The Legal AI Agentic Task Boundary Report 2026: What Law Firms and Legal Departments Are Actually Permitting AI Systems to Do Autonomously — and Where the Human-in-the-Loop Lines Are Being Drawn

Research briefing — a review of public sources. The Legal Stack did not conduct a survey, benchmark or interviews for this piece.

The evidence gap, stated plainly

The title asks what law firms and legal departments are actually permitting AI agents to do on their own. No published survey answers that with reliable numbers. Law firms and legal departments rarely publish how their AI systems are configured. We found no public dataset that measures, by organisation type, which tasks are fully automated, which notify a human, and which require approval. An earlier version of this briefing included a table of percentages by firm size. They were illustrative estimates, not data, and they have been removed.

What the public record does show is:

• the agentic products legal vendors are shipping and how they describe oversight;
• the first regulator-approved AI-driven law firm and the conditions attached to it;
• governance frameworks written specifically for agentic AI;
• security guidance on "excessive agency";
• the professional-responsibility and insurance context.

From that we draw a practical, clearly labelled framework for where the lines should sit.

What vendors are shipping, and how they describe oversight

Agentic features are now mainstream in legal products.

Thomson Reuters. On 5 August 2025 Thomson Reuters launched CoCounsel Legal. Its "Deep Research" creates multi-step research plans and produces cited reports. Its "guided workflows" are agentic multi-step task flows, with planned workflows covering drafting complaints and discovery requests and responses, and reviewing deposition transcripts. Thomson Reuters said the workflows "provide human oversight by design". The release does not describe specific approval checkpoints.

Microsoft. On 30 April 2026, through its Frontier early-access programme, Microsoft launched a Word Legal Agent for US users. It runs inside Microsoft 365 Copilot and reviews contracts clause by clause against a playbook. It was built partly by the Robin AI engineering team Microsoft acqui-hired in January 2026.

Harvey. At the time of its March 2026 growth round, Harvey reported more than 100,000 lawyers across about 1,300 organisations as users.

Analysis. "Human oversight by design" is a vendor's description, not a control you can audit. Buyers should ask where exactly the product pauses for approval, which actions it can take without one, and whether those settings are configurable and logged.

Some caution about the "agentic" label is also warranted. Gartner, in a 25 June 2025 release, predicted that over 40% of agentic AI projects will be cancelled by the end of 2027, because of costs, unclear value or inadequate risk controls. Gartner also warned of "agent washing", estimating that only about 130 of the thousands of vendors claiming agentic AI offer the real thing. Gartner expects agentic AI to make at least 15% of day-to-day work decisions autonomously by 2028, up from 0% in 2024. These figures are cross-industry, not legal-specific.

A regulator's line: Garfield.Law

The clearest public example of a regulator drawing human-in-the-loop lines for an AI-driven legal service is in England and Wales. On 6 May 2025 the Solicitors Regulation Authority (SRA) authorised Garfield.Law as the first law firm providing regulated services purely through AI. Solicitors Journal reported that the service guides small and medium-sized businesses through debt recovery and small-claims litigation up to trial. Conditions reported at approval:

• the system operates under client approval;
• named regulated solicitors keep "ultimate responsibility" for outputs;
• the SRA reviewed quality-check, confidentiality and conflict-management mechanisms;
• supervision and monitoring apply during launch;
• mandatory insurance is in place.

The SRA's stated concern included the risk of AI producing inaccurate case law.

Analysis. The SRA authorised a narrow, high-volume, well-defined workflow. It relied on human accountability and approval rather than open-ended autonomy. That is a useful template for in-house and law-firm deployments.

What agentic-specific governance frameworks say

Singapore's Infocomm Media Development Authority launched a Model AI Governance Framework for Agentic AI on 22 January 2026. Baker McKenzie summarised its four dimensions:

1. Bound risks upfront. Assess autonomy, sensitive data access and data breadth for each use case, and limit agents' tools, permissions and scope of action by design.
2. Make humans accountable. Assign responsibilities across developers, deployers, operators and users, and keep human oversight that can override, intercept or review agent actions with real-world impact.
3. Implement technical controls. These include tool guardrails, least-privilege access, pre-deployment testing of tool-use accuracy, progressive rollouts and real-time monitoring.
4. Enable end users. Tell users what the agent can do, provide escalation contacts, and train people to keep essential skills.

The OWASP Top 10 for LLM Applications (2025) frames the same problem in security terms as "Excessive Agency", meaning damaging actions taken in response to unexpected or manipulated model output. OWASP identifies three root causes: excessive functionality, excessive permissions and excessive autonomy. Its recommended mitigations include:

• giving the system only the tools it needs;
• applying least privilege;
• executing actions in the user's own context rather than through a broad service account;
• requiring human approval for high-impact actions;
• "complete mediation", meaning downstream systems check every request against policy rather than trusting the model.

OWASP notes that logging and monitoring limit damage but do not prevent excessive agency.

Analysis. Both sources support a distinction the original article drew without evidence: written policy alone is weaker than technical enforcement. Under OWASP's model, a boundary that exists only in a policy document is not a control. An agent with write access to the calendar or e-filing system can use it whatever the policy says.

Professional responsibility and insurance

ABA Formal Opinion 512, issued on 29 July 2024, applies lawyers' existing duties of competence, confidentiality, communication, candor, supervision and reasonable fees to generative AI. It is not specific to agentic AI. We found no US bar opinion addressing autonomous agents as a separate category. But the supervision duties apply whether the tool drafts one paragraph or performs ten steps. Courts continue to hold lawyers responsible for AI-generated errors in filings, as in Park v. Kim, 91 F.4th 610 (2d Cir. 2024), where the Second Circuit referred a lawyer to its grievance panel over a fabricated citation.

On insurance, the ABA Journal reported in February 2025 that coverage for AI-related errors under lawyers' professional liability policies is uncertain. AI use may not fit a policy's definition of professional services, especially where sanctions follow. The same article gave an example of a $10 million policy capping a single AI-related claim at $500,000, while noting such sublimits appear mainly in property policies. We found no public evidence for the earlier claim that named legal malpractice carriers are drafting agentic-specific sublimits. Firms should ask their broker directly.

A practical authorization framework (analysis)

In the absence of benchmark data, the following tiering applies the IMDA and OWASP principles to common legal tasks. It is our recommendation, not a description of market practice.

Three practical points follow:

• Deadline calculation belongs in the second tier at most. A wrong date that reaches the docket without review is exactly the kind of high-impact, hard-to-reverse action that OWASP's human-approval mitigation targets.
• Vendor updates can change what an agent is able to do. Review permission scopes at each major release, not only at go-live.
• In-house teams buying tools through business units should map those tools' permissions as well. The IMDA framework puts accountability on the deployer, not just the developer.

Sources

• Thomson Reuters, "Thomson Reuters launches CoCounsel Legal: transforming legal work with agentic AI and deep research" (5 Aug 2025): https://www.thomsonreuters.com/en/press-releases/2025/august/thomson-reuters-launches-cocounsel-legal-transforming-legal-work-with-agentic-ai-and-deep-research
• Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027" (25 Jun 2025): https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
• Solicitors Journal, "SRA approves first AI-driven law firm" (6 May 2025): https://www.solicitorsjournal.com/sjarticle/sra-approves-first-ai-driven-law-firm
• Baker McKenzie, "Singapore: Governance framework for agentic AI launched" (29 Jan 2026): https://www.bakermckenzie.com/en/insight/publications/2026/01/singapore-governance-framework-for-agentic-ai-launched
• OWASP, "LLM06:2025 Excessive Agency": https://owasp.org/www-project-top-10-for-large-language-model-applications/2_0_vulns/LLM06_ExcessiveAgency
• ABA Journal, "Does your professional liability insurance cover AI mistakes? Don't be so sure" (1 Feb 2025): https://www.americanbar.org/groups/journal/articles/2025/does-your-professional-liability-insurance-cover-ai-mistakes-dont-be-so-sure/
• American Bar Association, "Formal Opinion 512: Generative Artificial Intelligence Tools" (29 Jul 2024): https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
• Law360, "2nd Circ. Rebukes Atty For Fake Citation In Latest AI Blunder" (30 Jan 2024): https://www.law360.com/legalethics/articles/1791788
• Microsoft 365 Message Center (via merill.net), "MC1296877 - Microsoft 365 Copilot: Legal Agent for Word" (30 Apr 2026): https://mc.merill.net/message/MC1296877
• Legal IT Insider, "Microsoft turns up to its own fight with new Word Legal Agent" (1 May 2026): https://legaltechnology.com/microsoft-turns-up-to-its-own-fight-with-new-word-legal-agent/
• Artificial Lawyer, "Microsoft ‘To Acqui-Hire Robin AI Tech Team’" (9 Jan 2026): https://www.artificiallawyer.com/2026/01/09/microsoft-to-acqui-hire-robin-ai-tech-team/
• Legal IT Insider, "Microsoft hires raft of Robin AI engineers to bolster its Word team" (Jan 2026): https://legaltechnology.com/microsoft-hires-raft-of-robin-ai-engineers-to-bolster-its-word-team/
• Harvey (press release via GIC), "Harvey Raises at $11 Billion Valuation to Scale Agents Across Law Firms and Enterprises" (25 Mar 2026): https://www.gic.com.sg/uploads/2026/03/Harvey-Raises-at-11-Billion-Valuation-to-Scale-Agents-Across-Law-Firms-and-Enterprises.pdf