From theory to practice
Artificial intelligence has moved from an emerging trend to an operational reality across legal practice. While stories about hallucinated case law and data breaches have raised valid concerns, defensible standards already exist to guide safe adoption without reinventing the wheel. A recent eDiscovery Today webinar sponsored by Exterro brought together Martin Tully, partner at Redgrave LLP, Kelly Twigger, principal of ESI Attorneys and CEO of Minerva26, and Bryant Bell, lead product marketer for eDiscovery and AI at Exterro, to map out a practical framework for legal teams.
The panel's core message: forward-thinking legal departments should stop treating AI as an abstract risk and start building actionable guardrails that protect client data while enabling teams to work efficiently. Three core guidelines emerged from the discussion.
Provide vetted tools instead of banning AI
The rise of "Shadow AI"-employees independently using consumer-grade chatbots like ChatGPT or Claude for work tasks-is shadow IT in a new form. Outright bans rarely work and often push usage further out of view. Tully used a skate park analogy to explain the better approach.
"When municipalities built skate parks, it was often because there were kids skateboarding, and they were skateboarding in places where it wasn't safe," Tully said. "Knowing that people were going to skate where they found attractive places to skateboard, they built skateboard parks so that now people could use the park in a safe, in a more contained, and a more controlled environment."
For legal teams, that means establishing enterprise-approved AI pathways. Companies should communicate that approved tools are available quickly, rather than forcing employees to seek their own workarounds. Governance also requires verifying how vendor models process internal data. Bell offered a practical diagnostic: "In your legal gen AI system, ask it if a hot dog is a sandwich. And if it can answer that question or gives you different opinions on it, then you probably need to check on whether you have a governed gen AI system or not."
This practical guidance aligns with broader AI for Legal training resources focused on document review and compliance automation. Legal professionals evaluating these tools can also benefit from a structured AI Learning Path for Paralegals that covers AI document review and legal research automation.
Track case law on AI usage and privilege
Courts are issuing rulings on AI usage, prompt discoverability, and privilege waivers. Tracking these precedents is essential when negotiating protective orders and conducting Rule 26 meet-and-confers.
U.S. v. Heppner highlights the risks of unvetted consumer tools. The court determined that voluntarily entering privileged legal information into a public, free-tier chatbot destroyed the reasonable expectation of confidentiality, effectively waiving work-product protection. Tully put it plainly: "Heppner voluntarily imported presumably privileged legal information into a public free tier AI chatbot. The old rule is, is there a reasonable expectation of confidentiality when you do that? No."
In Morgan v. V2X, Judge Braswell ruled that confidential documents under a protective order cannot be loaded into a consumer tool unless three conditions are met: the model does not train on the data, third-party disclosure is prevented, and the user retains deletion rights-supported by written terms of service. Warner v. Gilbarco confirmed that work-product protections remain intact as long as data isn't exposed to opposing parties or unsecured public systems. Tate Group Automotive showed how state privilege rules can produce different results, with Texas law protecting an executive's prompts into ChatGPT as privileged communication.
Apply existing legal fundamentals
Despite rapid technological change, core legal principles, civil procedure rules, and ethical duties remain intact. Tully put it this way: "I always like to start with, is there a Flintstone way to address Jetsons technology? Because if there is, let's stick with what we know and apply the technology, and we don't have to constantly create new rules."
On AI hallucinations, Tully argued that verifying output is an existing professional standard. "What we're talking about is not so much a hallucination using some shiny new object. We're talking about is somebody failing to check their work, which has been something that we're required to do for centuries."
Twigger reinforced the need for human oversight: "If you haven't heard the term human in the loop, what that basically means is that you can use AI, but you still have to be paying attention to all the pieces. It's almost the equivalent of using someone to help you draft something, but then it's your responsibility to check everything that's in it and make sure it's valid, that it's well-reasoned, that the cases that are cited are actually referenced."
Why this matters for legal teams
The takeaway for legal professionals is straightforward: AI adoption doesn't require a new rulebook. It requires applying existing duties-competence, confidentiality, and diligence-to new tools. Build an approved tool pathway instead of banning AI outright. Verify that vendor models stay within your data environment. Track judicial rulings that define privilege boundaries for AI usage. And keep a human checking the work, every time. The technology changes. The professional standard doesn't.
Your membership also unlocks:
