AI Governance Guide
- Colin Levy
- May 19
- 2 min read
Most law firms and legal departments now have an AI policy. Very few have working AI governance. I wrote this guide specifically around that gap, e.g. the distance between the policy as written and the way lawyers actually use AI in practice and treats it as the operational problem worth solving. I wrote this guide to help anchor the topic to the frameworks lawyers cannot ignore: ABA Formal Opinion 512, the NIST AI Risk Management Framework, the EU AI Act, and the Colorado AI Act. But the emphasis is on what happens after the committee is chartered and the approved tool list is published, because that's where most programs quietly break down.
From there, the guide works through the operational questions that determine whether legal AI use holds up under real pressure: why change management (not document drafting) is the actual method for AI governance; why partner buy-in, billable-hour incentives, and the internal reporting climate matter more than any policy clause; and why the verification burden is the single control most likely to fail in production. It offers a working framework for calibrated trust in generative AI, giving lawyers a vocabulary for when to rely on a model and when to push back. The guide compares Claude, GPT, Gemini, and specialty legal AI tools (CoCounsel, Harvey, and Lexis+ AI) so legal teams can match models to tasks. It also covers the risks most programs still underweight: shadow AI, junior-lawyer skill atrophy, AI insurance exposure, and the early governance questions raised by agentic systems.
At the organizational level, the guide argues for treating AI governance as a continuous operating program rather than a one-time policy launch. A researched legal tech appendix profiles some examples of AI governance platforms: TruthSystems, CounselGuard, WitnessAI, FairNow, and Holistic AI, so the platform can be chosen to fit the program rather than the other way around. The law firms and legal departments most exposed today are not the ones without an AI policy. They are the ones whose dashboards show green while practice quietly drifts in directions no one is tracking. This guide is designed to make that drift visible and addressable before it appears on a sanctions docket or in a client RFP.