Shadow AI Is Already in Your Firm — Here’s How to Make It Safe
Your associates are probably using AI on client work. The danger is not that they are using it. It is that no one decided how. There is a good chance that a document which left your office last week passed through a generative AI tool first and no partner signed off on it.
This is not a hypothetical. It is one of the most common patterns in law firms right now, in KL and everywhere else. It even has a name: shadow AI. Staff use consumer AI tools on real matters, quietly, because the work is heavy and the tools are helpful. In many firms, far more lawyers use generative AI than work under any written policy governing it.
Why associates use it anyway
Associates are not being reckless. They are being human.
Building a chronology by hand at midnight is miserable. Drafting the tenth similar agreement this month is dull. When a tool makes that faster, people use it whether with policy or no policy.
Blaming them misses the point. The behaviour is a signal that the grind is real. The task is to redirect it, not to punish it.
Why shadow AI is genuinely risky
The problem is not that AI helped. The problem is which AI and under what conditions.
Confidentiality leaves the room
Consumer tools may retain what is typed into them, and some use that material to train their models. For a law firm, that can mean client-confidential information leaving your control — a risk the Bar Council has expressly flagged in Circular No 342/2023 and Circular No 242/2025, and one that also engages PDPA obligations.
Once the text is in a public or consumer system, you have lost the ability to say with confidence where it sits, who can see it or how long it remains.
Accuracy looks fine until it isn't
General models also invent authorities and misstate facts with a calm, professional tone. That is the dangerous part. The output reads like a work product. A quick skim often won't catch it.
Courts in other jurisdictions have already sanctioned lawyers for filing AI-fabricated citations. Those stories travel. Malaysian firms do not need to wait for a local cautionary tale to take the risk seriously.
No audit trail, no ownership
If nobody approved the tool, nobody can show later who used it, on which matter or what left the firm. That is a governance gap as much as a technology gap.
Why banning it usually fails
The instinct is to prohibit.
It fails for the same reason prohibition usually fails: it drives the behaviour underground. You lose visibility. You also lose goodwill and sometimes retention among juniors who want to work with modern tools.
A ban without an alternative tells people: suffer the grind, or hide the shortcut. Most will hide the shortcut.
What actually works: governed AI
The alternative is to give people a sanctioned tool that removes the risk while keeping the benefit.
In practice, that means AI that:
- Runs inside the systems the firm already uses — its email, documents and matter files, not a public website
- Is grounded in the firm's own precedents and matter files so outputs have a real basis
- Keeps every draft under lawyer review before anything reaches a client
- Does not train on client data, with matter-level isolation and an audit trail
That is not a bigger risk than what may already be happening in your firm. It is a smaller one, brought under control.
Start with one question
The first step costs nothing: find out what your people are actually using today.
Ask which tools associates rely on when the drafting piles up. Ask where chronologies and first drafts are getting accelerated. The answer usually settles the argument faster than a policy memo.
Then decide what "approved" looks like for your firm i.e. environment, review rules, matter isolation and what never goes into a consumer tool.
A simple 30-day pass
- Map current use — anonymous is fine at first; you want honesty more than names
- Draw a bright line — what may never go into a consumer tool (client facts, drafts, advice, opposing papers)
- Name one approved path — a governed tool inside your existing workspace, with lawyer review as non-negotiable
- Pilot narrowly — one practice group, two or three workflows, a short window, measurable time saved
- Keep or kill on evidence — if it does not earn its place, say so
That sequence beats a blanket ban. It also beats buying software first and writing policy later.
Do you know which tools your associates rely on when the work gets heavy? It is worth asking before someone else does.
Auxilator helps law firms in Malaysia adopt AI safely inside the firm's own tools and workspace, grounded in the firm's own precedents, with lawyers reviewing every output and no training on client data.
