Shadow legal: when AI moves legal decisions outside Legal

In many cases, that is useful. It can reduce repetitive work and help business teams move faster.

The catch is that a lot of this happens in personal AI accounts that Legal has not approved and does not know about, so contract terms and customer data end up in tools nobody has vetted.

We call this shadow legal. It turns into a much bigger problem once a chatbot’s answer starts shaping what the organisation agrees to sign.

Legal work is moving outside Legal

Contract-related decisions have always been made outside the legal team to some extent. Sales negotiates commercial terms, procurement handles supplier agreements and business teams work with templates and standard contracts every day.

AI increases the amount of legal work they can do independently, but it also makes it easier for legal judgement to move outside the structures that Legal has put in place. When that work runs through a personal chatbot account, confidential contract terms and personal data can also end up with a vendor the company has no data processing agreement with, and nothing is logged for Legal to look at later.^[1]

A model may explain that a clause is common in the market or suggest wording that appears reasonable. What it does not automatically know is whether that position is acceptable for your organisation.

A liability cap can be market standard and still exceed your approved limit. A clause can be legally valid and still create a risk the business has decided not to take. A concession made in one negotiation can be entirely inappropriate in another.

Those decisions depend on the organisation’s own policies, risk appetite and previous legal judgement.

Shadow legal is the legal side of shadow AI

Shadow AI usually refers to employees using AI tools without approval or oversight.^[1][2]

Shadow legal is the part of that problem that involves legal work, with contracts and negotiation positions handled in tools Legal has not sanctioned.

We would go further and say the risk stays after a company rolls out an approved AI assistant, because a sanctioned tool still does not know the organisation’s own positions. A general-purpose model can be fully approved by IT and still suggest a position Legal would reject, and then legal decisions get made without reference to the standards the organisation has already set.

That distinction matters as AI becomes embedded in everyday tools and workflows.

The problem is no longer simply that someone might use the wrong AI tool. It is that more people can now make decisions with legal consequences before Legal ever sees the contract.

The answer is not to send everything back to Legal

Trying to route every AI-assisted contract back through the legal team would remove much of the efficiency these tools can create. It would also push people back to the personal tools they used before. The approved route has to be at least as quick as opening a chatbot, or business teams will keep going around it.

Instead, organisations need a way to make Legal’s approved position available wherever contract work happens.

Business teams should be able to understand which terms are acceptable, which are not and which genuinely require Legal review. The same standards should apply whether the contract was drafted internally, received from a counterparty or worked on in another tool.

This allows routine work to move forward while giving Legal visibility into the exceptions that actually require judgement.

As AI makes legal work more distributed, legal governance has to become more scalable too.

The opportunity is not to stop people using AI. It is to make sure that the organisation’s own standards continue to govern the decisions that follow.