliable legal source. A firm that wants a more detailed research-control process can use How to Use AI Legal Research Without Getting Sanctioned as the natural companion to this workflow map.

The review point should be named, not implied. If a junior lawyer uses AI to assemble a research memo, the supervising lawyer should know whether the cited cases were checked in Westlaw, Lexis, Bloomberg Law, a court database, or another authoritative source. A clean memo should preserve enough of that trail that the verifier is not forced to start from suspicion.

Summarization Saves Time, Then Moves the Risk to Context

Summarization is popular for good reasons. A litigation team can ask for a deposition summary, a chronology, or issue tags. A transactional team can ask for a term-sheet summary, a diligence memo, or a list of unusual provisions. A corporate legal department can ask for a regulatory digest or a board-material briefing. Thomson Reuters reported 74% use for summarization, placing it alongside legal research as one of the most common AI workflows in the cited use-case data.[3]

The risk is not always a dramatic hallucination. More often, the model compresses away the thing a lawyer would have noticed: a witness qualification, a defined-term dependency, an exception in the last sentence of a clause, or a procedural fact that changes how the summary should be read. That is why summarization belongs under Rule 1.1 competence and Rule 5.3 supervision even when no legal citation appears.

• Use AI summaries for orientation, issue spotting, and work allocation, not as a substitute for reviewing source material before a legal conclusion.
• Require source-linked summaries where the tool can provide them, especially for deposition, diligence, and regulatory materials.
• Mark summaries as AI-assisted when they will travel outside the drafting team or become part of a client-facing work product.
• Assign a human owner for the final summary, so later corrections do not become a search for whoever ran the prompt.

Drafting Is Useful Only After the Firm Decides What Counts as Review

Drafting tools are no longer limited to novelty prompts. Lawyers use AI to outline briefs, draft client emails, convert research notes into memos, propose contract language, create first-pass discovery requests, and revise tone. Thomson Reuters reported 59% use for drafting and 58% for contracts in the same 2025 use-case reporting.[3]

The drafting category covers very different risk levels. A tone revision to an internal email is not the same as a dispositive-motion section with citations. A clause suggestion inside a negotiated agreement is not the same as a generic business-development note. That difference should appear in the firm’s rules. Some drafting uses need confidentiality review. Some need citation verification. Some need partner approval before leaving the building.

The most dangerous drafting failure is allowing the AI-generated version to become psychologically final too early. Once a polished paragraph exists, reviewers tend to edit it rather than rebuild the analysis underneath it. For litigation drafting, that means the review protocol should force counsel back to the record and the law: confirm cited authority, confirm record support, confirm procedural posture, and remove arguments the lawyer would not be prepared to defend. For practical prompt and review boundaries around general-purpose tools, see How to Use ChatGPT for Law Without Getting Sanctioned.

Contract Analysis Needs Playbooks, Not Just Extraction

Contract analysis is often described as a technology problem: extract clauses, compare them to a playbook, flag deviations, and produce a diligence report. The tools may sit in CLM platforms, clause-extraction systems, AI-assisted due-diligence tools, or transactional drafting products. Examples in the market include Ironclad, Icertis, Spellbook, and Lexion, but the category matters more than the brand name.

The governance question is whether the firm knows what the extraction is being used to decide. A tool that identifies assignment clauses for a diligence spreadsheet may be appropriate for first-pass triage. A tool that determines whether a change-of-control consent is required before closing needs tighter review. The same output can carry different consequences depending on whether it informs staffing, negotiation posture, disclosure schedules, or closing conditions.

Contract work also concentrates sensitive information: pricing, employment terms, customer lists, technical obligations, indemnity positions, and transaction timing. Rule 1.6 review should come before upload, not after a client asks where its agreements went. Rule 1.1 review should include the tool’s known limits: whether it handles amendments, exhibits, inconsistent defined terms, scanned documents, foreign-language contracts, and clause variants that do not use the playbook’s preferred wording.

Prompt, Verify, Audit: The Minimum Operating Pattern

A single AI policy is too blunt for these workflows, but the control pattern can stay simple. ABA Formal Opinion 512, issued in July 2024, treats AI use through existing professional-responsibility duties, including reasonable understanding of technology under Model Rule 1.1 and supervision of AI as a nonlawyer-assistance issue under Model Rule 5.3.[5] The Prompt→Verify→Audit pattern described in the GC AI ethics materials is a practical way to translate those duties into daily work.[4]

The words used in an AI policy should also be precise enough that lawyers and staff know what is being controlled. “AI” may refer to search, predictive coding, generative drafting, retrieval-augmented generation, summarization, or analytics. If the firm uses terms such as hallucination, RAG, model training, grounding, or prompt logging, those terms should be understood by the people expected to follow the policy. For a plain-language terminology base, see Why AI Terminology Matters for Legal Professionals.

State guidance may add more detail. Florida Bar Opinion 24-1, issued in January 2024, addressed confidentiality, supervision, fees, and advertising in an end-to-end framework for generative AI use.[5] Other jurisdictions are moving on their own tracks. A national firm should treat the ABA approach as the baseline, then check local rules, court orders, client guidelines, and matter-specific protective orders before declaring a workflow approved.

Client and Billing Pressure Should Not Decide the Control Standard

Clients are beginning to ask whether AI will improve speed, quality, and cost. Firms are also asking where saved time goes under hourly billing. Those are real business questions, but they should not decide whether a workflow is governed. Harvard Law School Center on the Legal Profession reported that, among 10 Am Law 100 interviews, only 9% of firms had introduced alternative fees despite 39% announcing plans; that finding is directional because the interview set was small, not a statistically representative market sample.[6]

The more immediate client conversation is disclosure and reliability. If AI changes how review is staffed, how research is checked, or how contract diligence is performed, the firm should be able to explain the human oversight built into the process. Clients do not need a product demo. They need to know their confidential information is protected, their legal positions are verified, and their bill is not hiding unmanaged experimentation.

Choosing the First Workflow to Govern

A firm does not need to adopt every AI workflow at once. It does need to stop treating personal experimentation as if it were deployment. The better first target is the workflow where adoption pressure, tool maturity, and ethics controls can be matched most clearly.

• If lawyers are already using AI for legal research, prioritize citation verification, approved tool lists, and filing-stage review.
• If litigation teams are using AI for document review, prioritize confidentiality terms, privilege protocols, reviewer supervision, and audit logs.
• If teams are using AI for summarization, prioritize source-linked outputs and human ownership of final summaries.
• If drafting is spreading through the firm, prioritize review standards by document type and ban unverified citations from entering client or court-facing drafts.
• If contract analysis is the target, prioritize data controls, playbook quality, and escalation rules for clauses that affect negotiation or closing decisions.

That is the practical line between experimentation and deployment. A deployed workflow has an approved tool category, a named review point, and a record that the relevant Model Rule duties were considered before the work left the team.

References

1. 2026 Legal Industry Report, 8am.
2. The Legal Industry Report 2025, American Bar Association, 2025.
3. How AI is transforming the legal profession, Thomson Reuters.
4. AI Legal Ethics, GC AI.
5. Legal Ethics: Practical Considerations for Lawyers Using AI in Modern Legal Practice, American Bar Association, July 2026.
6. The Impact of Artificial Intelligence on Law: Law Firms’ Business Models, Harvard Law School Center on the Legal Profession.