The Legal AI Outside Counsel Guideline Enforcement Report 2026: How Corporate Legal Departments Are Auditing Outside Firm AI Compliance — and What Happens When Firms Fail

Research briefing — a review of public sources. The Legal Stack did not conduct a survey, benchmark or interviews for this piece.

What can and cannot be known

Corporate legal departments rarely publish their outside counsel guidelines (OCGs), and almost never publish how they enforce them. We found no public, methodologically sound dataset showing what share of Fortune 1000 companies have AI-specific OCG provisions, which verification methods they use, or how often firms have been penalised for breaching them. Industry-by-industry adoption rates, or claims that particular named banks or insurers have issued AI addenda, should not be relied on unless the company itself has disclosed them.

This briefing therefore takes a different approach. It sets out what published surveys say about the gap between clients and firms on AI, the ethics rules that give AI OCG provisions their teeth, a public court decision showing what an AI failure by outside counsel can cost, and a practical enforcement model. Recommendations are labelled as our analysis.

The transparency gap is measurable

Two large published surveys show that clients often do not know how their law firms use AI, and are not yet seeing the benefit:

Thomson Reuters Institute, 2025 Generative AI in Professional Services Report. The report surveyed 1,702 professionals in January and February 2025, 41% of them in legal. According to LawSites' summary, 71% of corporate legal professionals surveyed did not know whether their outside firms use generative AI. Only 41% of law firms reported having a generative AI use policy, and 40% provided some form of generative AI training.
ACC and Everlaw, October 2025. The Association of Corporate Counsel and Everlaw surveyed 657 in-house legal professionals in 30 countries. 59% reported no generative AI savings from their law firms so far, and only about 24% were satisfied with how outside counsel were adopting the technology for cost effectiveness. 61% said they plan to push for changes in how legal services are delivered and priced, and 64% expect to rely less on outside counsel.

Taken together, the two surveys show that many clients cannot see what their firms are doing and are not getting cost savings from it, while fewer than half of firms report having a policy at all. That is why OCG provisions on AI are appearing. It also explains why issuing a provision without any way to verify it achieves little.

Clients have been raising the issue for some time. In November 2023, Bloomberg Law reported that some Paul Weiss clients had asked the firm not to use generative AI without first talking to them. In the same article, Reveal's Cat Casey advised in-house lawyers to spell out AI policies in their outside counsel guidelines.

The ethics rules that give provisions teeth

AI OCG provisions work best when they mirror duties lawyers already owe. That makes noncompliance both a contract issue and a professional-responsibility issue.

ABA Formal Opinion 512 (29 July 2024) is the ABA's first formal opinion on generative AI. It covers competence, confidentiality, communication, candor, supervision and reasonable fees. Its fee guidance, as summarised in the ABA's Law Practice Today, bears directly on billing review:

Lawyers who bill hourly must charge only for time actually spent, even when AI makes them faster.
They cannot pass on the cost of learning to use an AI tool unless the client specifically asks for that.
Direct AI costs may be billed without a surcharge, but overhead should not be passed on without prior disclosure and agreement.
A flat or contingent fee may be unreasonable if AI lets the lawyer finish the work much faster.

State guidance points the same way. It includes Florida Bar Ethics Opinion 24-1 (19 January 2024), New York City Bar Formal Opinion 2024-5 (7 August 2024), Texas Opinion 705 (February 2025) and the State Bar of California's practical guidance (November 2023). A client provision that requires disclosure of AI tools and AI-assisted billing therefore reinforces obligations lawyers already have.

On data security, the ACC published Model Information Protection and Security Controls for Outside Counsel on 29 March 2017. The controls cover data retention, return and destruction, data handling and encryption, breach reporting, physical security, staff background screening and cyber insurance. Many AI provisions in OCGs are, in practice, extensions of this framework to AI vendors.

What failure looks like on the public record

Public consequences of AI misuse by outside counsel come mainly from courts, not from clients' private panel decisions.

Johnson v. Dunn (N.D. Ala., 23 July 2025). Judge Anna Manasco sanctioned three Butler Snow attorneys for filing hallucinated citations in two discovery motions in prison litigation in which the firm represented the State of Alabama. According to EDRM's analysis, the sanctions were:

a public reprimand;
disqualification from the case;
referral to the Alabama State Bar;
an order to give copies of the sanctions order to their clients, opposing counsel, every attorney in their firm, and the judges in their other pending cases.

The firm was not itself sanctioned. Notably, Butler Snow had adopted AI use policies in June 2023 that required written approval and independent verification. A policy existed and was not followed. Any client that relies only on a firm's self-certified AI policy should take that lesson seriously.

The problem is common. Damien Charlotin's public AI Hallucination Cases database had logged around 800 U.S. cases by April 2026, as reported by heise online. The best-known early case is Mata v. Avianca (S.D.N.Y.). There, Judge P. Kevin Castel imposed a $5,000 Rule 11 sanction on 22 June 2023 and ordered the lawyers to send the opinion to their client and to each judge falsely named as the author of a fabricated opinion.

From a GC's point of view, these cases bring disqualification, delay, replacement-counsel costs and reputational spillover into the client's own matter, whether or not any OCG was breached.

An enforcement model (analysis)

The verification ladder below is The Legal Stack's suggested approach, ordered from weakest to strongest. It is not drawn from survey data.

Self-certification. An annual letter confirming compliance. It is cheap but weak, as Johnson v. Dunn shows: a firm can have a sound policy and still breach it.
Structured questionnaire. Ask which tools are approved, which model providers and subprocessors they use, whether client data is used for training, how outputs are verified, and who is accountable. Ask for the firm's written AI policy and training records.
Matter-level disclosure. For defined deliverables, especially court filings, the firm states which AI tools were used and confirms that citations were checked by a lawyer.
Billing review. Apply Opinion 512's fee principles. Look for hourly entries that do not reflect AI efficiencies, charges for learning a tool, and AI tool costs billed with a surcharge or without prior agreement.
Audit and incident rights. Reserve the right to inspect, require prompt notice of AI-related incidents involving client data, and connect both to ACC-style security controls.

Remedies should be set out in the OCG in advance. They might include fee adjustments for noncompliant entries, the right to require replacement of personnel on a matter, and removal from the panel for serious or repeated breaches.

Takeaways

For GCs and legal operations leaders: Start with what you can verify. Matter-level disclosure for court filings and billing review based on Opinion 512 give the most information for the least friction. Treat a self-certification as a starting point, not as assurance.

For law firm risk and client-relations leads: Expect questionnaires to become more specific. Firms that can produce an AI policy, a list of approved tools, training records and a citation-verification process will answer faster. Johnson v. Dunn shows that a policy only protects a firm if it is followed.

On the evidence: Public data on how OCG AI provisions are enforced does not yet exist in any reliable form. Departments willing to share anonymised experience, for example through the ACC or CLOC, would fill a real gap.

Sources

LawSites, "Thomson Reuters survey: over 95% of legal professionals expect gen AI to become central to workflow within five years" (15 Apr 2025): https://www.lawnext.com/2025/04/thomson-reuters-survey-over-95-of-legal-professionals-expect-gen-ai-to-become-central-to-workflow-within-five-years
Business Wire / ACC and Everlaw, "64% of In-House Counsel Expect GenAI to Reduce Reliance on Outside Counsel, 50% Expect Lower Outside Counsel Costs, ACC/Everlaw Survey Finds" (14 Oct 2025): https://www.businesswire.com/news/home/20251014382116/en/64-of-In-House-Counsel-Expect-GenAI-to-Reduce-Reliance-on-Outside-Counsel-50-Expect-Lower-Outside-Counsel-Costs-ACCEverlaw-Survey-Finds
Bloomberg Law, "Law Firms Wrestle With How Much to Tell Clients About AI Use" (29 Nov 2023): https://news.bloomberglaw.com/business-and-practice/law-firms-wrestle-with-how-much-to-tell-clients-about-ai-use
American Bar Association, Law Practice Today, "The Reasonableness of Fees When Using AI" (Dec 2024): https://www.americanbar.org/groups/law_practice/resources/law-practice-today/2024/december-2024/the-reasonableness-of-fees-when-using-ai/
Association of Corporate Counsel, "ACC Issues Guidelines for Law Firm Cybersecurity Measures" (29 Mar 2017): https://www.acc.com/about/newsroom/press-releases/acc-issues-guidelines-law-firm-cybersecurity-measures
EDRM, "When AI Policies Fail: The AI Sanctions in Johnson v. Dunn and What They Mean for the Profession" (Jul 2025): https://edrm.net/2025/07/when-ai-policies-fail-the-ai-sanctions-in-johnson-v-dunn-and-what-they-mean-for-the-profession/
Bloomberg Law, "Butler Snow Attorneys Disqualified Over Fake AI Case Citations" (Jul 2025): https://news.bloomberglaw.com/payroll/butler-snow-attorneys-disqualified-over-fake-ai-case-citations
American Bar Association, "Formal Opinion 512: Generative Artificial Intelligence Tools" (29 Jul 2024): https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
The Florida Bar, "Ethics Opinion 24-1" (19 Jan 2024): https://www.floridabar.org/etopinions/opinion-24-1/
Ezel, summary of New York City Bar Formal Opinion 2024-5, "Generative AI in the Practice of Law" (7 Aug 2024): https://ezel.ai/ethics-opinions/nyc-bar/2024-5-generative-ai-in-the-practice-of-law
Ezel, summary of State Bar of Texas Professional Ethics Committee Opinion 705, "Generative AI in the Practice of Law" (Feb 2025): https://ezel.ai/ethics-opinions/tx/705-generative-ai-in-the-practice-of-law
State Bar of California, "Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law" (Nov 2023; updated 2026): https://www.calbar.ca.gov/sites/default/files/portals/0/documents/ethics/Generative-AI-Practical-Guidance.pdf
Wikipedia, "Mata v. Avianca, Inc." (accessed Oct 2026): https://en.wikipedia.org/wiki/Mata_v._Avianca,_Inc.
Damien Charlotin, "AI Hallucination Cases" database (accessed Oct 2026): https://www.damiencharlotin.com/hallucinations/
heise online, "AI hallucinations in court" (2026): https://heise.de/-11257675