Legal technology fails when a company buys a repository and calls it governance. The system must start with an intake event, route the matter by risk, preserve source and version, obtain the right approval, and retain evidence. Generative AI can help summarize or classify, but confidentiality, competence, privacy, and hallucination risks make unsupervised legal conclusions a poor automation target.
Choose the workflow before the vendor
Write the matter from trigger to evidence: who submits, what facts are mandatory, how risk is classified, who reviews, who may approve, what is signed or filed, and where proof is retained. This workflow card is the useful artifact and remains portable if the vendor changes.
Prioritize high-volume, low-ambiguity transitions: intake completeness, reminders, version comparison, signature routing, renewal notices, and evidence export. Do not begin with autonomous interpretation of novel law or negotiation of material liability.
- Intake3 count
- Risk routing5 count
- Approval4 count
- Evidence6 count
American Bar Association Formal Opinion 512 (2026-08). Example required controls by workflow stage, not measured vendor performance.
Make security and privacy selection criteria
Map the tool against NIST CSF 2.0: governance and inventory before protection; detection before response; tested recovery after an incident. Ask about identity controls, least privilege, logs, encryption, backups, incident notification, subprocessors, retention, deletion, and export.
Under GDPR-style regimes, define controller and processor roles, lawful basis, purpose, data categories, transfer path, retention, and data-subject response before loading personal data. EU and UK guidance are not interchangeable with every jurisdiction, but they expose questions any procurement review should answer.
Use AI inside explicit boundaries
ABA Formal Opinion 512 identifies competence, confidentiality, communication, candor, supervision, and reasonable fees as issues for lawyers using generative AI. A startup should convert those concerns into controls: approved use cases, prohibited data, source citations, human verification, output labels, and incident reporting.
Allow low-risk administration such as extracting dates from approved documents only after quality testing. Require legal review for summaries or clause suggestions. Prohibit autonomous legal conclusions, fabricated citations, final rights decisions, and sending confidential material to an unapproved model.
Pilot with audit and exit tests
Run one bounded matter type through the old and new process. Check completeness, false routing, missed deadlines, reviewer overrides, evidence quality, access logs, and export. Example counts in this page describe controls, not claims that automation saves a particular percentage or number of hours.
Before renewal, export documents, metadata, approvals, audit history, and deletion confirmation in a usable format. If the company cannot leave without losing legal evidence, vendor lock-in has become a legal risk.
Jurisdiction and effective-date boundary
Sources were reviewed on 21 August 2026; NIST CSF 2.0 was published in 2024. AI, privacy, professional-conduct, cybersecurity, and cross-border transfer rules continue to change, so re-check the rules applicable to the users, data, company, and counsel.
This is a systems-control framework, not legal advice, a security certification, or approval of any vendor. Qualified legal, privacy, security, and local-jurisdiction reviewers must approve the actual workflow.
Frequently asked questions
What should a startup automate first?
Complete intake, reminders, versioning, routing, and evidence export—high-volume steps with explicit rules.
Can AI give final legal answers?
Not in this model. Material interpretation and rights decisions require qualified human review.
What is the minimum vendor exit test?
Export documents, metadata, approvals, logs, and deletion evidence in a usable format.
Does NIST CSF prove legal compliance?
No. It structures cybersecurity risk management; applicable law and contractual duties need separate analysis.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in Automate the Queue, Keep Judgment Human is attributed. Where a number is an estimate rather than a census, the note says so.
- NIST Cybersecurity Framework 2.0Official cybersecurity governance and lifecycle framework.
- ABA Formal Opinion 512Professional-responsibility issues for generative AI use.
- European Commission data protectionOfficial EU GDPR overview and rights.
- ICO AI guidanceUK regulator guidance on AI and data protection.
Primary sources used for this edition.
The bottom line
If an automated legal step cannot show its source, reviewer, decision, and evidence, it is not production-ready.
If you want the adjacent decisions after Automate the Queue, Keep Judgment Human, start with Legal documentation, Legal risk, Legal budget, API-first systems.
