The associate isn't drafting motions with AI. The billing coordinator is rescuing your realization rate.
Picture a 35-attorney litigation firm on a Thursday. A senior partner just spent forty minutes reconstructing what happened on a matter so she could write a three-paragraph status update to the client. A paralegal is hand-keying a new intake from a contact-form email into the practice management system. And somewhere, a billing coordinator is cleaning up time entries that read "reviewed docs" so they don't get written off when the client's outside-counsel guidelines kick them back. None of that is legal work. All of it is leaking margin.
That's where AI belongs in a law firm first — and most firms get the order exactly backward, chasing brief-drafting and case-prediction headlines while the operational bleed continues. The RSM middle-market AI survey shows mid-market leaders moving past experiments into production, while the OECD report on AI adoption by small and medium-sized enterprises names the four walls smaller firms hit: data readiness, skills, governance, and who actually owns the workflow. For a firm under 100 attorneys, those walls are real — you don't have a CTO, and the "AI committee" is two partners and the IT vendor.
So name the back-office targets explicitly: intake routing and conflicts pre-screening, first-draft matter-status updates pulled from time entries and docket events, billing-narrative cleanup against client guidelines, internal precedent and form search, and client-update prep that a responsible attorney edits and sends. Pick the one that costs the most non-billable hours and start there. If your firm can't yet say where client data lives, what the review rule is, and who owns the output, you're not picking a tool — you're picking a malpractice exposure.
Your governance isn't NIST boilerplate. It's Rule 1.6 with a model in the loop.
A law firm has a constraint a marketing agency does not: enforceable duties of competence, confidentiality, communication, fees, and supervision that don't bend because the draft came from a model. ABA Formal Opinion 512 on generative AI tools walks straight through them — and it's the document your managing partner should read before your IT vendor's demo, not after. The NIST AI Risk Management Framework gives you the four verbs to organize around — govern, map, measure, manage — but for a firm those verbs have to land on specific, billable-economy realities.
Translate it into rules a non-technical office manager can enforce. Confidential matter data does not enter a tool whose retention and tenancy you haven't reviewed — a public chatbot pasted with a client's deposition transcript is a confidentiality breach, full stop. No AI-drafted client communication leaves the building without attorney review, because the duty to communicate is yours, not the model's. Model output is a draft, never a citation — the sanctions for fabricated case law are now a recurring news story, and "the AI told me" is not a defense. And supervision means a named human signs off on every output that touches a client or a court.
For the many firms standing on Microsoft 365, that review is concrete: the Microsoft 365 Copilot privacy and data controls determine whether Copilot respects your matter-level permissions or quietly surfaces a sealed file to someone walled off from it. The same permission sloppiness that's an annoyance at a retailer is an ethical wall breach at a firm. Get the tenant boundaries and sensitivity labels right before anyone types a prompt, or accept that Copilot will read exactly what your access controls let it read — which in most firms is more than it should.
Run it like a matter: scope, owner, checklist, close.
The Deloitte State of AI report keeps landing on the same finding — value comes from changing the process, not from buying the tool. Lawyers already know how to do this; it's how you run a case. A workflow needs a responsible owner, an approved source set, an instruction standard, a reviewer checklist, an exception path, and a way to measure whether it worked. The difference between a firm that "tried AI" and one that transformed is the close-out step, the same way the difference between a matter and a mess is the file memo.
Make the first one boring and measurable. Monthly matter-status drafts generated from time and docket data, reviewed and sent by the responsible attorney — track the partner hours you recover. Intake triage that conflicts-checks and routes — track time-to-first-response. Billing-narrative support against outside-counsel guidelines — track your write-down rate before and after. Pick the workflow where you can put a number on the win in 90 days, because a managing partner approves the second project based on the first one's realization math, not its novelty.
What you do Monday: list every recurring non-billable task that eats more than two attorney or staff hours a week, and circle the one with the cleanest, already-approved data source. That's your pilot. Then turn it into a governed production workflow with a 90-day AI implementation plan, and run the SMB AI readiness assessment first so you find the data-boundary gaps on a whiteboard instead of in a bar complaint.
