Your Staff Are Already Using AI. You Just Don’t Know About It.

I run operations for a firm with 40 employees across nine locations. I can tell you exact numbers on our demands last month, our complaint volume, and our settlement pace. Before we got serious about AI governance, I couldn’t tell you what tools my staff were quietly using to do the work.

I’ve talked to too many firm leaders who don’t think their teams are using AI. No tools have been approved. Nobody has raised the issue. Therefore, it isn’t happening. 

That assumption is almost certainly wrong, and it leaves your firm exposed in ways you haven’t accounted for. The question isn’t whether your staff are using AI. They are, you may just not be aware of it. That’s why it’s called shadow AI. 

The real questions are what AI they’re using, how they’re using it, and what it takes to move them onto tools the firm actually controls.

Shadow AI Is a Liability for Your Firm

I’m not speculating when I say your staff are using AI. I’m describing what I’ve seen firsthand. 

2026 industry research found that at least 60% of personal injury firms have adopted or scaled their use of AI tools. I say “at least” because that’s just what firm leaders are reporting.

Staff across the industry are uploading client documents to consumer-grade shadow AI tools, platforms their firms never vetted, on personal accounts that don’t belong to the firm. Confidential case information flowing into systems with no data controls, no audit trail, no accountability. These are serious liabilities, and most firm leaders haven’t looked at them squarely.

The instinct driving it makes sense. These are capable people trying to work efficiently, and the tools are everywhere and easy to use. But from a compliance standpoint, every one of those interactions is a potential exposure. Client data on a consumer platform. Financial information on a tool not built for legal work. Interactions that may be discoverable in ways nobody on your team has thought through.

This isn’t happening because your staff are careless. It’s happening because no one has given them a clear policy, a vetted system, or a reason to use anything other than whatever’s most convenient.

Standards and Accountability Change the Equation

The fix isn’t banning AI. That doesn’t work, and it signals to your team that leadership is out of touch with how the work actually gets done. The fix is giving your staff a better option, one with guardrails the firm actually controls.

For us, that meant going with EvenUp. We evaluated options and chose them because they were established, we trusted the people behind the product, and we believed in where they were headed. What mattered operationally was that it was a closed-loop system: client data stayed within the platform, we controlled the permissions, and we set the standards.

Control Doesn’t Stop at Data Security

Getting control over AI use solved one problem. The next step was making sure the output reflected our firm’s standards. We have what I’d call unreasonably high standards. Every document that leaves this firm needs to be right. The reality is that AI can produce very different results depending on the tool and the person using it. Left unmanaged, that’s a consistency problem. Two people can start with the same case file and end up with two very different drafts.

We didn’t want AI generating generic documents. We wanted documents that sounded like Ostroff Godshall, like us.

Capabilities like Mirror Mode helped us make that shift. Instead of relying on Word templates spread across nine offices, we built our preferred structure, formatting requirements, and drafting standards directly into the platform. That mattered because we operate across 67 Pennsylvania counties, each with its own requirements. Before, consistency depended on people finding the right template and following the right process. Now those standards are built into the workflow itself.

Whether a document is drafted in Pittsburgh, Philadelphia, or any of our other offices, it starts from the same foundation. AI doesn’t replace our firm’s voice. It applies it more consistently.

Your AI Use Policy Is a Leadership Decision, Not a Dormant IT Document

An AI use policy is not something you hand off to IT and file away; it’s a leadership decision about what your firm stands for and what your clients deserve.

A workable policy covers three things:

1. Which tools are approved and under what conditions.
2. What categories of data can and cannot be used with an external system.
3. How AI-generated work product is reviewed, approved, and owned by the firm.

The closed-loop distinction matters more than people realize. Consumer AI tools aren’t built for confidentiality. They aren’t built for the audit trail required by legal work. And they aren’t built to produce the consistent, jurisdiction-aware output that a PI firm needs across a high-volume caseload. Choosing a closed, purpose-built system isn’t just a compliance decision. It’s a quality decision.

Time for Firm Leaders to Take the Lead on AI

The question isn’t whether your staff are using AI. They are. The question is whether you’ve made a deliberate choice about how, or whether you’re leaving that decision to whoever finds the most convenient tool.

Build the policy. Vet the platform. Give your team something better than whatever they found on their own. When you do, compliance and performance no longer work against each other. The right governance framework makes both possible.

Marina Bradley is the executive director of Ostroff Godshall Injury and Accident Lawyers, Pennsylvania’s only statewide local personal injury firm, with nine locations across Pennsylvania and New Jersey.