An internal or external auditor asks your legal team a simple question: where is AI being used, and who is accountable for it? If the answer relies on individual recollection, scattered approvals or a policy that nobody can connect to actual workflows, the team is not audit ready.
An AI audit of the legal function is unlikely to be satisfied by a statement of principles. Internal audit, a board committee, a regulator or a client may want evidence that approved systems and use cases are known, risks have been assessed, controls operate in practice, and issues are addressed. For the General Counsel, AI risk needs an operational record, not just a policy.
Start With an Inventory of Systems and Use Cases
The first task is to identify AI use across the legal department. Record both standalone tools and AI features embedded in existing platforms, including research, document, productivity, ebilling and workflow systems.
A useful inventory should capture:
- the system, provider and specific use case
- the business purpose and intended users
- the owner and approving authority
- the types of information entered or generated
- an identification of impacts on individuals and groups
- the risk classification and applicable controls
- the date approved, last reviewed and next review date
- whether the use case is active, being tested or retired
Separate the tool from the use case. One approved platform may suit summarising internal meeting notes but be unsuitable for processing privileged material or supporting a decision with considerable legal consequences. Approval should reflect how the technology is used, not simply whether the vendor is on an approved list.
The inventory should also account for shadow AI. Anonymous surveys, targeted interviews, usage data, and reviews of common workflows can help identify where staff are using unapproved tools or features. The goal is to close control gaps and provide workable alternatives, not to create an incentive to conceal use.
Make Accountability Visible
An audit should trace each use case to a named owner. That person does not need to carry every technical or legal responsibility, but they should be accountable for ensuring the use remains within its approved purpose and is reviewed when circumstances change.
Responsibilities across Legal, IT, Security, Privacy, Risk, Procurement and business teams should be explicit. The record should show who approved the use case, who manages access, who assesses the vendor, who monitors performance, and who decides whether to suspend the system.
Policies should distinguish approved, conditional and prohibited uses. They should also define escalation points, including when human legal judgement is required. AI-assisted workflows can support triage, drafting and administrative work, but legal advice, material approvals and risk decisions still require accountable human review.
Document Data and Vendor Controls
A credible legal AI governance document explains what data enters the system, where it goes and who can access it. For each material use case, document whether inputs may include personal, confidential, commercially sensitive or privileged information, and which controls apply.
Vendor due diligence should cover the service terms, data retention, model training, hosting, data storage, subprocessing, inference processing, access controls, security arrangements, incident notification and the provider’s approach to system changes. The legal function should retain the assessment and the basis for its approval, including any contractual protections or configuration decisions.
This work should connect with existing privacy, information security, records management and procurement processes. It should not sit in an isolated repository. The Office of the Australian Information Commissioner’s guidance emphasises due diligence, privacy controls, human oversight and review throughout the product lifecycle. Those expectations provide a useful reference point for in-house legal compliance, even when an audit has a wider scope.
Preserve Evidence of Testing and Human Review
A control is difficult to defend without evidence that it operates. Legal teams should retain proportionate testing records for each use case, including the scenarios tested, expected results, actual results, identified limitations and actions taken.
Testing should reflect the task’s risks. A low-risk administrative use may need a simple accuracy check. A workflow handling sensitive information or influencing a major decision may require more meticulous validation, access testing, failure scenarios and approval gates.
Human review should be specific; “human in the loop” assumptions are not enough. The record should identify who reviews the output, what they are expected to check, when escalation is required and whether they can reject or reverse the result.
Logs can also provide further evidence, subject to privacy and security requirements. Useful records may include access, material prompts or transactions, approvals, exceptions, overrides and changes to system configuration. Retention periods ought to align with the organisation’s legal and records obligations.
Prepare For Change and Incidents
AI systems, embedded features and organisational uses change. Legal function AI readiness therefore depends on recurring review.
Define events that trigger reassessment, such as a new model, changed service terms, an expanded use case, new data types, poor output quality, a security incident or a regulatory development. Keep a change record showing what was reviewed and why continued use was approved.
Incident procedures should tell staff how to report inaccurate outputs, inappropriate disclosures, unauthorised use and other control failures. The record should show who assessed the issue, what was contained, whether affected stakeholders were notified and what preventative measures were put in place afterwards to mitigate the risk going forward.
What Audit-Ready Legal AI Governance Looks Like
Audit readiness does not mean producing more paperwork than the risk requires. It means connecting each AI use case to a purpose, owner, risk assessment, control, and review record.
General Counsel can begin with a focused internal exercise: select the most significant AI use cases and test whether the team can produce the evidence an independent reviewer would request. The gaps will show where governance exists only on paper and where operational controls need strengthening.
The objective is not simply to be ready for an audit, but to ensure AI governance is embedded into everyday legal operations in a way that is visible, accountable and defensible.