Law firms and in-house legal departments are adopting AI agents for document review, research, drafting, intake, and matter management — work that routes the profession's most sensitive material through autonomous systems. Legal is a distinctive governance vertical because its core obligations are not sectoral regulations layered on top of business practice; they are professional duties — confidentiality, privilege, competence, supervision — whose breach carries consequences ranging from malpractice exposure to waiver of privilege in live disputes.

This post walks the governance controls that matter for legal AI agents, mirroring the approach we've taken for healthcare and financial services.

Legal confidentiality is structured differently from ordinary enterprise data protection. Access is not organized by department or seniority but by matter: which client, which engagement, which ethical walls apply. A document-review agent with firm-wide document access is not a convenience — it is a conflicts breach waiting to be discovered, because information barriers between matters (including barriers required by conflicts of interest) are load-bearing professional obligations, not preferences.

Privilege adds a second asymmetry: the harm from disclosure is not only reputational but evidentiary. Privileged material that leaks into the wrong context — an agent's summary delivered to the wrong audience, a prompt sent to an ungoverned external model — can support waiver arguments in litigation. And agents are precisely the kind of system that moves content between contexts at machine speed, which is what makes ungoverned shadow AI usage inside firms an acute problem rather than a policy footnote.

Agent Identity and Matter-Level Access

The foundation is per-agent identity with matter-scoped permissions. Each agent registers as its own principal — no shared service accounts — and its data access is scoped to the matters it serves, enforced at the platform rather than promised in a policy document. Ethical walls translate directly: an agent serving Client A's matter must be technically unable to retrieve Client B's files when the two are walled, and the wall must hold even if the agent is manipulated through injected content, which is why enforcement belongs outside the agent's own reasoning.

Delegation needs the same discipline. Research agents handing work to drafting agents should pass task-scoped tokens bounded by the matter, per the continuous authorization model, so no delegation chain quietly crosses a wall.

Guardrails: Protecting Privilege in Both Directions

Content guardrails for legal agents do double duty. Inbound, they defend against injection attacks arriving in the material agents review — opposing counsel's documents, discovery productions, and inbound correspondence are adversarial by definition, making legal document review one of the few workflows where hostile input is the expected case. Outbound, they protect privilege and confidentiality: detecting client identifiers, privileged-material markers, and matter-confidential content in agent outputs, tool-call parameters, and anything bound for external systems — with block/redact/escalate actions calibrated to the flow, per bidirectional guardrail design.

Model routing is part of the same control: which models agents may call, under what data-processing terms, with what retention — enforced centrally so a well-meaning associate's agent cannot route privileged text to an unapproved endpoint.

Audit Trails That Satisfy Supervision Duties

Professional-conduct frameworks impose supervision obligations on lawyers for the work done under their responsibility — and regulators and bar guidance have made clear this extends to technology-assisted work. For agents, supervision requires attribution: which agent did what, on which matter, reviewed by whom. An append-only, tamper-evident audit trail provides the substrate — every retrieval, tool call, and output attributable to a specific agent identity and delegation chain — and human-in-the-loop review provides the supervision surface for the outputs that carry professional judgment: filings, advice, and client communications should carry a responsible lawyer's review, recorded in the same trail.

That trail also serves the firm's own defense: when a client's outside-counsel guidelines ask how AI was used on their matter — an increasingly standard question — the answer should be a query, not an investigation.

Risk Classification and the EU AI Act

For firms and legal teams operating in or serving the EU, the AI Act's framework applies to legal AI on the same use-based logic as everywhere else. Systems intended for use in the administration of justice sit in the Act's high-risk territory; internal drafting and research aids generally do not. As of July 2026, the post-Omnibus timeline governs the planning: Article 50 transparency obligations (including disclosure when clients or the public interact with AI systems) take effect 2 August 2026, while Annex III high-risk obligations land in December 2027 — the split explained in what the Digital Omnibus changed. Per-agent risk classification, recorded with reasoning and kept current as agents' functions evolve, is the working artifact — the same discipline as the compliance checklist.

Ongoing Controls: Reviews, Budgets, and Vendor Diligence

Three operational disciplines round out the program. Access reviews on a matter lifecycle: when a matter closes or a wall changes, agent access changes with it — inactivity detection catches the review agent still holding access to a settled case. Budgets and rate limits per agent and matter, both as cost governance (client billing guidelines increasingly ask) and as blast-radius control. Vendor and tool diligence for the research databases, e-discovery platforms, and MCP-connected tools agents call — each is an extension of the confidentiality perimeter and should be vetted and scoped accordingly.

Common questions

Can AI agents be used on privileged material at all? Yes, subject to the same confidentiality analysis as any technology vendor or system: controlled access, appropriate terms with any external processors, and demonstrable safeguards. The governance question is not whether agents may touch privileged material but whether the firm can show matter-scoped access, protected flows, and supervised outputs when asked.

What is the single most important control for legal AI agents? Matter-level access scoping enforced at the platform: agents technically unable to read outside their matters, with ethical walls expressed as hard boundaries. It addresses confidentiality, conflicts, and privilege exposure simultaneously — and it is the control clients and regulators ask about first.

How do professional supervision duties apply to agents? Responsible lawyers must be able to review and stand behind agent-assisted work. Operationally: attributable logs of agent actions per matter, human review gates on outputs carrying professional judgment, and records of that review — the same evidence that satisfies outside-counsel guideline inquiries.

Does the EU AI Act make legal AI high-risk? Use-based, not blanket: systems used in the administration of justice sit in high-risk territory; internal research and drafting aids generally do not. Classify per agent, record the reasoning, and plan against the post-Omnibus dates — transparency duties in August 2026, high-risk obligations in December 2027.