AI for Law Firms in 2026: What to Automate First, and What to Keep Away From a Model

AI for law firms: what to automate first, and what to keep away from a model

If you're a partner at a small or mid-sized firm, you've been sold AI from several directions this year: AI research, AI drafting, AI intake, AI billing. Some of it saves real time. Some of it has already ended up in sanctions orders.

We're an AI engineering company. We build AI systems for clients and run our own product in production, a website assistant called ConGreeto, so read this knowing we sell in this space. We've tried to write the guide we'd want a managing partner to read before talking to us or anyone else: where AI is safe and useful in a law firm, where it isn't, what your ethics rules now say, and when to buy a tool instead of having one built.

The risk is real, and it's concentrated in one task

The cases keep coming. Damien Charlotin, a researcher at HEC Paris, maintains the AI Hallucination Cases database, which tracks court and tribunal decisions where a party relied on AI-hallucinated content. When we checked it on 29 October 2026, it listed 2,241 decisions. 886 involved lawyers, 1,292 involved people representing themselves, and the rest involved judges, experts and others.

The best-known case is still the clearest. In Mata v. Avianca (S.D.N.Y.), Judge P. Kevin Castel found that two lawyers and their firm "submitted non-existent judicial opinions with fake quotes and citations created by the artificial intelligence tool ChatGPT, then continued to stand by the fake opinions after judicial orders called their existence into question." The court imposed a $5,000 penalty, jointly and severally (Opinion and Order on Sanctions, 22 June 2023). The same opinion also says: "there is nothing inherently improper about using a reliable artificial intelligence tool for assistance."

Legal-specific tools aren't immune. A Stanford study published in May 2024 tested leading AI legal research tools and found they "hallucinate between 17% and 33% of the time", fewer than a general-purpose chatbot but far from zero (Magesh et al., Hallucination-Free?, arXiv:2405.20362). The products have changed since, so treat the numbers as a 2024 snapshot. The ABA cites the study in its own AI opinion.

Notice what these failures have in common: a model generating legal authority that nobody checked. That one task carries most of the risk. Plenty of other work in a law firm carries very little.

What your ethics rules now say

The two documents most worth reading in full are short.

ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024), PDF. The points that matter most when you buy or build:

Competence. Lawyers need "a reasonable understanding of the capabilities and limitations" of the tools they use. Uncritical reliance on AI output "can result in inaccurate legal advice to clients or misleading representations to courts."
Confidentiality. For "self-learning" tools that may reuse what you put in, the opinion says a client's informed consent is required before inputting information relating to the representation, and "merely adding general, boiler-plate provisions to engagement letters… is not sufficient." As a baseline, read the tool's terms of use and privacy policy.
Vendor diligence. Its checklist, carried over from the cloud-computing opinions: confidentiality that's enforceable, breach notification, whether the tool keeps your data after you stop using it, and whether it claims rights to it.
Supervision. Managing lawyers must "establish clear policies regarding the law firm's permissible use of GAI" and train people on it.
Fees. You can't bill clients for time spent learning a tool you'll use regularly. And if AI makes a flat-fee task much faster, charging the same flat fee "may be unreasonable".

Oregon State Bar Formal Opinion 2026-208, Chatbots and AI Agent Communications (February 2026), PDF. It's one of the first opinions on chatbots and AI agents, meaning systems that take actions, not just answer. Its example is worth quoting: if an agent decides that sending an engagement letter furthers the goal of signing a client, "it may do so without notifying or consulting the lawyer." The opinion's conclusion is that "it would be prudent to subject autonomous learning or actions by a chatbot to lawyer approval."

Your own state may have its own opinion (Florida, Pennsylvania, New York City, California and others have published guidance). This isn't legal advice: read your bar's opinions, and ask your malpractice insurer what it expects.

How to decide what to automate

AI is a good fit for a task in a law firm when the task is:

Repetitive. The same kind of question or document, many times a week.
Checkable. A person reviews the output before it leaves the firm, and checking takes less time than doing.
Not legal judgment. It doesn't advise a client, assess merits or decide strategy.
Not creating authority. It doesn't produce citations, holdings or quotations that someone might rely on without checking.
Clean on data. You know where the data goes, and it doesn't breach an ethical wall.

Run every proposal through those five. Most of what's worth doing passes easily. Most of what goes wrong fails 2 or 4.

What to automate first

1. Website intake and the first reply

This passes all five tests when it's designed properly, and it's where most firms lose the most business. In the secret-shopper study in Clio's 2024 Legal Trends Report, only 33% of US firms replied to an emailed enquiry, and 48% neither answered the phone nor called back (as reported by the Illinois Supreme Court Commission on Professionalism, November 2024).

An intake assistant should route the enquiry, capture the other party's name for the conflict check, flag deadlines, and book the consultation. It should never advise. Our sister product's team has written the detailed version: law firm website intake: what to ask, and what your chatbot must never say.

2. Scheduling, reminders and chasers

Booking consultations, reminding clients about appointments, chasing missing documents ("we still need your payslips for March"). Low risk and high volume, and nobody went to law school to send them.

3. Search over your own precedents and know-how

Most firms have years of good work they can't find: templates, past advice notes, research memos, clauses. A retrieval system (RAG) that searches your own documents and links every answer back to the source document is one of the most useful things AI can do in a firm. The lawyer still reads the source.

The hard part is permissions, not the AI. If a matter is behind an ethical wall, the search must never show it to someone outside the wall, not even as a snippet in an AI-generated answer. More on that below.

4. First drafts of routine documents and letters

Engagement letters from your own templates, routine correspondence, first-pass summaries of long documents for triage. Each one is reviewed by a lawyer before it goes anywhere. The ABA opinion's footnotes include a useful habit: mark AI-produced material as such when it's stored in a client or firm file, so later readers know to check it.

5. Time capture and billing narratives

Turning calendar entries, emails and documents into draft time entries for a lawyer to approve. That's useful, as long as you remember the fee points in Opinion 512 above.

What to keep away from a model (or always behind a check)

Citations and quotations nobody verifies. If a system produces case law, every citation must be checked against a primary source before a lawyer sees it, and the lawyer still reads the case. "The AI found it" is not a defence.
Advice to clients or prospective clients. Not from a website chat, not from an automated email reply.
Anything filed with a court without a lawyer reading every line. Opinion 512 also tells lawyers to check the court's local rules on AI use, which vary from court to court.
Agents that act without approval. Sending engagement or non-engagement letters, emailing opposing counsel, filing anything. Draft, yes. Send, only after a person approves, as the Oregon opinion advises.
Limitation dates and deadlines as final answers. A system can flag that a date matters. A lawyer calculates it.
Client data in tools that train on it. Unless you have the client's informed consent as Opinion 512 describes, and in practice you won't want to ask for it.

If you build: what the system must do

This is the part generic AI tools tend to get wrong in a law firm, and it's where a custom build can be worth the money.

Permissions checked at the moment of use. Every document in a retrieval system carries the matter it belongs to and who may see it, and that check runs every time a document is retrieved, before the model sees it. A permission recorded once, at upload, goes stale the day a wall goes up or someone leaves a matter. We've found this exact class of bug more than once in our own product (a permission checked when something was saved, not when it was used), which is why we now design for it from the first day.

Cite or refuse. Answers about your documents link to the exact passage they came from. If the system can't find a source, it says so instead of producing a plausible answer. For legal authority, a separate verification step checks every citation against a trusted database before anyone sees the output.

No training on your data, in writing. Use model providers' business terms that exclude your inputs from training, and say which providers are involved. Opinion 512's diligence checklist is a good list of contract terms to demand.

An audit trail. Who asked what, which documents were retrieved, what the model returned and who approved it. When a client or a court asks how a document was produced, you can show them.

Approval gates on every action. The system drafts. A person sends. If an agent can email, file or sign anything without a click from a lawyer, it's built wrong.

Model change without surprises. Models get retired. OpenAI is shutting down GPT-4o and GPT-4.1 in its API on 14 January 2027, for example. A firm system needs a test set of real (anonymised) tasks so you can prove a replacement model behaves before you switch. We wrote about what that migration involves.

Buy or build?

Buy for most things: legal research from an established legal publisher (with the verification habits above), practice management with built-in scheduling, and an intake assistant for your website.

Build, or have something built, when one of these is true:

Your know-how is the asset. Years of precedents, clause banks and advice notes that a generic tool can't search properly, or searches without respecting your walls.
Your systems don't talk to each other. Document management, practice management, billing and email need connecting in ways no product supports.
Ethical walls are complex. Many matters, many walls, and a retrieval system that has to enforce them exactly.
AI is part of what you sell. A client-facing tool, a fixed-fee product or a portal.

If you do talk to developers, us included, these 12 questions will tell you quickly whether they've built anything in production. For a firm, add three more: How do you enforce ethical walls in retrieval? How does the system verify citations? Which companies will see our data?

Frequently asked questions

Can law firms use AI ethically?

Yes. ABA Formal Opinion 512 (July 2024) allows it, subject to the duties of competence, confidentiality, communication, supervision and reasonable fees. The Mata v. Avianca sanctions opinion itself says there is "nothing inherently improper" about using a reliable AI tool. The problems come from unchecked output and careless data handling.

What should a law firm automate first with AI?

Website intake and the first reply to enquiries, then scheduling, reminders and document chasers, then search over the firm's own precedents and know-how, then first drafts of routine documents with lawyer review.

How common are AI hallucinations in legal filings?

As of 29 October 2026, Damien Charlotin's AI Hallucination Cases database listed 2,241 court and tribunal decisions involving AI-hallucinated content, 886 of them involving lawyers. A 2024 Stanford study found leading legal research AI tools hallucinated between 17% and 33% of the time.

Do we need client consent to use AI on a matter?

Under ABA Formal Opinion 512, informed consent is required before you put information relating to the representation into a self-learning tool that could disclose it, and boilerplate in an engagement letter isn't enough. Whether you need to tell clients in other cases depends on the facts. Check your state's rules.

Should a law firm build its own AI system?

Usually not for research or scheduling, where good products exist. A custom build makes sense when your own know-how is the asset, your systems need connecting, your ethical walls are complex, or AI is part of a service you sell to clients.

Sources

Damien Charlotin, AI Hallucination Cases database, checked 29 October 2026 (2,241 decisions; 886 lawyers, 1,292 pro se litigants).
Mata v. Avianca, Inc., No. 22-cv-1461 (PKC) (S.D.N.Y.), Opinion and Order on Sanctions, 22 June 2023.
Magesh, Surani, Dahl, Suzgun, Manning & Ho, Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools, arXiv:2405.20362, 30 May 2024.
American Bar Association, Formal Opinion 512, Generative Artificial Intelligence Tools, 29 July 2024.
Oregon State Bar, Formal Opinion 2026-208, Chatbots and AI Agent Communications, approved February 2026.
Illinois Supreme Court Commission on Professionalism, Phone Calls Ignored, Emails Unanswered, 1 November 2024, summarising Clio's 2024 Legal Trends Report.
OpenAI, API deprecations, notice of 14 October 2026.

This article is general information, not legal or ethics advice.

Related reading

Brillnex Systems builds AI agents, assistants and retrieval systems for businesses, and runs its own AI product in production. If one of the four custom-build conditions above fits your firm, tell us what you're trying to fix, or see our RAG implementation and AI agent development services.