AI governance for solicitors
AI governance for Irish law firms. Built to the standard your clients expect.
A shadow AI audit, acceptable use policy, and EU AI Act compliance framework — designed by a certified ISO 42001 lead auditor and aligned to Law Society of Ireland guidance.
Find out which AI tools your practice uses
Staff may be using AI tools outside the firm's approved arrangements. An inventory helps establish which tools are actually in use, what information is being entered and where a closer review is needed.
When something goes wrong — a hallucinated citation in a court submission, a confidential brief processed through a consumer chatbot, a regulator query about Article 4 literacy — the absence of a policy is the firm's exposure. The tool is not the defendant.
Three components. One governance framework.
Component 01
Shadow AI Audit
- What AI tools are in active use across the firm, by whom, and for what tasks
- Risk classification of each tool: Block, Formalise, Adopt, or Monitor
- Delivered as a mapped inventory with prioritised actions
Component 02
AI Acceptable Use Policy
- Tailored to the firm's practice areas and existing technology environment
- Covers the ten policy domains required for credible legal-sector governance
- Aligned to Law Society of Ireland guidance and EU AI Act obligations
- Firm-specific adaptation sections included for handover and ongoing review
Policy domains covered
Permitted uses · Confidentiality · Privilege · Verification · Disclosure · Supervision · IP and copyright · Data protection · AI literacy · Governance and review
Component 03
EU AI Act Compliance Framework
- Article 4 AI literacy measures mapped to role-specific training
- Risk-tier assessment for the firm's current and planned AI use cases
- Deployer obligations checklist for any high-risk system in use
The standard
What ISO 42001 means for your firm
ISO 42001 is the international standard for AI management systems. It establishes the requirements for responsible AI governance — covering risk assessment, policy design, accountability structures, and continuous review. It is the AI equivalent of ISO 27001 for information security.
Ger Perdisatt holds a personal ISO/IEC 42001 Lead Auditor qualification. It informs our advice on governance and preparation for an audit. It is separate from certification of a firm's management system.
A client or insurer may need evidence of how your controls operate. A qualification or policy document alone does not establish that those controls are effective. Any decision to pursue organisational certification needs its own scope and assessment.
Professional guidance
The Law Society's public technology guidance is a useful reference for solicitors reviewing AI use. Your policy should also reflect the firm's actual work and responsibilities.
lawsociety.ie/solicitors/knowledge-base/tech-hubCommon questions
Does my firm need an AI acceptable use policy?
Yes. If any member of staff uses ChatGPT, Microsoft Copilot, Claude, Gemini, or any other AI tool to assist with client work, the firm needs an acceptable use policy. The Law Society of Ireland's Guidelines for the Use of Generative Artificial Intelligence by Solicitors (2025) confirm that the solicitor remains responsible for verifying AI output. In the absence of a policy, the firm has no documented basis on which that responsibility is being discharged. The policy is what converts informal, unmonitored AI use into governed AI use.
What is shadow AI in a law firm?
Shadow AI is the use of AI tools by staff without the firm's knowledge, approval, or governance framework. In Irish law firms this typically means fee earners and support staff using consumer ChatGPT, free Claude accounts, or unmanaged Copilot deployments for tasks involving client information. The exposure is twofold: the firm has no record of where client data has been processed, and the firm has no basis to demonstrate compliance with confidentiality, privilege, or data protection obligations. A shadow AI audit surfaces what is actually in use so it can be either formalised or removed.
What does ISO 42001 certification mean?
ISO 42001 is an international standard for AI management systems. Ger Perdisatt holds a personal Lead Auditor qualification, which informs our advice on governance and audit preparation. It does not mean Acuity or your firm is ISO 42001 certified. Organisational certification requires a separate assessment by a certification body.
What are solicitors' obligations under the EU AI Act?
Irish solicitors have three main obligations under the EU AI Act. First, Article 4 (AI literacy): since 2 February 2025 the firm must take measures to support the AI literacy of staff using AI on its behalf, suited to their role; the amended text does not require any specific level of AI literacy of any individual. Second, deployer obligations: where the firm uses high-risk AI systems (which can include AI used in administration of justice contexts), it carries documentation, oversight, and transparency obligations. Third, transparency to clients where AI is involved in producing advice or work product. These obligations apply regardless of whether the firm developed the AI tool or simply uses it off the shelf.
How does this align with Law Society guidance?
Professional guidance is one input to a governance review. We consider the Law Society of Ireland's guidance alongside the firm's responsibilities, applicable law and the actual tools in use. The firm retains responsibility for its own decisions and review of AI-assisted work.
Ready to put AI to work in your practice — safely?
A 30-minute call is enough to identify the highest-value starting point for your firm.