A lawyer can save twenty minutes generating a first draft and lose hours proving where an invented authority entered the document. The useful question is therefore not whether a firm “uses AI”. It is whether one defined legal task has the right data boundary, competent reviewer, client explanation, supplier controls and stop conditions. The SRA’s rules continue to apply when technology assists delivery: regulated professionals remain accountable for service quality, confidentiality, supervision and what reaches the client or court. The ICO adds data-protection duties, while judicial guidance makes the risks of hallucination and confidential input impossible to treat as abstract. This creates a precise first purchase: a go, redesign or stop sprint for one use case such as research, drafting, review or intake. This reading shows how to package that decision, test it on real matter conditions, build human review around consequence rather than theatre, and create recurring assurance as tools, vendors, models and legal work change.
What duties remain when a law firm uses AI?
A law firm’s existing professional duties remain in force when AI assists legal work. The firm and regulated individuals must protect client interests and confidentiality, provide competent service, supervise delivery and remain accountable for outputs and decisions. A supplier contract or model disclaimer does not transfer those responsibilities away from the regulated provider.
That is why a governance sprint begins with the service and professional owner. Tool features matter only after the team can name what the output will influence and who is qualified to challenge it.
- 1Defined legal task and intended user
- 2Client, matter and data boundary
- 3Error consequence and competent reviewer
- 4Supplier, security and retention evidence
- 5Go, redesign, restrict or stop
Which AI use case should a firm assess first?
The first use case should be narrow, frequent enough to measure and important enough to justify control—such as summarising a disclosure set, preparing a research starting point, extracting clauses or triaging intake. It should not combine every matter type, data source and client consequence into a single “AI transformation” programme.
Selection balances possible time saved against confidentiality, accuracy, vulnerability and legal-consequence risk. A low-volume but court-facing task may deserve tighter review than a high-volume administrative classification.
- Étape 1Frequent and lower consequence: controlled pilot
- Étape 2Frequent and higher consequence: specialist design first
- Étape 3Rare and lower consequence: low priority
- Étape 4Rare and higher consequence: restrict or retain manual route
What should a paid AI governance sprint deliver?
A paid sprint should map one workflow, classify the information used, test representative outputs, define competent human review, examine supplier evidence and issue a go, redesign, restrict or stop decision. It should also leave an operating procedure, approved-use boundary, incident route and measurable pilot plan—not a generic ethics policy.
The firm supplies real process owners and safely prepared test material. The adviser separates professional judgement, data protection, information security and procurement questions so each is decided by the right person. Pilot acceptance criteria should include quality, review effort, incident handling and user behaviour; time saved on a demonstration is not enough to approve matter use.
How should confidential and personal data move through the workflow?
The workflow should show what client and personal data enters the tool, the lawful and professional basis for using it, where it is processed, who can access it, how long it is retained and whether it trains or improves a model. Public consumer tools should never receive confidential material merely because access is convenient.
Privilege, client instructions, cross-border processing and supplier sub-processors may change the answer. The decision record should explain exclusions as clearly as permitted uses.
- 1Matter source and client instruction
- 2Approved preparation or redaction
- 3Contracted AI environment
- 4Output storage and access
- 5Human review and matter record
What does competent human review actually mean?
Competent human review means a person with enough legal and factual understanding independently checks the material that matters before it affects a client, filing or decision. The reviewer needs the source documents, time and authority to reject the output. Asking the same model to verify itself is not independent assurance.
Review depth should follow consequence. Citation, limitation date, advice, witness evidence and court documents require different tests from tone editing or formatting.
Review must also fit workload reality. If the approved process assumes a senior lawyer will inspect every source but the pricing and deadline provide no time, the control exists only on paper. Pilot measurement should expose that mismatch before the workflow scales across teams or clients.
- 1Étape 1
- 2Étape 2
- 3Étape 3
- 4Étape 4
- 5Étape 5
How can hallucination and bias be controlled without pretending they disappear?
Hallucination and bias are controlled by limiting the task, grounding work in approved sources, requiring traceable citations, testing representative edge cases and setting mandatory escalation. These controls reduce exposure; they do not make generative output inherently accurate or neutral. The firm must preserve a non-AI route where the risk remains unacceptable.
| Failure | Preventive control | Detective control |
|---|---|---|
| Invented authority | approved source retrieval | citation checked against source |
| Missing fact | structured matter input | comparison with file record |
| Biased triage | exclusion and fairness tests | outcome sampling |
| Confidential disclosure | approved environment and redaction | access and incident review |
| Over-reliance | user training and scope label | supervisor matter sample |
Which supplier evidence matters before approval?
Supplier evidence should cover purpose and limitations, security, data use and retention, processing locations, sub-processors, access controls, model or product changes, incident response, audit rights and exit. A strong demonstration is not evidence that the tool will behave safely with the firm’s matters, users and professional obligations.
The contract allocates commercial liability, but the firm still needs operational controls and client redress. Material version changes should reopen the use-case decision rather than pass silently into production.
A vendor exit plan matters too. The firm should know how matter data, prompts, output records and configuration are exported or deleted, and how work continues during suspension. Dependence becomes visible when the service fails; governance should identify it before client delivery relies on a single platform.
Which moments create a credible buying window?
A buying window appears before procurement, after uncontrolled staff adoption is discovered, when a client requests an AI protocol, after an output incident, during insurer review or before a workflow is exposed to clients. These moments create ownership and urgency; a general seminar on the future of law rarely does.
Acquisition can combine professional networks, insurer and security partners, focused research, workshops, direct outreach and useful search content. Qualification should establish a sponsor, use case, matter access and willingness to enforce restrictions.
- Review time and correction rate
- Unsupported authority or fact rate
- Confidentiality and access incidents
- User overrides and escalations
- Client complaints or redress events
What recurring service follows use-case approval?
The recurring service samples matters and outputs, reviews incidents and overrides, tracks supplier and model changes, refreshes training and tests whether the approved boundary still fits actual use. It should retire controls that add no assurance and stop the workflow when evidence deteriorates. Governance is an operating discipline, not an annual policy renewal.
When is a legal AI acquisition campaign ready to launch?
The campaign is ready when the partner can assess one legal workflow, involve competent professional and data owners, test real failure modes and state what it cannot approve. GetFishNet’s free eligibility test checks the addressable firm cohort, buying trigger, first-purchase value and recurring monitoring capacity before channels are activated.
Responsible AI adoption is commercially useful when it makes a legal service more consistent, accessible or efficient while leaving responsibility visible. If the control design cannot achieve that, “stop” is a valuable result.
Authorities cited: Solicitors Regulation Authority; Information Commissioner’s Office; Legal Services Board; Courts and Tribunals Judiciary. Dated references remain in the private source register.
The eligibility report dates and quantifies it, then tests whether it deserves action.
Reading the diagram. A disease contact only progresses after proof of origin, qualification of the relationship and control of the product concerned.
Text alternative. Telephone, prescriber or incoming request follow different proofs; missing consent causes documented exit.
How can the testing cycle reach a stable operating rhythm?
Relative benchmarks: D00 sets the rules of origin and termination of contact, D14 closes the preparation, W03 to W06 tests the scripts, consents, relationships of more than thirty-six months and ceilings per product, W07 to W08 arbitrator, then M03 stabilizes documented paths. Variances are recorded before any budget extension.
Gantt chart for the testing cycle — NON-EXHAUSTIVE DEMONSTRATION
Reading the diagram. The foundation secures the right to contact; exploration then measures the quality of requests before any channel stabilization.
Textual alternative. D00 sets consent, D14 audits scripts, W03–W06 tests provenance, W07–W08 cuts discrepancies, M03 maintains compliance.
What financial potential does the model make visible?
Model: 132 qualified conversations, 44 reviews and 26 new customers. Weighted average: 1 527 CHF; monthly total: 39 700 CHF. The projection concerns acquisitions agreed and allocated, without using the ceilings as margin or portfolio value. No national denominator is applied.
Breakdown of acquisitions — NON-EXHAUSTIVE DEMONSTRATION
The chart counts customers, not percentage points.
Reading the diagram. 26 acquisitions represent subscriptions preceded by a controlled origin and relationship; the size of a share does not prejudge either the documentary quality or the maintained value.
Text alternative. The circle distributes customers obtained after verifiable consent, never people simply called. Total: 26 customers, reread with the value specific to each channel.
How do customers, average monthly revenue, and recurring revenue correlate by channel?
| Channel explored | Customers | Average monthly revenue per customer | Monthly Recurring Channel Revenue |
|---|---|---|---|
| Natural and paid referencing | 4 | 1 300 CHF | 5 200 CHF |
| Telephone outreach | 3 | 1 600 CHF | 4 800 CHF |
| Voicemails | 2 | 900 CHF | 1 800 CHF |
| Email Campaigns | 4 | 1 200 CHF | 4 800 CHF |
| Social networks | 3 | 1 400 CHF | 4 200 CHF |
| Partners and prescribers | 3 | 2 000 CHF | 6 000 CHF |
| Events and webinars | 2 | 1 700 CHF | 3 400 CHF |
| Advertising retargeting | 1 | 1 100 CHF | 1 100 CHF |
| Strategic accounts and outbound outreach | 2 | 2 300 CHF | 4 600 CHF |
| Content and press relations | 2 | 1 900 CHF | 3 800 CHF |
| Total / weighted average | 26 | 1 527 CHF | 39 700 CHF |
The value is read again with the product, the applicable ceiling and the cost of controlling the provenance. The product customers × average income totals 39 700 CHF without promising performance.
Monthly recurring revenue by channel — NON-EXHAUSTIVE DEMONSTRATION
Reading the diagram. Compliant disease contacts, their converted volumes and the corresponding monthly income recompose 39 700 CHF without a value outside the table.
Alternative text. Each height associates an authorized channel, actual assigned customers, and the value specific to their product. Their addition exactly equals monthly 39 700 CHF.
How should acquisition cost be assessed before recurring revenue is scaled?
Arbitration adds proof of consent, script control, relationship data, call supervision and refusal handling and reports the charge to assigned customers. It compares legal origin, product concerned, ceiling, full cost, expected termination and service capacity then reduces any channel that weakens the proof.
Funnel to Retained Monthly Recurring Revenue — NON-EXHAUSTIVE DEMONSTRATION
Reading the diagram. disease contacts whose origin is demonstrated produce raw 39 700 CHF, then 34 142 CHF after maintaining at 86 %.
Text alternative. 132 conversations become 44 journals and 26 clients for disease contacts whose provenance is demonstrated. 39 700 CHF weighted to 86 % gives 34 142 CHF.
Financial limit. The 70 francs and the sixteen bonuses limit the remuneration; they give neither margin, nor number of contracts, nor maintenance. The 34 142 CHF remains a hypothesis, without reference value or forecast.
Which sources and related readings deepen this analysis?
Text references: Federal Office of Public Health, decision and rules applicable to intermediaries; monitoring activity report. The federal office describes ceilings and outreach, while consent and history remain evidence specific to the file. The addresses remain in the internal source register. Each topic retains a clear documentary boundary.
The ISA 2024 processes the status. The ICA 2022 processes the contract trace. The nLPD 2023 shows another prequalification of the contact and data.
CORRELATED READINGS — DYNAMIC MODULE
The thematic map will link rules 2024 of health insurance intermediaries to ISA for status, ICA for contract and nLPD for legality of contact data. The links remain governed without implying equivalence.
- See the insurance & brokerage market
- Explore all market readings
- Test the eligibility of your own window
The September deadline has passed; each origin of contact must always be able to be explained The report isolates the proof and the next action without reopening the 2024 rules of health insurance intermediaries.
The topic is broken down into entities, attributes, evidence, channels, costs and decision points. Institutions are cited in the text; no external resource interrupts the reading path.