AI governance is chasing adoption. Four years into generative AI, almost no company has standardized its use of the technology, and most companies are still experimenting to find what works for their business.
That gap has created a workplace reality that formal policy has failed to contain. Two-thirds, or 66%, of office professionals use AI tools at work that they believe are prohibited, according to PagerDuty’s 2026 Shadow AI Survey. Shadow AI detections rose fourfold in a year, according to Verizon’s 2026 Data Breach Investigations Report.
“People have found something useful and are adopting it faster than companies can build processes around it.” That sentence explains the problem without needing a committee, a slide deck, or another cheerful declaration that responsible innovation is just around the corner.
Legal Is Moving Before Policy Catches Up
Legal teams see an opening in this disorder: shadow AI can increase a lawyer’s influence and strategic value. Many lawyers work in-house because they want to be part of the business and understand how the organization works, yet they still spend much of their time on low-complexity work.
AI can handle more repetitive work, allowing legal teams to focus on matters where legal judgment matters. But that shift requires in-house legal teams to understand what the business is trying to accomplish, not merely review a finished AI decision after the fact.
The role now reaches into the design of AI use itself. Legal leaders are helping decide how technology should fit into the business, expanding their role from reviewing decisions to shaping the systems and processes that produce them.
“The fact that questions like this increasingly land with the GC demonstrates how much the role has expanded.” General Counsels are no longer being asked only whether a proposed use creates legal risk. They are helping determine how the business should use AI and what governance must surround that use.
Prototypes Are Easy; Trust Is Not
Natural-language coding has made building AI tools more accessible for GCs. A GC who has never written code can describe what they want and see something functional appear, turning an idea into a working prototype without first becoming a software developer.
That prototype is not an operating system. Running it requires maintenance, security, permissions, integrations, and controls for output quality. The distance between “something functional appeared” and “the business can rely on this” remains the part that tends to arrive without fanfare—and with a bill.
Accuracy matters even more for lawyers because unreliable AI outputs require verification. If people do not trust the output, verification can cost more than the original work, erasing the efficiency the tool was meant to create.
That makes governance a practical business requirement rather than a legal review performed at the edge of a project. Legal teams must help shape how AI enters workflows, what the technology is allowed to do, and how the organization checks its results.
The numbers from September 10, 2026, point to a clear mismatch: employees are adopting useful tools while companies are still figuring out their processes. Legal leaders now sit inside that mismatch, with a chance to replace low-complexity work with higher-value judgment—provided they help build systems people can trust.
Based on
