The Legal AI Accountability Standard

Every factual claim the AI presents is traceable to a source the lawyer can open: a document span, an email, a docket entry, a statute, a verified case citation, or a ledger record. The trail is attached to the answer itself, not reconstructable on request.

Lawyers are personally responsible for what they file and advise. An answer whose basis cannot be inspected transfers risk from the vendor to the lawyer while removing the means to manage it.

When the system cannot support a claim from evidence, it says so — visibly. Unsupported material is withheld or flagged, never silently blended into confident prose.

The most dangerous AI output is the fluent paragraph with one unsupported sentence in the middle. A system that cannot show you what it removed will eventually make you its co-signer.

Citations are verified against an authoritative corpus before they are relied on — deterministically first, with probabilistic judgment only on top, and human review for what neither can settle.

Fabricated citations are the signature failure of legal AI, and sanctions for them are now routine. Verification that depends on the same model that wrote the citation is not verification.

The AI acts only under explicit grants. Each task or standing instruction carries an allowlist of what it may touch; anything consequential — sending, filing, changing deadlines, moving money — pauses for human approval, every time.

An assistant that can act is an agent, and an agent without defined authority is an unsupervised signatory. Law firms already know how to grant authority — engagement letters, signing authority, supervision rules. AI should meet that bar, not lower it.

Standing instructions are immutable once active: edits create a new version, history never mutates, and every run records exactly which version it executed.

When an automated process does something surprising, the first question is “what was it told, at the time?” If instructions can be silently edited, that question has no reliable answer — and neither does a regulator's version of it.

AI work product lands in the firm's systems of record — the task list, the document management system, the matter file — attributed, reviewable, and billable like any team member's work. Not in a side panel that vanishes with the browser tab.

Work that is not on the record cannot be supervised, cannot be billed, and cannot be defended. If the AI's output only exists in a chat transcript, the firm has an unsupervised shadow workforce.

Autonomous work is bounded — iteration limits, budget ceilings, progress checks, a kill switch — and everything is written to an audit trail the firm can produce: decisions, actions, approvals, and cost, attributable down to the client matter.

“It keeps working while you sleep” is only a feature if it also stops. Bounds are what make autonomy insurable; the audit trail is what makes it defensible.

The firm chooses where its data and models live — a managed cloud, a private cloud, or its own infrastructure — and can run local or firm-tuned models without surrendering any of the preceding principles.

Privilege and confidentiality obligations do not stop at a vendor's terms of service. Deployment choice is what makes every other principle enforceable rather than promised.