Shadow AI in Law Firms: The Risk You Can’t See (and How to Fix It)

AI for your firm: Part 1 of 8. A short series for law firm leaders on getting AI right, from the risks you can’t see to the policy, tools and plan that fix them.

Quick answer: Shadow AI in law firms is when lawyers or staff use AI tools your firm hasn’t reviewed or approved, often by pasting client information into a free chatbot. It puts confidentiality and privilege at risk, and guidance like ABA Formal Opinion 512 and Canadian law society guidance expects your firm to supervise how AI is used. The fix isn’t a ban. It’s a short policy, approved tools, training and an honest look at what’s already happening.

It’s 4:45 on a Thursday. Your associate has a demand letter due, a client calling, and a 60-page agreement to summarize. A free AI chatbot is one browser tab away. Copy. Paste. Done in two minutes.

Nobody meant any harm. But your client’s confidential information just left the building, and your firm has no idea where it went.

That’s shadow AI in a law firm: your team using AI tools your firm hasn’t reviewed or approved. It’s one of the fastest-growing risks in legal practice. It rarely comes from bad intent. It comes from good people under pressure.

So here’s the uncomfortable question: do you know which AI tools your team used this week?

What is shadow AI in law firms, and is it happening at yours?

The numbers below come from vendor and industry surveys, so treat them as indicators, not a census:

• In a 2025 DeepL survey of 1,000 US legal professionals, 71% said they had used AI tools without formal approval, about half of them frequently. The top reason was pressure to deliver work faster, and 30% said they’d used unauthorized tools recommended by managers or senior colleagues. (DeepL; Law.com)
• Thomson Reuters’ Future of Professionals 2026 report (1,816 professionals in law, tax, accounting and compliance across 62 countries) found about one-third use unapproved AI, rising to 41% where people feel their organization is moving too slowly on AI. (Artificial Lawyer summary)
• In the UK, an April 2026 Censuswide survey for Access Legal found 59% of fee earners admit to using unapproved AI apps, while 68% of firm leaders believed they had full visibility. (Legal Support Network)

Read that last one again. The people using AI and the people accountable for it are seeing two different pictures.

Why shadow AI hits law firms harder than other businesses

1. Your client’s confidential information leaves your control

Lawyers’ duty of confidentiality covers all information relating to a client’s matter. ABA Formal Opinion 512 (July 2024) says lawyers must evaluate the risk that information entered into a generative AI tool will be disclosed or accessed by others, and for self-learning tools generally requires the client’s informed consent before client information goes in. Boilerplate in an engagement letter isn’t enough. (ABA Formal Op. 512)

Canadian regulators say the same thing in their own words. The Law Society of Ontario’s guidance lists confidentiality among six key obligations when using generative AI, and the Law Society of Alberta’s Generative AI Playbook warns lawyers about putting confidential information into public tools. (LSO; LSA)

Picture a draft affidavit pasted into a free chatbot. Where is that text stored? For how long? Could it be used to train the model? With shadow AI, your firm usually can’t answer any of those questions.

2. Privilege gets harder to defend

Sharing privileged communications with a third-party service your firm hasn’t vetted creates an argument about whether confidentiality, and potentially privilege, has been compromised. How courts will treat this is still developing, which is exactly why firms shouldn’t let it happen by accident. The Law Society of BC’s guidance specifically flags confidentiality and privilege when using generative AI. (LSBC)

3. You don’t know where the data goes, or how long it stays

Consumer and enterprise versions of the same AI product can have very different terms on retention, training on your inputs, and where data is hosted. Florida Bar Ethics Opinion 24-1 tells lawyers to research a program’s policies on data retention, data sharing and self-learning before use. (Florida Bar Op. 24-1) With shadow AI, nobody at your firm has done that research. For Canadian firms, data residency adds another layer.

4. Confident, wrong answers can end up in front of a judge

Generative AI can produce confident, wrong answers, including case law that doesn’t exist.

• In Mata v. Avianca (S.D.N.Y. 2023), lawyers were sanctioned for filing a brief with non-existent cases generated by ChatGPT (as discussed in Texas Ethics Opinion 705).
• In Zhang v. Chen, 2024 BCSC 285, a BC lawyer included two ChatGPT-invented cases in a notice of application. The court called citing fake cases “an abuse of process” that is “tantamount to making a false statement to the court.” The judge found she had no intent to deceive and declined to award special costs, but ordered her to personally bear the extra costs her error caused and to review her other files. The Law Society of BC confirmed to media in February 2024 that it was investigating. (BC Courts; Vancouver Sun)

Courts are responding with practice directions too. The Federal Court of Canada, for example, expects a declaration in the first paragraph of litigation documents that contain content created or generated directly by AI (Federal Court notice, May 7, 2024).

5. You’re still responsible for what your team does

Shadow AI is also a supervision problem. ABA 512 points to lawyers’ duties to supervise employees and agents, and the LSO lists the duty to supervise among its six obligations. Competence includes understanding the benefits and risks of relevant technology: in Canada it sits in the FLSC Model Code commentary adopted by provincial codes, and in the US in Model Rule 1.1. And when AI speeds up work, billing has to reflect that. ABA 512 and Texas Opinion 705 both say hourly billing must reflect actual time spent, not time saved.

Why doesn’t a “no AI” memo stop shadow AI?

It’s tempting. One email, problem solved. Except the surveys above suggest the opposite: when firms move slowly, people use AI anyway, just out of sight. A ban without approved alternatives pushes usage underground, where you can see even less.

Bring AI out of the shadows in 5 steps

1. Find out what’s happening, without blame. Run an anonymous survey and, if you’re on Microsoft 365, check what your existing security tools can report about cloud app usage. Make it safe for people to tell the truth.
2. Write a short, usable AI policy. Our law firm AI policy starter outline shows what to include. Cover approved tools, what information can and can’t be entered, verification requirements (every citation checked against a primary source), client communication and consent, court disclosure rules, billing, and who to ask. Map it to your regulator’s guidance: ABA 512 and your state Bar Association, or your provincial law society.
3. Approve tools people actually want to use. Vet enterprise-grade options for retention, training, hosting and access controls, using the 8 criteria for secure AI tools. Check the AI features already in your practice management and productivity software first. You may already be paying for them.
4. Train everyone, not just lawyers. Assistants and law clerks are often the heaviest users. Cover safe prompting, verification, confidentiality and real examples like Zhang v. Chen.
5. Review regularly. Tools and guidance are changing fast. California updated its guidance in 2026 to address agentic AI, for example. Revisit your policy and tool list at least every six months.

FAQ

You don’t have to figure this out alone

If this feels like a lot, you’re in good company. Most firms we talk to are interested in AI and nervous about getting it wrong. Both are reasonable. Our free AI readiness assessment includes a confidential shadow AI check, a snapshot of where your firm stands, and the top risks and opportunities to tackle first, mapped to the guidance in your jurisdiction across Canada or the US.

Get your free AI readiness assessment

Want the plan after the risks? See how to implement AI in a law firm: your first 90 days.

This article is general information, not legal or ethics advice. Consult your law society or Bar Association’s practice advisors about your specific obligations.