What will your AI find when it starts looking?
Peter Fisher, chief product officer at Morae, outlines why law firms should begin with reviewing records before implementing AI
AI will find your firm’s best work but it will also find the outdated drafts, forgotten folders and confidential files nobody meant to share. For law firms, getting value from AI starts with knowing what it can see.
Picture a trainee preparing for a client meeting. They ask the firm’s new AI assistant to pull together recent work on a similar transaction. The answer is fast and useful but it also includes a superseded draft containing out-of-date advice, and a document from another client’s matter, closed years ago, that should have been deleted.
The critical point is, the AI assistant cannot tell the difference. It’s designed to find what is relevant and what the user can access — and treats it all the same. That is the trade-off: the more content AI can reach, the more useful it becomes but the more it can expose. The degree to which AI adds value or adds risk depends less on the model than on the data underneath it.
The data you know about, and the data you don’t
Most firms know their document management system (DMS) well. Matters are opened, filed and closed within it, and it is the system auditors and clients ask about — but the DMS only holds the documents the firm is choosing to manage, and even then most DMS systems contain a decade or more of data.
Client data also lives in email, file shares, OneDrive and on laptops, spreading the moment someone forwards an attachment or saves a local copy to work on over the weekend.
Over time, this builds up — partners retire or move firms, and their folders stay behind with no clear owner, matters close, but the working copies outside the DMS exist regardless. Keeping everything feels like the safer option but in practice it is neither safe nor cheap: every file kept is a cost to store and a risk to explain.
For firms, the problem is rarely classification; work is already organised by client and matter. The challenge is accumulation: years of content sitting inside and outside managed systems, with nobody accountable for it. For a long time that content was effectively invisible and therefore the impact minimal. It was hard to find, so in practice it was rarely found.
Why AI raises the stakes
AI has changed that. Copilot and similar assistants typically work within the permissions a user already has. If a folder was shared too widely years ago, the AI can surface its contents in seconds.
For a law firm, the consequences go beyond inconvenience. Information barriers depend on people not seeing what they should not see. Confidentiality obligations do not end when a matter closes and if a breach occurs, the first question will be which clients’ information was exposed. A firm that cannot answer that quickly has a problem whether or not AI is involved, AI is simply bringing the moment of reckoning forward.
There is a quality issue too as AI amplifies what it can see. If the content it draws on is outdated, duplicated or superseded, the answers will reflect that, and fee earners will stop trusting the tool or worse — trust misleading outputs.
Three steps before you switch it on
The steps will be familiar to anyone who has worked on records management. The difference is the urgency.
- Find out what you hold, where it sits and who can access it. That means looking beyond the DMS to email, file shares and cloud storage, and covering physical records where they still drive cost. You cannot govern data you do not know exists.
- Decide what matters. Agree retention rules tied to matter status, client requirements and regulatory obligations. Settle ownership of departed partners’ data now, before it becomes an AI question.
- Apply those decisions consistently. Delete what has no legal or business value, with an audit trail that shows why. Tighten access where it has drifted. Build this into your systems, so it does not depend on every fee earner remembering to file correctly.
Then keep doing it. Many firms have treated records reviews as a periodic exercise, tackled every few years or ahead of an office move. AI does not wait for the next review. New content is created and shared every day, and the assistant can see it straight away. Inventory, policy and action have to run as a continuous cycle, not a one-off clean-up.
None of this needs to be finished across the whole firm before an AI pilot begins. Start with the repositories the pilot group will touch, and widen from there.
Find it first
Firms that do this groundwork will get more from AI, because it will draw on content that is current and relevant. They will also be ready for a question any client is entitled to ask: where is all our data, and who can see it? The answer should take hours, not weeks.
So before you switch it on, ask what your AI will find when it starts looking. Better that you find it first.
