Before you switch on Copilot: five governance questions for law firms

Why governance comes first

Microsoft 365 Copilot works within each user’s existing permissions: it can find and summarise anything that person can open. In most firms, years of Teams sites, shared folders and “everyone” links mean people can open far more than they realise. Before Copilot, that was hidden because nobody went looking. After Copilot, a simple question can surface it.

The professional duties do not change either. The SRA’s warning notice on the misuse of AI covers client confidentiality, accuracy and governance, and the Law Society’s guidance on generative AI sets out the risks and the questions to ask. A firm that can show it decided the rules before rollout is in a far stronger position than one explaining afterwards.

AT A GLANCE

Five questions before rollout

Answer these first, and the rollout can go as fast as the firm likes.

• See

  What can it see? Check Teams, SharePoint and shared folder permissions first.

  No surprise access to other matters

• Decide

  Who decides how it is used? One owner, a short policy, approved uses.

  Clear rules people have read

• Check

  Who checks the output? Supervision applies to every AI draft.

  Errors caught before clients see them

• Agree

  What have your clients agreed? Some terms restrict AI on their matters.

  No breach of client terms

• Measure

  How will you know it is working? Measures set before you start.

  Value shown, not assumed

1. What can it see?

Start with permissions, not with the licence. Ask your IT support to:

• find Teams and SharePoint sites shared with the whole firm, or with “everyone”, and check whether they should be;
• check that matters with restricted access, such as conflicts, HR, partners’ papers and sensitive clients, are restricted in Microsoft 365 too, not only in the case and matter management system;
• review sharing links that never expire;
• confirm which of Microsoft’s tools for finding overshared content and limiting what Copilot searches are included in your licences, and use them.

Information barriers matter most. If the firm keeps teams apart on a matter for conflict reasons, Copilot must not bridge the gap.

2. Who decides how it is used?

Name one owner, usually a partner working with the COLP and the person responsible for data protection. Then write a short use policy, one or two pages, that covers:

• approved uses (for example summarising long email chains, first drafts of routine letters, preparing for meetings);
• uses that need care or approval (anything a client will rely on, anything involving special category data);
• what never goes in (for example material a client has asked to be kept out of AI tools);
• how to report a problem.

Complete a data protection impact assessment before rollout, and record the decisions. A policy nobody has read is not governance, so walk each team through it in ten minutes and ask for questions.

3. Who checks the output?

Supervision and competence apply to AI drafts exactly as they apply to a trainee’s. Agree how output is checked: who reviews it, what they check (facts, citations, figures, names), and how the check is recorded on the matter where it matters. Make it normal to say that AI helped with a draft, so checking is expected rather than awkward.

4. What have your clients agreed?

Some clients, particularly institutions and those with panel terms, restrict or set conditions on the use of AI on their matters. Check engagement terms and panel requirements, keep a list of clients with restrictions, and make sure fee earners on those matters know. Consider whether your own client care information should say how the firm uses AI.

5. How will you know it is working?

Choose two or three measures before rollout, so the benefit is shown rather than assumed:

• time saved on a named task (for example preparing a matter summary);
• take-up by team after one and three months;
• problems found by the checking in step 3, and what changed as a result.

Start with a small group from two or three teams, measure, adjust the policy, then widen it. Champions in each team will do more for adoption than any training session.

Start this week

Ask your IT support for a list of everything shared with the whole firm, name the owner of AI decisions, and check your three largest clients’ terms for anything on AI. Those three steps tell you how much work stands between you and a safe rollout, and in our experience it is usually less than firms fear.

It sits alongside keeping control of which AI sees your clients’ data, what you give a legal system permission to do in Microsoft 365 and the first 90 days after go-live.

We help firms prepare for AI independently: permissions, policy, client terms and adoption, whichever AI they choose.

Microsoft’s products and licences change often; check the current position with your IT support. If you think anything here is out of date, please tell us and we will correct it.