AI governance for a practice too small to have a committee

Why borrowed governance frameworks don't fit

I get asked fairly often by solo and small-firm lawyers to help them set up 'AI governance,' and what they usually mean is that they read an article describing a large firm's AI committee, use policy, and audit process, and they're worried they're supposed to have something similar. They're not, and trying to build a scaled-down version of a large firm's framework is usually worse than having no framework, because it creates paperwork with no enforcement behind it.

A large firm's AI governance exists to coordinate hundreds of lawyers who don't know each other, across dozens of practice areas, with a general counsel who needs a defensible answer if something goes wrong. A three-lawyer practice doesn't have that coordination problem. What it has is a much simpler, sharper problem: does everyone in the office actually know which uses of AI are fine, which need a second look, and which are off the table, and will they remember that under deadline pressure.

The four rules I actually recommend

1. 1. Name what confidential data is allowed to touch which tools

   Not a general statement about 'protecting client confidentiality.' A specific list: this tool is approved for drafting from public information, this tool is approved for client documents because we've confirmed it doesn't train on inputs and we've reviewed its terms, this tool is never to be used with client names or facts, full stop. Write the tool names down. Update the list when a tool changes its terms.

2. 2. Define which outputs require sign-off before they leave the practice

   I tell every small practice I work with: anything that goes to a client, a court, or opposing counsel needs a named human who reviewed it and is willing to put their name on having reviewed it. AI-assisted drafting is fine. AI-assisted drafting that skips a human read-through before it goes out the door is not, regardless of how good the tool has gotten.

3. 3. Decide who can approve a new tool

   In a small practice this is usually one person, often the person reading this. But it needs to be explicit, because otherwise every associate and paralegal independently decides which tools are fine to try, and you end up with client data scattered across services nobody vetted.

4. 4. Write down what happens when something goes wrong

   A tool hallucinates a citation, a draft goes out with an error, a piece of client information ends up somewhere it shouldn't. Decide now, calmly, what the response is: who gets told, how the client gets told if they need to be, how you figure out how far it spread. Practices that skip this step end up improvising during the worst possible moment to improvise.

What I've actually seen go wrong without this

In one small commercial litigation practice I advised, an associate had been using a general-purpose AI tool to summarize deposition transcripts, pasting full transcript text into the tool because it was fast and the output was genuinely useful. Nobody had told him not to, because nobody had written anything down at all. The practice had no idea this was happening until I asked, during an unrelated engagement, what tools people were using day to day.

Nothing had gone wrong yet in that case, which is exactly the point: the absence of an incident is not evidence that the practice was fine, it's evidence that nobody had looked. The fix took one afternoon: a short written policy naming the approved tools, the confidentiality line, and the sign-off rule, sent to everyone, discussed in a fifteen minute meeting. That's the whole governance program for a practice that size, and it's genuinely sufficient.

Keeping the policy alive instead of filed away

• Revisit it every time you adopt a new tool, not on a fixed annual schedule, because tool adoption is what actually changes your risk, not the calendar.
• Put the approved tool list somewhere people will actually see it day to day, not buried in an onboarding packet nobody rereads after week one.
• Ask new hires to read it in their first week and confirm they have, in writing, the same way you'd handle a conflicts check acknowledgment.
• When you catch a near miss, even a small one, treat it as a reason to tighten the specific rule that would have caught it, rather than a generic reminder to 'be careful.'

What changes as the practice grows

The four rules scale further than people expect. I've watched practices grow from three lawyers to fifteen without needing to add a committee, because the core structure, a named approver, a specific confidentiality list, a hard sign-off rule, and an incident plan, doesn't actually depend on headcount. What changes is enforcement mechanics: at three lawyers, enforcement is a conversation, at fifteen it's worth having someone spot-check occasionally that the approved tool list is actually what people are using.

The moment I do tell a client to build something closer to a real committee structure is when they're managing regulated data at real scale, multiple offices, or outside counsel guidelines from institutional clients that specifically require it. Short of that trigger, resist the pull toward heavier process. It's rarely the risk that justifies it, it's the discomfort of not having a formal-looking document to point to.