Shadow AI: the firm already uses AI, just not the approved kind
Why law firms end up running AI tools nobody approved, where the professional-conduct risk actually sits, and what works better than a ban.
In most firms the question is no longer whether AI is being used, but whether firm leadership knows which tools. Shadow AI means the ones nobody approved, vetted or documented: the browser tab next to the practice management system, the app on a private phone, the free translation service used on a contract excerpt.
How widespread is it?
For its “Future Ready Lawyer 2026” report, Wolters Kluwer surveyed 810 lawyers between 8 and 25 August 2025. 92 percent of them said they use at least one AI tool in their daily work. The survey is international and does not specifically reflect the German legal market. Treat it as a direction of travel, not as a figure for your own firm.
The number that matters more to firm leadership is not in any study anyway: what share of that usage runs through a route the firm knows about and has approved? If you cannot answer that question, you already have the answer.
Deadline pressure beats policy
Shadow AI rarely comes from bad faith. It comes from a passage that has to get shorter and clearer at six in the evening, with no permitted way to do it. Someone with no approved route for rewriting a paragraph takes the route already open in the browser. That is not defiance. It is the shortest distance between the task and going home.
Hierarchy has little to do with it. Partners dictate memos into apps nobody has vetted just as trainees paste a set of facts into a chat window. What both cases share is the absence of a convenient permitted alternative.
Why the invisibility matters more than any single prompt
A single paragraph in a consumer tool is a manageable event as long as someone knows about it. The damage comes from nobody knowing.
Without logging, the firm cannot answer three questions: which data left the building, where did it go, and when? If a client asks, if the bar association (Kammer) makes an inquiry, or if there is a data protection incident, there is no basis for a reliable answer. A firm that cannot reconstruct its own data outflow cannot assess it either.
In professional-conduct terms this is the difference between a controlled and an uncontrolled state. The duty of confidentiality under § 43a BRAO (the German Federal Lawyers’ Act) and the criminal offence in § 203 StGB apply whether or not the firm noticed the processing. Know about it and you can limit it, steer it, and explain it if challenged. Miss it and you have none of those options.
A ban moves the usage, it does not end it
The obvious response is an internal directive: AI tools are prohibited. In practice the usage migrates to private devices. There the firm sees nothing at all, and it loses even the ability to say which content must never go into an outside tool.
A ban without an alternative describes a wish, not a state of affairs. It also relieves leadership only in appearance, because responsibility for the client data stays exactly where it was.
What an approved alternative has to deliver
It has to be at least as convenient as the forbidden one. That is the hard requirement, and it is where internal solutions routinely fail. Access that demands a separate login, an application form or three more clicks than the open browser tab gets bypassed, by the same people who signed the policy.
Then comes the second requirement: requests are logged, and the processing location is fixed. Together those two turn an invisible event into an auditable one. The firm does not read every prompt word for word, but it can show that work happened, when, at what volume, and where the processing took place.
I built a setup like this for the law firm context on AWS Bedrock (the language model service on the Amazon Web Services cloud platform): the EU inference profiles are technically enforced rather than merely selected, and invocation logging (the record of who called which model when) produces a usage record per admitted lawyer. The setup effort is real, but it happens once, while the uncontrolled state carries on every day.
The alternative first, then the rule
Anyone who wants to end shadow AI therefore starts with the route, not the policy. Only once an approved route exists that genuinely makes the work easier does a rule have anything to point at. Before that it is an instruction with nowhere to land.
While that question is open, the debate about autonomous agents and their limits already concerns the stage after next. The first stage is knowing what is happening in your own building right now.
The content of this blog was created partly with the support of AI.