Reader’s Question
Every now and then I get a question or a note back from one of you reading this, and I really appreciate it. People are busy, and taking a few minutes out of the day to write in is no small thing today. And so this week I received a question that made me want to write this whole edition around, mostly because it’s the same one I’ve been asked over and over these past few months.
It went like this:
If we’re right at the start with AI, isn’t Microsoft Copilot really the only safe option? And how is a firm meant to get its head around all the data security and residency choices when it feels like you’d need a PhD just to follow them - so where do you actually begin?
You’ve Already Started
The premise buried in her question is that starting is a decision still ahead of her while in most firms, it isn’t.
Right now, some of the people at your firm are almost certainly already using AI. They’re pasting things into ChatGPT on their phones, drafting an email in some new free tool over lunch, running a clause past whatever chatbot is open in the browser. It’s what busy, capable people do when the work is heavy, when nobody has handed them a proper firm tool or shown them how to use it safely, and the shiny latest and greatest option is one tab away.
So the starting line is already behind you, the process just happened on its own, with no tool chosen, no plan set up, and nobody able to see what’s being done with client work.
This is where it stops being hypothetical. In March, a court in New York ruled that information typed into a public AI tool isn’t protected by attorney-client privilege, because the consumer terms give you no reasonable expectation of confidentiality.
Every professional in law working with AI tools should know that a paid subscription doesn’t necessarily mean being on the right (commercial) plan. A paid ChatGPT Plus, Claude Pro, or Copilot Pro licence might feel like a safe, compliant choice but you can pay and still be sitting on the consumer plan, with consumer terms and consumer exposure.
Safe and compliant comes from being on the right plan, AND set up the right way.
Same Principles Underneath
So is Copilot really the only safe option? No, and seeing why takes the pressure off the whole decision.
Copilot feels safe because it sits inside the Microsoft world your firm already trusts. That’s familiarity, and familiarity is worth something, but it isn’t a security property. On the consumer tier, Copilot carries the same exposure as the rest; on the commercial plan, Claude and ChatGPT are every bit as safe. Whatever protects client data travels with the plan you’re on and the way it’s set up.
This is a kind of relationship your firm already knows how to run. You trust Outlook with privileged email and your document system with matter files every day, because those sit under proper terms you set up once and haven’t had to think about since. AI on the right plan is the same sort of arrangement. You set it up once, and it holds.
So what sits underneath all of these tools? They run on the same handful of principles. Get your firm onto the commercial plan, connect the AI tool to the systems the firm already uses, keep a lawyer reviewing what AI produces, and you train people on what they can and cannot do with the tool, how to prompt it and check the answers.
You don’t have to work all of this out yourself. Getting the firm set up is a one time job, and giving your team the basics so they can actually use these tools is not a months long project either. This is something to consider getting expert help with by someone who does this for law firms, so it’s done right the first time.
Most of what firm learns and creates that way carries over from one tool to the next, though not all of it. The understanding of how these tools work, the habit of prompting it well and reviewing the output, stay with your team whatever tool you run. The tool itself is the part you learn again - each one has its own setup and its own quirks and capabilities, but moving from Copilot to Claude later isn’t starting from scratch. That’s why which tool you pick at this point if you haven’t yet matters less than it feels like it should. If the firm is already using Microsoft and hasn’t set anything else up, Copilot is the natural place to start.
A Week, Then Off You Go
Here’s what the early stage actually looks like, and it’s a lot shorter than the overwhelm suggests. Two moves, and both fit inside a week.
The first is to get the setup done properly, once, for the whole firm - the right plan, the connections to the systems you already run, who has access, and how long data is kept. If people have already started on their own, this is a review that brings that under control; if they haven’t, it’s a clean setup from the start.
This is the piece you want an expert pair of eyes on, for the same reason you’d have someone qualified wire the building rather than doing it yourself. It’s not straightforward or intuitive and the cost of getting it wrong lands on your client work.
The second is to train your people. The training that matters covers two things: what the tool actually is and where it quietly gets things wrong, and how to use it well on real work. The setup makes the safe path available; the training is what gets your people to walk it instead of drifting back to the browser tab.
Do those two, and you’re off. From here, what you’re building is momentum. You want your people trying things in their work, sharing the lessons and experiences, and enjoying it. Set up a regular slot for that - an AI lunch, an AI Friday, where people bring what they tried that week, what worked and what didn’t, and everyone picks up something from each other.
That’s where the enthusiasm comes from, and it’s where your real use cases surface too, out of what your team actually tried, rather than from a list drawn up in advance. Once you’ve seen enough of it, you’ll know where AI is paying off in your firm, which use cases are actually worth it, and that’s when you double down. You take the few things that clearly work and go deeper into them.
If your firm hasn’t done that first pass yet, I would recommend putting this on your priority list for this month.
Setting a firm up properly and getting the team trained is what we do day to day. If you’d like a hand with yours, we’re around.
Get your firm set up the right way from the start →
Legal AI in Action
🎬 AI Brain That Builds Itself
Last week I broke down what Google’s Open Knowledge Format is; this week I show it actually running: you ask it a question and it answers in your firm’s own position with the source cited, you hand it a signed deal and it grows the brain itself, keeping what matters and filing it on your sign-off, and it draws you a map of everything the firm knows. Plus the trick that gets Claude writing into your OneDrive.
🎙 Two Years of AI in a Civil-Law Firm
Denisa Kopandi is a senior associate at a top Romanian law firm, working across competition, TMT and M&A, and for the past two years she’s run AI on almost everything she does, in a civil-law jurisdiction where almost nothing comes standardised. Recorded in person at LegalTechTalk in London, she’s honest about where the vendor tools fall short. We talked through why AI made her slower before it made her faster, how contracts that swing from ten pages to over a hundred break the playbook dream vendors sell, her inquisitorial way of prompting, and the verification ritual she runs on every answer.
A new interview drops every few days - watch on YouTube or follow the full series on my site.
Coming up!
🎙 Next Tuesday at 2pm CET!
Next week’s guests on Rok’s Legal AI Conversations is Dillon Harindiran, a second time founder and ex-J.P. Morgan banker, now co-founder and CEO of Context Systems, which works with founder led firms serving startups and VC funds and builds the context layer that sits underneath their AI agents.
We discuss why knowledge management traditionally always stalled in law firms and how AI finally closes that gap; his contrarian take that the DMS matters far less than you’d think, because that’s not where the real story lives; and why the next wave is about data sovereignty - who gets to hold and organise your firm’s knowledge, rather than who ships the best Word plugin.
Each edition of Legal AI Brief brings practical lessons from firms using AI safely.