Rolling Out Legal AI Across a Firm: A 90 Day Implementation Plan

By Michael Nadalin, Founder, Market Lead · 12 October 2026 · 8 min read

Picture a common version of the rollout. The partners approve the licences on a Friday. On Monday every fee earner gets a login and a one page memo saying "verify everything". By the end of the month, three people use the tool daily, most have tried it twice and gone back to their old habits, and nobody can say whether a junior has pasted client instructions into a free chatbot on their phone instead. No one decided any of that. It just happened.

Most of the trouble with legal AI in firms is not the technology. It is the absence of a plan: no agreed list of permitted tasks, no verification step anyone can describe, no person who owns the outcome. Australian courts have now told the profession plainly that responsibility for anything filed sits with the practitioner, whatever tool produced the draft. A rollout that ignores this is a risk decision the firm has made by default.

What follows is a 90 day plan in three stages: foundations, a controlled pilot, then a firm wide rollout with a review at the end. It suits a firm of five as well as a firm of two hundred. The stages stay the same, only the number of people in each one changes.

Why most firm rollouts stall in the first month

Rollouts usually fail in one of two ways. The first is quiet abandonment: the tool is available, nobody was shown what it is good for, the first answer someone gets is mediocre, and they never open it again. The second is worse: enthusiastic unsupervised use, where output goes into advices and submissions without anyone checking the authorities behind it.

Both come from the same assumptions, and the assumptions are worth naming before you spend any money.

The 90 day plan at a glance

The plan has three blocks of thirty days. The first is spent almost entirely on decisions, not software. The second puts the tool in front of a small group doing real work under close supervision. The third extends access to the rest of the firm, practice group by practice group, and ends with a review that decides what continues.

Skipping the first block is the usual temptation, because it feels like delay. It is the block that determines whether the other two produce anything you can rely on.

Days 1 to 30: policy, confidentiality and choosing where to start

Start with the rules that already bind you. Under the Australian Solicitors' Conduct Rules, the duties of competence, confidentiality, candour to the court and supervision of staff apply to work done with AI exactly as they apply to work done without it. In New South Wales, Supreme Court Practice Note SC Gen 23 restricts the use of generative AI in preparing affidavits and witness statements and requires that authorities cited in written submissions be verified. The Supreme Court of Victoria has published guidelines on responsible use of AI in litigation, and other courts and regulators have issued their own guidance. The positions differ and they change, so your policy should name the courts you appear in and require someone to check the current documents, not a summary of them.

The policy itself should fit on two pages. It needs to say which tools are approved, what information may and may not be entered into them, which tasks are permitted, who must check the output, and what gets recorded on the file. Decide your position on telling clients, and check whether any client's engagement terms or panel guidelines already restrict AI use on their matters.

Then choose where to begin. Rank the candidate tasks by how much damage an undetected error would cause, and start at the bottom of that list.

Days 31 to 60: a pilot built around verification

Keep the pilot small enough that one person can read every log entry. Include a partner, a senior associate, a junior and, if you can, the person in the firm most doubtful about the whole exercise. A sceptic who is persuaded by their own matters is worth more than any vendor demonstration, and a sceptic who is not persuaded will tell you exactly why.

The point of the pilot is not to prove the tool is fast. It is to establish a verification routine that people follow when they are busy. Language models can produce case names, citations and quotations that look right and do not exist, or that exist and do not stand for the proposition stated. The only reliable control is a lawyer reading the primary source. Write the routine down as steps, and make it part of the file.

Log the failures as carefully as the successes. A record of where the tool was wrong, by task type, is the most useful document the pilot will produce. It tells you what to permit, what to restrict and what to teach.

Days 61 to 90: extending access without losing control

Extend access one practice group at a time, not all at once. Each group has different documents, different courts and different risks. A property team and a commercial litigation team will not use the same tasks or face the same rules. Have the pilot users run the training for their own group, using examples from the pilot, including the ones that went wrong.

Measure things you can observe, and resist the urge to produce a headline number. Useful measures are: how many people are using the tool each week, which tasks they use it for, how many errors verification caught and of what kind, and whether supervisors report any change in the quality of first drafts. If the firm bills by time, decide now how AI assisted work is recorded and charged. Your costs disclosure obligations and the requirement that costs be fair and reasonable do not change because a draft was produced faster.

Finish with a formal review. It is a real decision point: the answer may be to continue, to narrow the permitted tasks, to change tools or to stop.

What to look for in the tool, and what happens after day 90

The plan above works with any tool, but the tool affects how hard verification is. For research, prefer one built on Australian primary sources that shows you the passage it relied on and links to the judgment or provision, so that step three of the routine takes minutes instead of an afternoon. Legal Brain was built for that kind of work, and it is one option to assess alongside others. Whatever you choose, test it on questions where you already know the answer, including one where the right answer is that there is no authority on point. A tool that invents something in that situation has told you what you need to know.

After day 90 the work becomes routine maintenance. Review the policy when a court you appear in issues or amends its guidance, when your vendor changes its terms, and at least once a year regardless. Include AI use in the induction for new staff and in the supervision of juniors, who still need to learn to read a judgment properly before they can check a summary of one.

None of this is complicated. It asks a firm to do what it already does with any new source of risk: decide who is responsible, write down the rules, start small, check the work and review the result. The firms that have trouble are almost always the ones that skipped straight to the logins.

Frequently asked questions

Can Australian lawyers use AI for legal research?

Yes, subject to your professional obligations and any rules of the court you are appearing in. The duties of competence, confidentiality and candour apply to AI assisted work in the same way as any other work. Every authority must be checked in the primary source before it is relied on, and some courts restrict AI use for particular documents such as affidavits and witness statements.

Does a law firm need a written AI policy?

There is no single rule that requires one in all cases, but it is hard to show that staff are properly supervised without one. A short policy naming the approved tools, permitted tasks, confidentiality limits and verification steps gives principals something concrete to enforce. It also helps in conversations with clients and your professional indemnity insurer.

Is it safe to put client information into an AI tool?

It depends on the tool and its contract terms. Check where the data is stored, how long it is kept, who can access it and whether your inputs are used to train the model. Consumer chatbots used on personal accounts are generally unsuitable for confidential or privileged material, and client engagement terms may impose further restrictions.

How long does it take to roll out legal AI in a law firm?

About three months is a realistic period for a careful first rollout: a month for policy and vendor checks, a month for a supervised pilot, and a month to extend access and review the results. Smaller firms can move faster through the later stages, but the policy and confidentiality work at the start should not be shortened.