Why AI stalls once a whole organisation starts using it, and what legal teams can do

Most organisations now use AI somewhere. Far fewer get value from it across the business. We wanted to know why, so we read the research from the last 18 months, including the studies written by companies with something to sell.

Our view is that the problems that stall AI are rarely about the AI. They are about cost, control, visibility and the way the work is done, and each has a known response. Legal teams are well placed to help with all four, because most of the responses are judgments about risk, rules and process, which is what lawyers already do.

Exhibit 1

Four problems appear as AI spreads beyond a few users, and each has a known response

Our framework, drawn from the research cited below.

A few keen usersThe whole organisation

1. 1The bill grows faster than the benefitYou seeCosts that miss forecasts; few initiatives meet their expected returnWhat helpsPrice one finished piece of work; budgets and caps per team
2. 2Data leaks and filing errorsYou seeBreaches through AI tools; invented cases in court filingsWhat helpsLimit access; approve irreversible steps; check every authority
3. 3Nobody knows who uses whatYou seePersonal tools, hidden use, AI on expense claimsWhat helpsApproved tools that do the job; a short policy; ask outside firms
4. 4The pilot works, the rollout stallsYou seeTrials that stay trialsWhat helpsRedesign the work first; train people; measure before and after

1. Why does the bill grow faster than the benefit?

Most organisations cannot predict what AI will cost them. AI is usually priced by use: each question, document or step costs a small amount, and the total depends on how much people use it and how the tools are built. In a 2026 survey of 396 organisations, only 11% forecast their AI costs to within 10% of what they spent, and 62% said an unexpected AI cost had changed a business decision in the past year [1]. The survey was commissioned by a company that sells AI cost software, but other sources point the same way: IBM's 2025 survey of 2,000 chief executives found that only 25% of AI initiatives had delivered the return expected of them [7].

Falling prices do not settle the question. The cost of each unit of AI has dropped sharply, but newer tools use far more units for each task, because they take several steps on their own for every request.

For legal teams the cost question also runs the other way. In a 2025 survey of 657 in-house lawyers, 59% said they had seen no savings yet from their law firms' use of AI [10]. If the firm's costs fall and the bill does not, the client is entitled to ask why.

The fix is to price the finished work. Lawyers already think this way about fees: what does one finished contract review cost, and what happens to that cost when volume doubles?

2. Where do data leaks and filing errors come from?

AI tools create routes for information to leave an organisation that its existing controls were not built for. In IBM's 2025 study of 600 organisations that had a data breach, 13% had a breach involving an AI model or application, and 97% of those had no access controls on their AI tools [2]. IBM's 2026 study put the average cost of a breach caused by prompt injection, where hidden instructions in a document or email make an AI tool act against its user, at US$5.89 million [11].

For lawyers the most visible failure is in court. A public database of court decisions that deal with AI-generated errors, such as invented cases or quotes, listed 2,202 decisions worldwide by 19 October 2026 [5].

Exhibit 2

Courts across the region have already ruled on AI errors in filings

Court decisions dealing with AI-generated errors, selected jurisdictions, number, as listed on 19 October 2026. Includes filings by unrepresented litigants as well as lawyers.

• United States1,501
• Canada234
• Australia112
• United Kingdom76
• Singapore8
• New Zealand7
• Hong Kong5

Of all 2,202 decisions, about 1,270 involved unrepresented litigants and about 870 involved lawyers. Source: Charlotin, AI Hallucination Cases database [5].

Courts have been clear about where responsibility sits. The High Court of England and Wales said in June 2025 that freely available tools "are not capable of conducting reliable legal research", that lawyers must check what they produce against authoritative sources, and that heads of chambers and managing partners must take practical steps to make sure this happens [12]. In Singapore, a court ordered counsel to pay costs personally after a fictitious case was cited, describing the duty to check cited material as one the lawyer cannot delegate [13]. None of this is new law. It is the duty to check a junior's draft, applied to a new kind of junior.

Regulation is also moving. The EU's AI Act has applied in stages since 2025. An amending regulation in force since 27 July 2026 moved the main obligations for high-risk systems listed in Annex III to 2 December 2027 [14].

3. Why does nobody know who is using what?

When an organisation does not provide AI tools, or provides ones people find less useful, staff use their own. In a 2025 study of more than 48,000 people in 47 countries, almost half of employees who use AI at work admitted using it in ways that break company policy, including uploading company information to free public tools, and 57% hide their use of AI or present its output as their own work [3]. A smaller 2025 study by MIT researchers found that only 40% of companies had bought an official AI subscription, while workers at more than 90% of them used personal AI tools for work [15]. Some of this shows up on expense claims: in one software-spend dataset for 2025, ChatGPT became the most expensed application [16].

The same gap exists between legal departments and their law firms. Fewer than one-third of corporate legal and tax departments know whether their outside firms use AI on their matters [17].

Hidden use mostly shows that people want the tools. A ban on its own does not stop the use. It only stops the organisation from seeing it.

4. Why does the pilot work and the rollout stall?

Many trials succeed and then stay trials. BCG's 2025 study of more than 1,250 companies found that 5% of companies were getting value from AI at scale, 35% were scaling and seeing some returns, and 60% reported little or no material value despite substantial investment [4]. Deloitte's 2026 survey of 3,235 leaders found that 25% had moved 40% or more of their AI pilots into production [18].

Exhibit 3

Six in ten companies are not yet getting material value from AI

Share of 1,250 companies, 2025.

• 5% getting value at scale
• 35% scaling, with some returns
• 60% little or no material value

Source: BCG, The Widening AI Value Gap [4].

The obstacles are mostly about the organisation rather than the AI: data that is unready, tools that do not connect to existing systems, too few people with the skills, and no agreed way to measure results [4][19]. BCG's rule of thumb is that 70% of a company's focus should go on people and processes, 20% on technology and 10% on the algorithms [4]. Legal teams report the same pattern. In a 2025 survey, 61% of UK lawyers used AI, but only 17% said it was fully embedded in their organisation's strategy and operations [6]. Lawyers in a 2026 survey named ethics and data privacy (39%), inadequate training (39%) and resistance to change (35%) as the main challenges [20].

That rule fits legal work closely. A contract review tool changes little if requests still arrive by email without the facts, wait two days in a queue and go out without a standard sign-off.

Where the skeptics are right

Some caution about scaling AI is sound judgment. A team that holds a tool back until it can check the output, control the data and predict the cost is doing its job. The aim is to use AI where the work and the controls are ready.

The evidence also has limits we want to state plainly. Most of these figures come from surveys in which respondents describe their own organisation, and several come from companies that sell AI, cost-management or security products. Some sources measure different things under similar names: "scaling" means something different in each of the McKinsey, BCG and Deloitte studies. The court decisions database counts decisions that discuss AI errors, and many errors never reach a written decision. Treat the figures as signs of where problems tend to arise, and measure your own organisation before and after any change.

What we'd ask

If you lead a legal team or a firm:

• Work out the cost of one finished piece of work, such as one contract reviewed, before committing, and test how it changes when volume grows. Give each team a budget and a cap.
• Give each AI tool only the access its job needs, keep a record of what it did, and require a person to approve any step that sends, files or deletes something.
• Provide approved tools that do what people were using personal tools for, with a one-page policy on which tools, which data and how to check the output.
• Ask your outside firms how they use AI on your matters, and how it shows up in their bills.
• Redesign the work before scaling the tool, and agree how results will be measured before the pilot starts. We set out why in Why AI pays off only when the work is redesigned and Legal AI workbenches pay off when the work is redesigned first.

If you work in a legal team:

• Use the approved tools, and say what is missing from them rather than working around them.
• Check every authority and quotation against the source yourself. Asking a second AI tool to check the first leaves the same risk in place.
• Offer to help write the policy and design the controls. That work is legal work, and it is a way to be in the room when your team decides how it will use AI.

Why we built the course

The organisations that get value from AI change how the work is done, and someone has to lead that change in each team. We built AI Women in Law so that more of the people leading it are women lawyers. Over five weeks, participants redesign one piece of their team's work and build a first version of a tool for it. See the course.

References

1. Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report. 396 organisations, surveyed April to May 2026. Reported by Channel Insider, 29 July 2026.
2. IBM, Cost of a Data Breach Report 2025, press release, 30 July 2025. 600 breached organisations.
3. KPMG and University of Melbourne, Trust, attitudes and use of AI: a global study 2025, press release, 9 May 2025. More than 48,000 people in 47 countries.
4. BCG, The Widening AI Value Gap (Build for the Future 2025), 30 September 2025. more than 1,250 companies.
5. Damien Charlotin, AI Hallucination Cases database, last updated 19 October 2026.
6. LexisNexis UK, Two-thirds of UK lawyers now use AI, yet firm culture slows progress, press release, 1 September 2025.
7. IBM Institute for Business Value, CEO Study, press release CEOs Double Down on AI While Navigating Enterprise Hurdles, 6 May 2025. 2,000 CEOs in 33 countries.
8. Stanford HAI, 2025 AI Index Report, April 2025.
9. Anthropic Engineering, How we built our multi-agent research system, 13 June 2025.
10. ACC and Everlaw, GenAI's Growing Strategic Value for Corporate Law Departments, press release, 14 October 2025. 657 in-house professionals in 30 countries.
11. IBM X-Force, 2026 Cost of a Data Breach: AI adversaries and enterprise risk, 29 July 2026. 602 breached organisations.
12. Ayinde v London Borough of Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin), 6 June 2025, paragraphs 6 to 9.
13. Tajudin bin Gulam Rasul v Suriaya bte Haja Mohideen [2025] SGHCR 33, 29 September 2025, paragraphs 52 and 99.
14. European Commission, AI Act: regulatory framework for AI, page updated 19 October 2026.
15. Challapally, Pease, Raskar and Chari, The GenAI Divide: State of AI in Business 2025, MIT NANDA, July 2025. 52 organisations interviewed and 153 leaders surveyed. Copy read at mlq.ai.
16. Zylo, 2026 SaaS Management Index, 29 January 2026. Data from Zylo's own customers.
17. Thomson Reuters Institute, 2026 AI in Professional Services Report, 9 February 2026.
18. Deloitte AI Institute, State of AI in the Enterprise 2026, 21 January 2026. 3,235 leaders in 24 countries.
19. Gartner, Lack of AI-Ready Data Puts AI Projects at Risk, press release, 26 February 2025. Survey of 1,203 data management leaders, July 2024.
20. Wolters Kluwer, 2026 Future Ready Lawyer Survey Report, 10 March 2026. 810 lawyers in the US, China and nine European countries. Summary.