Why Law Firms Need an AI Strategy Before the Next AI Subscription

For most law firms, AI is already in the building -- whether leadership authorized it or not.

A November 2026 column on Above the Law by cybersecurity consultants at Sensei Enterprises lays out a disciplined framework for law firms to move from informal AI adoption to intentional AI strategy. The authors -- Michael C. Maschke, Sharon D. Nelson, and John W. Simek -- distinguish between AI adoption (employees using AI tools) and AI readiness (the firm actually preparing to manage the risks those tools create).

The piece focuses on three failure modes law firms are walking into without a plan: security gaps from unvetted tools handling confidential client data, inadequate attorney training on AI limitations, and buying more AI subscriptions before measuring results from the ones they already have.

Key Takeaways

• Security questions come first. Before any AI tool handles client data, firms need answers: Does the vendor use uploaded data to train models? Who has access? What happens when the subscription ends? These should be routine procurement requirements, not afterthoughts.
• Training isn't optional. AI tools cannot compensate for attorneys who don't understand their limitations. Polished output doesn't mean accurate output -- and attorneys remain responsible for the work product regardless of how it was produced.
• Measure before expanding. Start with a narrow set of use cases, measure accuracy and time savings honestly, and adjust before expanding access. Not every task benefits from AI, and not every tool earns a place in the budget.

The authors close with a question worth borrowing beyond legal practice: "Do we have a strategy for the AI tools we already use?"

🔗 Read the full article on Above the Law