AI can draft. Lawyers must always review.

A useful first draft is not a finished legal product.

That distinction matters when law firms use generative AI. The technology can organise material, suggest a structure and turn instructions into readable prose. It can also state an invented authority with confidence, flatten an important qualification or fill a factual gap with a plausible assumption.

For a managing partner, the question is therefore not whether a document was drafted by a person or a system. The better question is: who checked it, against what, and who is prepared to take responsibility for it?

The Malaysian Bar's July 2025 advisory is direct. Generative AI output must remain subject to human oversight, legal judgment and ethical consideration. It identifies early drafts, simplified content, checklists and formatting as potentially appropriate uses, with caution. It also says AI should not be used to finalise legal documents without manual legal review, or to handle confidential instructions, privileged information or personal data.

The operating principle is simple: AI may assist with preparation. The lawyer remains accountable for the work.

Start with tasks that can be reviewed

AI is most useful where the task has clear boundaries and the output can be checked efficiently. Three common examples show the difference.

A client update. AI can turn an approved note on a new decision or statutory change into a proposed email with headings and plain language. The reviewing lawyer must still confirm that the law is current, the decision is described accurately, the practical effect is not overstated, and the wording fits the client's circumstances. A general update should not quietly become client-specific advice.

A chronology. AI can help place supplied events into date order and standardise descriptions. The lawyer should compare every entry with the underlying correspondence, pleadings, attendance notes or exhibits. The review should also identify missing periods, disputed dates and the difference between an allegation and an established fact. A clean table can conceal an untidy evidential record.

A first draft. AI can propose the structure of an internal memorandum, letter or clause from a controlled set of non-sensitive instructions. That may remove the blank page. It does not determine the correct legal position, the client's commercial objective or the acceptable level of risk. Those are professional judgments.

This is why "first draft" should describe a stage in the workflow, not a lower standard of care.

Review is more than proofreading

A lawyer reviewing AI-assisted work is not checking only grammar and tone. The review has at least four dimensions.

First, the facts. Names, dates, amounts, defined terms and procedural history should match the file. If the source material does not support a statement, fluent drafting does not cure the problem.

Second, the law. Every case, statutory provision and legal proposition should be checked in an authoritative, current source. An AI-generated citation is a lead at most, not authority. The Malaysian Bar advises practitioners to treat generative AI responses as unverified third-party commentary rather than primary legal sources.

Third, the analysis. The reviewer should test whether the draft identifies the real issue, distinguishes relevant facts and acknowledges uncertainty. A balanced conclusion may require facts or instructions that were never given to the system.

Fourth, confidentiality and data protection. Review begins before information is entered into a tool. The firm should understand the provider's terms, including whether inputs are retained or used for training, and restrict what users may upload. Redaction helps, but labels alone do not make sensitive material safe. Malaysia's Personal Data Protection Act framework includes security, disclosure, retention and data-integrity principles. The Bar Council's cloud guidance also recommends understanding provider arrangements and the risks of access, storage and cross-border processing.

A five-point review workflow

A 30- to 50-person firm does not need a different rule for every practice group. It needs a short, repeatable control that partners, associates, pupils and support staff can follow.

1. Classify the task before using AI. Decide whether the task is suitable, what information may be used and what must stay out. Client-confidential, privileged and personal data should not be entered into a general generative AI tool. Escalate uncertain cases to the supervising lawyer or the firm's designated technology lead.

2. Preserve the source set. Identify the documents and authorities against which the output will be reviewed. For a chronology, this may be a bundle index and correspondence file. For a client update, it may be the judgment, legislation and official announcement. Without a defined source set, "review" can become a quick read rather than verification.

3. Verify facts and authorities line by line. Check every material factual statement, quotation, citation and calculation. Open and read the cited authority. Confirm jurisdiction, court, date, subsequent treatment and the precise proposition it supports. Remove anything that cannot be verified.

4. Apply legal and client judgment. Ask what is missing, what is contested and what the client needs to decide. Test the draft against the retainer, strategy, procedural posture and commercial context. Rewrite where necessary. The aim is not to preserve the machine's wording; it is to produce sound legal work.

5. Record approval and control the final version. The responsible lawyer should be identifiable. Keep an appropriate record of the sources checked, material corrections and final approval, in line with the firm's document and risk-management procedures. Only the approved version should enter the client file, be sent externally or be filed in court.

Make the control visible

A policy is useful only if it changes daily work. Firms should define approved tools, prohibited inputs, permitted use cases, review responsibility and an escalation route. Training should use examples from the firm's own workflow, without exposing client material. Supervision should focus on whether the review can be demonstrated, not whether a document sounds polished.

AI can make the starting point faster. It does not move the finishing line.

For firms considering AI-assisted drafting, Auxilator can help map a controlled workflow in which source material, review steps and lawyer approval remain visible. The product is not the point. The quality of the lawyer's final work is.

Notes

1. Malaysian Bar, Circular No 242/2025, "Updates on the Use of Generative Artificial Intelligence in Legal Practice" (3 July 2025): https://www.malaysianbar.org.my/cms/upload_files/document/Circular%20No%20242-2025.pdf
2. Malaysian Bar, Circular No 393/2024, "Guidance Notes on Cloud Services | Ensuring High Cybersecurity Standards for Law Firms" (21 November 2024): https://www.malaysianbar.org.my/cms/upload_files/document/Circular%20No%20393-2024.pdf
3. Personal Data Protection Commissioner, "Principles of Personal Data Protection" (official guidance on the seven principles under section 5(1) of Act 709): https://www.pdp.gov.my/ppdpv1/en/principles-of-personal-data-protection/
4. Personal Data Protection Commissioner, Personal Data Protection Act 2010 [Act 709] (official Act page): https://www.pdp.gov.my/ppdpv1/en/akta/pdp-act-2010-en/
5. Malaysian Bar, Rules and Rulings of the Bar Council, updated 13 July 2026: https://www.malaysianbar.org.my/cms/upload_files/document/Rules%20and%20Rulings%20BC%202026-13%20Jul%202026.pdf