AI governance basics for legal teams, and what they mean for women lawyers

This is general information and does not constitute legal advice for any jurisdiction.

Our view is that a legal team should settle four things in writing before it uses AI on live matters: what information may go in, who checks the output, what records are kept, and what the vendor's terms allow. We tested that view against the guidance from regulators and professional bodies in five jurisdictions, a study of error rates in legal research tools, and the data on who does AI governance work.

What must be in place before a team uses AI on live matters?

Suppose the head of an in-house legal team wants her lawyers to use an AI drafting assistant on live contract reviews next month. What must be in place before she agrees?

Regulators start from one point: the lawyer stays responsible. In August 2026 the Solicitors Regulation Authority (SRA) in England and Wales published a warning notice on AI. The SRA had received 42 reports about potential misuse of AI between July 2025 and July 2026, and its ongoing investigations include issues of inaccurate legal citations, supervision and confidentiality. It said individuals remain responsible for their work whether or not AI is used [1]. Singapore's Ministry of Law said the same in its guide of 6 March 2026: legal professionals remain ultimately accountable for all work product [2]. This is the duty a supervising lawyer already has for a junior's draft.

For a legal team, AI governance means written rules on which AI tools are used, on what information, and who checks the results. The guidance points to four areas to settle first.

What information may go into the tool?

Decide what information may go in before anything else, because once client information reaches a vendor's system, its handling depends on the vendor's terms and settings.

• United States. The American Bar Association's Formal Opinion 512 (29 July 2024) applies the ABA Model Rules on competence, confidentiality, communication and fees to generative AI [3]. A lawyer needs the client's informed consent before entering information about the representation into a "self-learning" tool, one that learns from the data it processes, and standard wording in an engagement letter does not meet that standard [4].
• Australia. A joint statement of 6 December 2024 from the bodies that regulate lawyers in New South Wales, Western Australia and Victoria says lawyers cannot safely put confidential, sensitive or privileged client information into public AI tools, and need to review contract terms carefully before using commercial tools with client information [5].
• England and Wales. The Law Society generally advises against putting confidential information into generative AI tools, especially where the user lacks control over the tool, and says that, as a general rule, testing a tool or building templates should use fictional data, with no personal data or client confidential information [6].
• Hong Kong. The Privacy Commissioner's checklist for employers (31 March 2025) recommends that internal policies list permitted tools and purposes, and the types and amounts of information, including personal data, that may be entered [7].

The safer the tool, the more information it can take. Singapore's guide ranks tools by the protection they generally offer: free tools least, then off-the-shelf enterprise tools with safety features, then systems built in-house. For confidential client or business data it recommends enterprise tools [2]. Working through these questions gives the team a short list of information types, each marked allowed, allowed only in the approved tool, or not allowed.

Who checks the output, and how?

Each use of AI output needs a named checker and a stated method, because tools built for lawyers make errors too. In a study first released in May 2024, Magesh and colleagues tested AI legal research tools from LexisNexis and Thomson Reuters and found that each hallucinated, meaning it made up false information, between 17% and 33% of the time [8]. The figures describe the 2024 versions, but show why vendor accuracy claims cannot replace a lawyer's check. The check is the one lawyers already run on any cited authority: open the source and read it.

Every regulator in this article puts the check on the lawyer. ABA Opinion 512 says lawyers must independently verify AI output used in client representation [4]. The Australian statement says lawyers must be able and qualified to verify AI-prepared documents personally, and must actually ensure they are accurate. The statement also suggests limiting AI to lower-risk tasks that are easier to verify, such as drafting a polite email, and prohibiting it for higher-risk tasks such as translating advice [5]. Singapore's guide asks for oversight in proportion to the risk of the task, and greater scrutiny when a lawyer works outside her own expertise [2].

Checking also depends on supervision. Under Opinion 512, supervising lawyers should set clear policies and train the people they supervise [4]. The Australian statement suggests policies that say how junior and support staff will be supervised [5]. The SRA added sections on AI to its supervision guidance in June 2026 [1].

What records, vendor terms and fee rules does the team need?

Records let a team show later who did what. The Law Society's checklist includes documenting the tool's inputs, outputs and errors where the tool does not store them automatically [6]. Singapore's guide points to audit logs that trace prompts and outputs, and to approval logs in contract management systems [2]. A log of this kind does the job a file note does for advice given by phone.

Vendor terms decide whether client information can go in at all. The Law Society asks whether a tool is a closed system or also trains a model used by others [6]. For enterprise tools used with confidential client data, Singapore's guide says to verify that the terms prohibit training on inputs and outputs, or to opt out in the settings, to check where data is stored, and to prefer tools that allow client data to be deleted on request or at the end of an engagement. For free tools, it says to turn off retention and training and re-check the settings regularly, because updates may reset them [2].

Clients and fees need rules too. Singapore's guide suggests considering whether to tell clients or business units about AI use, especially where it is substantial or affects cost [2]. On fees, Opinion 512 allows a lawyer to charge for entering information and reviewing the draft, but in most circumstances not for learning the tool [3]. The Australian statement adds that AI should not unnecessarily raise a client's costs above traditional methods [5].

For a fuller structure, the US National Institute of Standards and Technology (NIST) publishes a voluntary AI Risk Management Framework. NIST added a companion document on generative AI in July 2024 and is revising the framework [9].

A checklist before the team starts

What each jurisdiction's guidance says

A worked example

Northgate Freight is a fictional logistics company. Its general counsel, Mei Tan (also fictional), wants her team of five to use a licensed enterprise AI assistant for first-pass reviews of supplier contracts. Her one-page rules:

1. Tools. Only the licensed assistant, on company laptops; no public chatbots for company or counterparty information.
2. Information. Supplier contracts and the team's written contract playbook may go in. Privileged advice, employee records and anything about a live dispute stay out.
3. Vendor terms. Before the team starts, confirm in the licence that inputs and outputs are not used for training, that data is deleted when the licence ends, and where data is stored.
4. Checking. The reviewing lawyer checks each issue the assistant lists against the contract and reads the whole contract, because the assistant may miss a clause. Contracts above the existing approval limit still go to Mei.
5. Records. Each review notes the tool, which standard prompt was used and who checked it. Errors go into a log Mei reviews monthly.
6. Training and review. Lawyers practise on fictional contracts first. After three months, Mei reads the error log and decides whether to extend use.

Governance work is done in teams where many women lawyers work

AI governance work is growing, and much of it is assigned to legal and compliance teams. The IAPP, a not-for-profit association for privacy and AI governance professionals, surveyed more than 670 people in 45 countries and territories in 2024. Of the organisations surveyed, 77% were working on AI governance, and 50% of AI governance professionals were typically assigned to ethics, compliance, privacy or legal teams. Only 10 of 671 respondents, 1.5%, expected to need no more AI governance staff in the next 12 months [10].

Legal teams of this kind include many women. In New South Wales in 2024, 5,363 of the 8,573 solicitors in the corporate (in-house) legal sector were women, or 63%; across Australia, women were 56% of all solicitors [11].

Women are less represented in AI roles: they made up 26% of US AI hires in 2025, against 50% of hires into other occupations, and held 13% of C-suite AI leadership roles at AI companies across 27 countries, according to LinkedIn data [12].

Exhibit 1

Women are most of the in-house solicitors in New South Wales, and about a quarter of US AI hires

Women's share of each group, %. The dashed line marks 50%. The groups come from different sources and countries.

• Corporate (in-house) solicitors, New South Wales, 202463%
• All solicitors, Australia, 202456%
• US hires into other occupations, 202550%
• US AI hires, 202526%
• C-suite AI leadership roles at AI companies, 27 countries13%

In New South Wales, 5,363 of 8,573 corporate solicitors were women. Sources: Urbis for the Law Society of New South Wales [11]; LinkedIn [12].

Women also use generative AI less than men. A Harvard Business School working paper reviewing 76 sources and more than 300,000 people found that, weighted by sample size, 47.8% of men and 39.3% of women used generative AI. Reasons it reports include less workplace training and weaker employer encouragement for women, and stronger concern among women about data security. The HBS AI Institute's summary recommends clear policies, hands-on training and privacy safeguards [13].

Exhibit 2

Fewer women than men use generative AI

Share using generative AI, weighted by sample size, %. 76 sources covering more than 300,000 people.

• Men47.8%
• Women39.3%

Source: HBS AI Institute, summarising Cranney, Delecourt and Koning, Harvard Business School Working Paper 25-023 [13].

Governance work provides some of what that research recommends. A team that writes rules like Mei's is doing the AI governance work the IAPP survey counts. It is also providing two of the conditions the HBS summary recommends: a clear policy and training. Leading that work lets a woman lawyer help decide which tools her organisation uses and on what terms.

Where the skeptics are right

A team that holds back from AI on live matters until it has rules is doing what the guidance asks. The regulators in this article accept caution: the Australian statement suggests prohibiting AI for higher-risk tasks such as translating advice [5], and the Law Society generally advises against putting confidential information into generative AI tools [6]. Tools built for lawyers have made up false information [8], so a lawyer who wants to see the error log before extending use is exercising the judgment the rules expect.

The evidence on women and governance work also has limits, which we want to state plainly. We found no current published count of women in AI governance roles, and the IAPP summary page gives no gender figures. The New South Wales figure covers one state, the LinkedIn figures cover LinkedIn members, and the Harvard review combines surveys of different designs. None of these sources shows that governance roles lead to AI leadership. Whether a governance role does so depends on whether it carries authority to decide which tools are used and on what terms. Our view is that a lawyer who understands how the tools work, as well as the rules for using them, is better placed to ask for that authority.

This article also has limits. It covers five jurisdictions and the documents below, read on 5 October 2026. Guidance changes often; check current versions. Teams with work in the European Union should also check the EU AI Act, which sets rules for organisations that use AI as well as those that develop it; it entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions [14]. Litigators should also check court rules on AI, such as the Singapore Courts' guide for court users, to which the Ministry of Law guide refers [2]. On the AI Women in Law course, participants build with fictional data only, which is what the Law Society recommends for testing [6].

What we'd ask

If you lead a legal team or a firm:

• Before anyone uses AI on live matters, decide in writing which tools are approved, for which tasks and users, and what information may go into each one, including whether client consent is needed.
• Read the vendor's terms on training, retention, deletion and data location before client information goes in.
• Name who checks each use of AI output, against what, and how closely, with more scrutiny for higher-risk work.
• Write a supervision policy, train lawyers and staff, and keep a log of inputs, outputs and errors.
• Decide when clients or business units are told about AI use, how AI time is charged, and how staff report a wrong input or doubtful output.
• Set a date to review the error log and decide whether to extend use.

If you work in a legal team:

• Check every AI output you use against the source yourself, including output from tools built for lawyers.
• Keep confidential, sensitive or privileged client information out of public AI tools.
• Offer to help write your team's rules. That work is legal work, and it lets you help decide which tools your organisation uses and on what terms.

Why we built the course

Rules like these are easier to write well when the lawyer writing them has used the tools. We built AI Women in Law so that more of the lawyers writing them are women who understand how the tools work. Over five weeks, participants redesign one piece of their team's work and build a first version of a tool for it. See the course.

References

1. Solicitors Regulation Authority, SRA cautions profession about safe and responsible use of AI in legal sector, news release, 17 August 2026.
2. Ministry of Law, Singapore, Guide for Using Generative AI in the Legal Sector, 6 March 2026.
3. American Bar Association, ABA issues first ethics guidance on a lawyer's use of AI tools (Formal Opinion 512), news release, 29 July 2024.
4. Illinois Supreme Court Commission on Professionalism, Breaking Down the ABA's Guidance on Using Generative AI in Legal Practice, 15 August 2024.
5. Law Society of New South Wales, Legal Practice Board of Western Australia and Victorian Legal Services Board and Commissioner, Statement on the use of artificial intelligence in Australian legal practice, 6 December 2024.
6. The Law Society (England and Wales), Generative AI: the essentials, page dated 1 October 2025, read 5 October 2026.
7. Office of the Privacy Commissioner for Personal Data, Hong Kong, media statement on the Checklist on Guidelines for the Use of Generative AI by Employees, 31 March 2025.
8. V. Magesh, F. Surani, M. Dahl, M. Suzgun, C. D. Manning and D. E. Ho, Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools, arXiv 2405.20362, version of 30 May 2024.
9. National Institute of Standards and Technology, AI Risk Management Framework, read 5 October 2026.
10. IAPP and Credo AI, AI Governance Profession Report 2025, 16 April 2025.
11. Urbis for the Law Society of New South Wales, 2024 National Profile of Solicitors, 13 June 2025.
12. LinkedIn, New LinkedIn Research Finds Women Account for Just 26% of AI Hires as AI Jobs Surge, 18 August 2026.
13. HBS AI Institute, The Gender Divide in Generative AI: A Global Challenge [Update], summarising K. Cranney, S. Delecourt and R. Koning, "Global Evidence on Gender Gaps and Generative AI Over Time", Harvard Business School Working Paper 25-023, May 2026.
14. European Commission, AI Act (Shaping Europe's digital future), page updated 3 August 2026, read 5 October 2026.