Eight AI priorities law firms should consider ahead of PII renewal
Artificial intelligence (AI) is no longer something law firms can simply watch from the sidelines. It’s being widely used across practices for drafting, research, summarising, document review, administration, searching, time recording and myriad other tasks.
The range of AI tools available is expanding rapidly. Alongside ChatGPT and Microsoft Copilot, legal-specific platforms are increasingly bringing AI into everyday workflows. LEAP, for example, has a growing suite of AI functionality including Matter AI for matter insights, LawY for verified legal knowledge, Generator for document creation, Prompts for legal drafting and AutoTime for time recording.
The important point is not which tools you choose, but whether you understand how they work, what information they use and what controls need to sit around them.
AI in relation to PII
You see, while AI can bring significant benefits, its use also introduces new risks. And when it comes to professional indemnity insurance (PII), the issue isn’t necessarily whether your firm is using AI. It’s whether you can demonstrate that you’re using it properly, safely and with appropriate oversight.
With PII often representing the second largest cost for most firms after salaries, the annual renewal process deserves careful attention. Renewal season typically falls around September or October so now’s an opportune time to consider whether your firm’s approach to AI is robust enough to withstand scrutiny from insurers, regulators and clients, if you haven’t already
AI adoption isn't the risk. In fact, it presents many commercial advantages under the correct circumstances. Uncontrolled AI adoption is the risk
There’s an important distinction between using AI and using it without appropriate controls.
Insurers increasingly expect firms to understand the risks associated with new technology and to have sensible measures in place to manage them. Regulators and clients are also asking questions about how firms are using AI, especially where confidential information, legal judgement and client communications are involved.
That means you need to be able to demonstrate that AI isn't simply being adopted because it’s available. There should be a clear framework around what tools can be used, what they can be used for, what information can be entered and who remains responsible for the outcome.
So, as you approach your next PII renewal, what should you be looking at?
Immediate priorities for your firm
1. Put an AI governance policy in place
If your firm doesn’t already have one, an AI policy should be a priority.
It should set out how AI can and cannot be used across your business, including approved tools and prohibited uses. It should also establish who’s responsible for overseeing AI use and how concerns or incidents are dealt with.
A policy sitting in a folder isn't enough, though. People need to understand it and know how it applies to their day-to-day work, which means education and communication are critical
2. Be clear about what data can be entered
One of the biggest dangers associated with AI is breaching confidentiality.
Your staff should understand exactly what information can be entered into a specific AI tool (as they vary) and what should never be shared. Sensitive client information should not be entered into unrestricted public AI tools, and your people should understand how each platform handles, stores and protects the information submitted to it.
This is particularly important for the law sector, where confidentiality and legal privilege are fundamental obligations.
3. Make human review non-negotiable
AI can produce impressive-looking content that’s inaccurate, incomplete or simply wrong.
That makes human oversight essential. AI can assist with legal work, but it cannot take responsibility for professional judgement.
This applies even where AI is drawing on a controlled legal knowledge base. Tools such as LEAP’s LawY, which provides verification from lawyers, can support legal research and understanding, as the output is authenticated by a qualified individual.
You should have clear processes for checking AI-generated content, particularly where outputs could influence legal advice, documents or decisions affecting a client. Being able to demonstrate that appropriate human review takes place is also an important part of showing insurers and regulators that AI is being used responsibly.
4. Don't overlook client-facing AI
AI isn't only being used behind the scenes.
Website chatbots and other AI-powered client interactions can create additional risks if your clients aren't clear about who – or what – they’re interacting with, or if information is passed to a third-party provider.
If your firm uses client-facing AI, consider whether appropriate disclosures and disclaimers are in place, how personal information is handled and where responsibility sits for the information provided.
5. Review your insurance arrangements
AI-related incidents don't necessarily fit neatly into one category of insurance.
For example, an incident involving negligent legal advice may fall within PII, while a data breach may involve cyber insurance. A confidentiality issue could potentially involve both.
The important point is to understand your firm's actual exposure rather than assume that an existing policy automatically covers every consequence of AI use.
As part of your renewal preparations, speak to your broker and insurer about how your firm's AI activities affect your coverage and whether any gaps need to be addressed.
6. Train your people
A policy is only as effective as the people expected to follow it.
Staff should understand your firm's approved AI tools, what information they can use with them, how to check outputs and when they need to seek further advice.
Training doesn't have to mean turning everyone into an AI specialist. It means giving people enough knowledge and confidence to use the technology appropriately and recognise when something isn't quite right. And like any new process, people need to understand the value to them to buy into it. There are many benefits, but often people who are fear-driven will steer away from it completely, rather than think about how they can learn to adopt tools in a phased and risk-averse way.
7. Keep a register of AI tools
Do you actually know which AI tools are being used across your firm?
That might include general-purpose tools such as ChatGPT and Microsoft Copilot, as well as legal-focused tools like LEAP’s Matter AI, LawY, Generator, Prompts and AutoTime. A register doesn't need to become a complicated exercise, but it should give your firm a clear picture of what’s being used and where.
A central register can help you keep track of the platforms in use, what they’re being used for, who has access to them and what data they handle. This becomes particularly useful when reviewing risks, updating policies, training staff and answering questions during the PII renewal process.
8. Make AI governance an ongoing process
AI is developing too quickly for governance to be something you establish once and then forget about.
Consider introducing regular reviews at board or management level – quarterly, for instance – to look at new tools, emerging risks, incidents, training needs and whether existing policies remain appropriate.
This also creates a useful record of ongoing oversight, rather than simply demonstrating that an AI policy was written and filed away.
What might your insurer want to know?
As AI becomes more embedded in legal practice, your firm should expect questions about how you’re managing it.
You should be prepared to explain:
Which AI tools does your firm use?
What are they used for?
What information can staff enter?
Which uses are prohibited?
Do you have an AI policy?
How are AI-generated outputs checked?
What training have staff received?
How are new AI tools assessed before they’re introduced?
Who has responsibility for AI governance?
How are risks and incidents monitored?
Have your AI-related risks been discussed with your broker or insurer?
Being able to answer these questions clearly can demonstrate that your firm isn't simply experimenting with AI but has thought carefully about the risks that come with using it.
Don't wait until the push back questions arrive at renewal stage
PII renewal shouldn't be treated as an annual paperwork exercise. It’s an opportunity to take a proper look at the risks your firm is carrying and whether your existing arrangements still reflect the way your practice operates. The required data for a PII renewal is already extensive and can be time consuming depending on the reporting solutions available to your firm, so this is only going to add to that complexity.
With AI now forming part of everyday legal work for many organisations, it belongs in that conversation.
The good news is that responsible AI adoption doesn't have to slow innovation down. In many cases, putting sensible controls around AI gives people greater confidence to use it effectively and compliantly and adds real value to their day-to-day routines, as well as impacting client outcomes positively
The key is to have the foundations in place: clear policies, approved tools, trained people, human oversight, documented processes and ongoing governance.
Final thoughts
The firms most likely to get the best from AI won't necessarily be those that use the most technology. They will be those that understand where it adds value and have the right controls around it.
Good governance can protect more than your firm’s data and reputation. It can help demonstrate to clients, regulators and insurers that your firm understands its responsibilities and is taking them seriously.
And as PII renewal season is in our midst, that’s worth thinking about sooner rather than later.
We’ve previously looked at the importance of understanding your firm's data and reporting through our work around PII and Power BI. The same principle applies here: good technology decisions start with having a clear understanding of what’s happening across your firm.
AI isn't going away, and banning it across the board will likely result in some lost opportunities and possible removal of the competitive advantage delivered with technological innovation. The challenge is to make sure your people can use it in a way that’s safe, controlled and appropriate for a modern legal practice.
Get in touch
If you’re reviewing your firm’s approach to AI, technology governance or IT security ahead of PII renewal, we can help. From daily IT support to practical advice on making technology work for your firm, we can help you understand your options and put the right infrastructure in place. To get in touch, email info@jayvaglobal.com or complete our enquiry form.