Generative AI Governance Policies for Legal Departments

Legal departments settled the argument over generative AI use somewhere in the last eighteen months. Active use jumped from 23% to 52% in a single year, an ACC/Everlaw survey found, and the FTI/Relativity GC Report put usage among general counsel at 87%, up from 44% the year before. DISCO's survey found that 86% of law firms and corporate legal organizations plan to fold generative AI into routine legal work within two years. Whether to use the technology is no longer up for debate. What's left is harder: governing a technology that's already inside contract systems, HR platforms, and vendor products, not just sitting in a chatbot window an employee might open.

That's the real shift, and most legal departments have not caught up to it. Governance used to mean writing rules for how staff prompt a public chatbot. Squire Patton Boggs' June 2026 guidance states the scope now includes AI embedded in SaaS platforms, developer tools, HR systems, and a growing number of autonomous agents acting on their own initiative. Most of the AI policies sitting in law department shared drives were written for the simpler version of this problem, and they no longer match the environment they're supposed to control. A court in 2026 already ruled that exchanges with a public AI platform weren't privileged and weren't protected work product. That ruling turns a policy gap into a client's exposed secret, and no department wants to learn that lesson in front of a judge.

The difference between an AI policy and an AI governance framework

DISCO offered a useful analogy in an April 2026 piece: a policy is a speed limit sign. Governance is the whole city, the mayor's office, the courts, the charter that decides who enforces the limit and what happens when someone blows through it. A speed limit posted with no police department behind it is a suggestion. The same goes for an AI policy with no structure enforcing it, and this is where most departments get it wrong: they write the sign and stop there.

A policy document can't say who owns the risk when an AI tool produces a bad output that makes it into a filed document. It can't describe how the organization evaluates the next tool that shows up six months from now, doing something today's policy never anticipated. And it creates no accountability across departments, no way to check whether anyone is actually following what's written on page one. Governance fills those gaps with defined ownership, a process for approving new tools, a schedule for reassessing risk, oversight mechanisms that keep running after the policy gets signed, and an escalation path for when something goes wrong.

Squire Patton Boggs made the point in June 2026: AI governance is a living structure spanning legal, compliance, privacy, security, and product functions, and it has to change shape as the technology does. None of this means starting from a blank page. Most legal departments already have privacy policies, security policies, and vendor diligence processes, and governance builds on top of those instead of replacing them. The goal was never to slow innovation down, either. DISCO frames it the right way: governance is what makes responsible adoption possible in the first place, not a brake pedal.

Who owns AI governance in a legal department

Somebody has to own this, because "everybody" is not an answer; it's an evasion. DISCO's research describes a Center of Excellence model built around a small cross-functional leadership group made up of the CISO, the General Counsel, the CHRO, the CIO, and the Chief Data Officer. That group sets AI strategy, runs risk assessments on new tools before deployment, updates policy as needed, tracks whether the program is working, and builds a RACI matrix spelling out who's responsible, who's accountable, who gets consulted, and who just needs to be kept informed for any given AI outcome.

Regulated industries tend to formalize this further, with a standing AI Governance Group covering legal, privacy, security, product, and HR that owns policy, signs off on higher-risk deployments, and coordinates compliance across applicable regulatory frameworks. The federal government moved the same direction. OMB M-25-21, issued in April 2025, required federal agencies to name chief AI officers to oversee deployment and compliance, while a companion memo, M-25-22, addressed how agencies buy AI. Regulators keep converging on the same idea: AI needs a named owner.

Inside a legal department specifically, the General Counsel has to hold the professional liability piece directly. This one can't be delegated. When a court sanctions a lawyer for citing a hallucinated case, the sanction lands on the lawyer, full stop, regardless of who in the organization picked the tool or how convincing the vendor's sales deck was. ABA Formal Opinion 512 backs this up: lawyers need a reasonable grasp of what an AI tool can and can't do before they use it. "I didn't understand the tool" stopped being a valid excuse once these tools started appearing in filed briefs. DISCO's 2026 research frames the right mental model: bar associations increasingly treat AI output the way they'd treat work from a paralegal, whose work needs a lawyer's review before it goes anywhere. That's not a new category of professional responsibility. Forty states already impose a duty of competence covering the technology relevant to a lawyer's practice, so this sits inside a framework that already exists, it just has a new subject.

Mapping the AI landscape before you can govern it

Before anyone writes a rule, someone has to know what they're regulating. DISCO's 2026 framework treats landscape mapping as one of three foundational governance steps, and it aligns with the NIST AI Risk Management Framework's foundational principle: know what's out there before deciding what to do about it.

Most legal departments don't have that picture yet. Employees adopted tools quietly, without asking anyone, and some of those tools have been fed confidential material, privileged communications, or personal data nobody meant to expose. That's shadow AI, and it's the starting issue that almost every governance effort later runs into trouble over.

The scope here runs wider than most General Counsel expect walking in. Squire Patton Boggs' June 2026 guidance states AI now sits inside SaaS platforms, HR and performance systems, cybersecurity workflows, developer suites, customer-facing products, and a rising number of agents operating across all of the above on their own. That last category changes the inventory itself, because vendor contracts and diligence questionnaires written before generative AI existed need updating: the AI risk sitting inside an existing SaaS relationship is a different animal from a net-new AI purchase, and most legal departments haven't gone back to check the old contracts against the new reality.

Agentic systems raise the stakes further, because they don't just generate text when asked. They take action: sending something, updating a record, triggering a workflow, without a human clicking "send" first. So the inventory can't stop at cataloging which models are in use. It has to capture what those systems are authorized to do and what data they can touch while doing it. The output of all this mapping is a live inventory, sorted by risk, and it becomes the foundation for the approved-tool list, the risk tiers, and the audit trail.

Adopting a risk framework and classifying AI tools by their potential harm

Once the landscape is mapped, the next job is sorting it. DISCO's 2026 guidance points to the NIST AI Risk Management Framework as a key standard doing the heavy lifting, alongside ISO 42001, which is gaining traction across the industry. Neither is mandatory the way a statute is, but both give a governance program a shared vocabulary, and that matters more than it sounds like it should when five departments are trying to agree on what "high risk" even means.

ISO 42001 certification is beginning to follow a trajectory similar to SOC 2 Type 2 and ISO 27001, with client expectations around AI management standards gaining traction across the industry.

NIST's Generative AI Profile, AI 600-1, addresses risk categories that map directly onto legal work, including output reliability, data privacy, and information security concerns. Each needs its own control.

The EU AI Act adds a hard compliance deadline to all of this. Full high-risk obligations took effect in August 2026, deferred to December 2027 under the Omnibus package, which entered into force in July 2026. Certain AI uses in legal contexts may fall inside the high-risk category, and the penalties are not symbolic: up to €15 million or 3% of global annual turnover for high-risk violations, with the real ceiling, €35 million or 7%, reserved for prohibited practices under Article 5. Compliance-by-design is the only approach that actually works here, and departments that wait to retrofit will pay for it twice. Building risk assessments, documentation, logging, and human-oversight checkpoints into a deployment from day one costs far less than reconstructing them after a regulator asks for records that were never kept.

A practical tiering structure looks something like this. Low-risk tools (template generation, formatting, internal document search) can be self-serve with basic training. Medium-risk tools (contract review assistance, research summarization) need a human to check the output before anyone relies on it. High-risk tools (autonomous redlining, obligation monitoring, anything touching employment-related automated decisions) need Center of Excellence sign-off, documented oversight checkpoints, and an audit trail built to survive a regulator's questions.

One rule underlies all three tiers, and it isn't negotiable at any level: confidential, privileged, or personally identifiable data never goes into a consumer or personal AI account. Not occasionally, not with good intentions, never. Departments that treat this as a guideline rather than a hard line expose themselves to professional liability risk that a firm rule would have prevented.

Governance requirements specific to AI in contract and agreement workflows

Contract management has moved through roughly four stages: manual review, workflow automation, contract intelligence, and now AI-native contract lifecycle management, where continuous analysis, predictive risk flagging, and agent-driven automation run throughout the whole lifecycle instead of sitting at one stage of it.

The speed gains are real and well documented. Industry data from Loio, cited in TermScout's research, found AI reviewing a standard NDA in 26 seconds against 92 minutes for manual review, at 94% accuracy. That's not a marginal improvement; it's a different order of magnitude. But speed cuts both ways: an error an AI system makes propagates through a contract portfolio just as fast as a correct clause would. The same research found that over 90% of organizations still require a human to check AI recommendations before anyone acts on them, because the transparency gap hasn't closed. It hasn't, and the human checkpoint shouldn't disappear until it does.

Several controls follow directly from that reality. Human review gates before AI recommendations get acted on aren't optional for anything above low-risk paperwork. Vendor selection needs to prioritize explainable AI, systems that show their reasoning behind a clause suggestion instead of returning a verdict with no trail behind it. Models should be fine-tuned on an organization's own contract history and playbooks, so recommendations reflect that organization's actual risk tolerance instead of whatever generic training data the vendor used. Access control, encryption, and audit logging need to be built into the contract platform itself, meeting GDPR, SOC 2, or HIPAA depending on what the department handles. Clause-identification tools are only as good as the playbook and clause library governing what they pull from, so that library needs its own oversight, too.

Docusign's IAM platform shows where this category is heading, extending e-signature into full lifecycle automation, with Iris as its purpose-built AI engine for contract intelligence, a CLM layer for lifecycle management, and an AI-assisted review capability that suggests clauses from a centralized library, supports redlining, and routes agreements through workflows tied to systems like Salesforce or Microsoft Dynamics 365. The platform connects to more than 1,100 applications, which gives legal departments one governed, auditable environment instead of a patchwork of disconnected point tools, each carrying its own risk profile to track separately.

Agentic AI is the next frontier inside contract workflows, and it's arriving faster than most governance frameworks are ready for. A system that drafts, routes, flags, and escalates on its own needs governance covering not just what data it touches but what actions it's allowed to take without asking first. Industry observers note that leaders are adopting agentic contract capabilities quickly, and organizations without a governance framework for autonomous contracting will find themselves behind competitors who built one early. The financial stakes are already measurable: industry data attributes 9.2% of revenue leakage to poor contract management. Governance here is a line item, not a compliance exercise sitting off to the side. It's a line item.

The regulatory floor legal departments must meet in 2026

There is no single federal AI law to comply with, and there won't be one soon. The Atlantic Council noted that US AI governance has grown into a patchwork of agency guidance and voluntary frameworks, with states stepping in to fill the space the federal legislature hasn't. Legal departments have to track several obligations at once, not one, and treating any single law as the whole picture is how gaps open up.

The EU AI Act sets the floor for anyone touching EU markets: full high-risk obligations from August 2026, deferred to December 2027 pending formal Omnibus adoption, with penalties up to €35 million or 7% of global turnover, and a requirement to complete conformity assessments and stand up real human-oversight mechanisms. Colorado's approach shifted mid-course: the original SB 24-205 was repealed and replaced by SB 26-189, signed in May 2026, and the replacement law, effective January 1, 2027, focuses on transparency and disclosure for automated decision-making rather than the risk management and impact assessment regime the original bill called for. Illinois took effect January 1, 2026, requiring disclosure whenever AI plays a role in an employment decision, which matters directly to any legal department running AI through HR-adjacent workflows. GDPR Article 22 has been in force for years and gives individuals the right to refuse being subject to a fully automated decision with legal or similarly significant effect, unless one of three narrow exceptions applies: contractual necessity, legal authorization, or explicit consent, each requiring its own safeguards. And OMB M-26-04, from December 2025, set new procurement and transparency requirements for generative AI systems and large language models specifically, which matters to any legal department working inside or alongside a federal agency.

A December 2025 executive order tried to preempt state AI laws outright, and it's already facing serious constitutional pushback. Gunderson's February 2026 guidance was blunt about it: companies should keep complying with existing state laws until courts or agencies actually settle what the order does and doesn't reach. Betting against state law based on an EO still working through the courts is a gamble with someone else's exposure, not a compliance strategy.

Put together, for a legal department with EU exposure, regulated customers, or operations touching Illinois, a major city, or Colorado, a written AI governance policy in 2026 is the floor, the bare minimum, not a mark of diligence. Global spending on AI governance and compliance tooling is projected to hit $2.54 billion in 2026, and that number alone says how seriously the market has already priced in the risk of getting this wrong.

Making governance a living discipline rather than a document that goes stale

None of the above holds up if it's treated as a document filed away after the sign-off meeting. Squire Patton Boggs' June 2026 guidance calls for governance to be pressure-tested continuously, not reviewed on some fixed annual cycle, because the technology and the regulatory landscape move month to month, not year to year.

The framework outlined here, mapping the landscape, classifying risk, assigning ownership, meeting the regulatory floor, only works as a cycle, and departments that treat it as a one-time project are the ones that end up scrambling. New tools appear faster than any annual review can catch them. Regulations shift, as Colorado's reversal with SB 26-189 already demonstrated inside a short span. Agentic systems keep expanding what AI is authorized to do inside contract workflows and beyond, often faster than the Center of Excellence charged with approving them can keep pace. A governance framework that isn't built to absorb that speed is already behind the moment it gets published. In an environment moving this fast, a framework that's a year old deserves the same scrutiny as one that was never written.