home  /  governance & policy  /  incident response
governance · ai for legal practice

Incident response.

Something reached a court, a client or a counterparty that should not have. What happens in the next hour matters more than most firms expect.

begin here

Where is your firm?

Start a conversation with the AI Adoption Concierge, already scoped to incident response. Pick a starting point, or describe your situation directly.

AI Adoption Conciergeincident response · orientation, not legal or ethics advice
Tell me what happens today if someone realises AI output caused a problem — who they call, and whether they would. I'll help you make that route usable. If something has already happened, get professional-responsibility advice in your jurisdiction now.

The reported decisions carry a consistent lesson that has nothing to do with technology. Courts have responded far more severely where an AI-related error was minimised, denied, or discovered by the court rather than disclosed by the firm — the Ninth Circuit's 2026 sanctions order turned in part on a failure to disclose that inaccuracies had come from generative AI. That means the most valuable governance a firm can have is not a control that prevents every error; it is a route that makes early escalation obviously safe, and a decided position on what happens next. Firms that improvise this while a filing deadline looms make worse decisions than firms that decided it on a quiet afternoon.

mechanisms

The first hour.

In order. The sequence matters, and most of it is establishing facts before anyone decides anything.

Stop the spread

Identify whether the same material has been reused in other filings or matters, which it frequently has.

Establish what happened

Which tool, which output, what was checked, by whom. Facts before conclusions and before blame.

Scope the exposure

What went where — a court, a client, a counterparty, or no further than the firm.

Escalate internally

To the named owner, immediately, regardless of how small it currently appears.

Take professional-responsibility advice

From someone qualified in the relevant jurisdiction. This is the point for it, not later.

Decide on disclosure

To the court, the client, or the insurer — a decision the reported record suggests should lean early.

methodology

What the evidence shows — and what we examine.

What to have ready in advance.

A named person to callOne name, known firm-wide, reachable out of hours. Ambiguity here costs hours nobody has.
A no-blame first responseExplicit, and meant. Firms that punish the first report do not receive the second.
Counsel identified beforehandSomeone qualified in professional responsibility, identified before you need them at short notice.
A facts templateWhat to capture, so the record is made while it is fresh and before accounts start diverging.
what's at stake

What the response determines.

The error sets the floor. The response sets almost everything above it.

the sanction, if any individual disciplinary exposure the client relationship insurance position whether it becomes public whether the firm learns anything

Candour appears to matter as much as the error.

Across the reported decisions, outcomes have been markedly worse where the problem was minimised or found by the court. A firm whose people believe disclosure will be punished has built the opposite of a control.

common questions

Incident response — practical questions.

Do we have to tell the court?

That is a professional-responsibility question turning on the jurisdiction, the rules of the tribunal, the nature of the error and the stage of the matter, and it needs advice from someone qualified in that jurisdiction — this is precisely where general guidance is not a substitute. What the reported record suggests is that firms which disclosed promptly have generally fared better than firms whose errors were identified by the court or by opposing counsel. Candour toward the tribunal is among the duties ABA Formal Opinion 512 identifies as engaged by generative AI.

Should the client be told?

Usually yes, and again it depends on the circumstances, the engagement terms and the jurisdiction. The practical consideration is that clients discover these things — from a court order, from opposing counsel, or from the press — and discovering it independently is materially worse for the relationship than being told. Where the error affected the client's matter or their costs, the communication duties are more clearly engaged, and the conversation is better had early and voluntarily.

How do we avoid punishing the person who reported it?

By deciding in advance that the first response is fact-finding rather than accountability, and by saying so in the policy in terms people believe. The failure mode is a firm that says reporting is safe and then makes the first reporter an example, after which nothing is reported again. Where individual conduct genuinely warrants a response, separate that conversation in time and forum from the incident handling. Firms that get this right tend to find near misses surface — which is the only way to fix the process before a real one.

What should change afterwards?

Something specific and visible, or the incident teaches nothing. The useful question is not who erred but where the process allowed it: was there no verification step, was there one that was skipped under deadline, was the tool wrong for the task, or did nobody know the rule. Each of those has a different fix. A written short account of what happened and what changed — circulated internally — does more for the firm than any amount of retraining on the same policy that already failed.

related

Related specialization areas & resources.

Decide the first hour now.

Describe what your escalation route looks like today. The Institute will help you make it usable.

AI adoption conciergeorientation · not legal or ethics advice
Tell me what happens today if someone realises AI output caused a problem — who they call, and whether they would. I'll help you make that route usable. If something has already happened, get professional-responsibility advice in your jurisdiction now.