The Legal AI Outside Counsel Guidelines Drafting Gap Report 2026: What Corporate Legal Departments Are Actually Writing Into AI Provisions — and What Outside Firms Say They Can Comply With

Research briefing — a review of public sources. The Legal Stack did not conduct a survey, benchmark or interviews for this piece.

Updated October 2026. An earlier version of this briefing attributed specific AI clauses to named companies' outside counsel guidelines and described vendor data-routing practices. We could not verify those claims in public sources, so they have been removed.

The evidence problem

Outside counsel guidelines (OCGs) are almost never published. No public, systematic study shows what Fortune 1000 legal departments actually write into the AI provisions of their OCGs, or how often firms push back or quietly fail to comply. Anyone who claims to know the prevalence of specific OCG AI clauses is working from private data or guesswork.

What is public is enough to draft better provisions:

• the ethics framework that governs how lawyers use AI for clients
• survey evidence on how little clients currently know about their firms' AI use
• vendors' published data-handling commitments

This briefing sets out that record and then offers drafting guidance, which we label as analysis.

Clients largely can't see whether firms use AI

Two recent surveys suggest that client visibility into firms' AI use is low:

• ACC and Everlaw. Generative AI's Growing Strategic Value for Corporate Law Departments (14 October 2025) surveyed 657 in-house professionals across 30 countries. It found that 59% of in-house teams do not know whether their outside firms use generative AI on their matters. Nearly 60% had seen no noticeable savings yet from that use.
• Thomson Reuters. The 2025 Generative AI in Professional Services report (15 April 2025) found that 71% of law firms' clients did not know whether their firms were using generative AI.

The earliest reporting on the topic came from Bloomberg Law on 29 November 2023:

• Paul Weiss did not address generative AI in its standard engagement letter. However, some clients had asked the firm not to use generative AI without first communicating with them.
• Cat Casey of Reveal argued that in-house lawyers should spell out their AI policies in their OCGs.

Almost three years later, the survey data suggests many legal departments still have not done so in a way that produces visibility.

The ethics baseline OCGs sit on top of

ABA Formal Opinion 512, issued 29 July 2024, is the reference point for U.S. drafting. As summarized by Freeman Mathis & Gary, the opinion addresses three areas directly relevant to OCGs.

Disclosure. Lawyers must disclose their use of generative AI when a client asks. They must also comply with disclosure requirements in engagement agreements or outside counsel guidelines. In other words, an OCG provision creates a duty that the Model Rules would not otherwise impose in the same form.

Confidentiality. Before entering client information into a self-learning tool (one that may train on its inputs), a lawyer must obtain the client's informed consent.

Fees. For lawyers who use AI, the opinion sets these rules:

• Lawyers billing hourly may bill only for time actually spent.
• Lawyers generally may not bill for time spent learning a tool they will use regularly.
• General-practice tools are overhead, not chargeable expenses.

This matters for drafting. An OCG doesn't need to restate professional duties. It is most useful where it goes beyond them: specifying what is disclosed, when, and in what format.

What vendors publicly commit to on data

Many OCG AI provisions focus on training, retention and data residency, and these are areas where the public documentation is reasonably specific.

OpenAI's API data documentation says:

• Data sent to the API has not been used to train OpenAI models by default since 1 March 2023.
• Abuse-monitoring logs are kept for up to 30 days, unless the law requires longer retention.
• Zero Data Retention, which excludes customer content from those logs, is available only to eligible customers with prior approval.

Harvey's post on its privacy culture (19 August 2025) states:

• Customer data "may not be used to train AI models."
• Harvey requires its AI model providers to commit to no retention of customer data and to process data ephemerally.
• Customers set their own retention periods, "with options as short as three hours."
• Harvey built EU- and Swiss-only processing and has since extended that commitment to customers in Australia.

Two drafting points follow from this. First, a requirement that client data "not be retained in any AI system" can conflict with a model provider's standard abuse-monitoring retention unless a zero-retention arrangement applies. Some legal AI vendors document such arrangements. Second, these commitments sit in vendor terms and data processing addenda (DPAs) between the vendor and the firm. The client is not a party, so an OCG needs a mechanism that carries them through to the client.

Analysis: where OCG AI provisions tend to go wrong

The following points are our analysis, based on the record above.

1. Undefined terms. Phrases like "AI tools" or "substantive legal analysis" with no definition make compliance untestable. Is spell-check AI? Is a document management system's embedded search AI? Firms will read ambiguity in their own favour.
2. Disclosure without format. Saying "disclose upon request" adds little to what Opinion 512 already requires. The 59% "don't know" figure suggests that this kind of passive disclosure is not producing visibility.
3. Absolute guarantees that conflict with documented architectures. Promises of "no retention anywhere" or "no processing outside the U.S." may be impossible for a firm to give unless the specific tool and configuration support them. Vendor documentation shows that zero retention and regional processing are typically configured or approved options. Firms should not assume them by default.
4. No path to the subprocessor. Training and retention commitments matter at the model-provider level. An OCG that binds only the firm, without requiring the firm to hold equivalent commitments from its vendors, leaves a gap.
5. Billing silence. The ACC/Everlaw finding that clients largely see no savings suggests that OCGs should address AI-related billing explicitly, in line with Opinion 512.

Drafting checklist for legal departments

These recommendations are our analysis.

• Define a scope. Cover "generative AI tools that process client confidential information or produce work product delivered to the client." Exclude routine embedded features unless they meet that test.
• Require a tool register, not ad hoc notices. Ask firms for a periodic list of approved generative AI tools used on your matters. For each tool, list the vendor, the model provider (where disclosed), retention settings and processing region.
• Mirror vendor commitments. Require that any tool used on your matters must:
• contractually prohibit training on client data
• support retention no longer than a stated period, or zero retention
• process data in your required region
• document each of these in the firm's vendor terms or DPA
• Ask for evidence, not just attestations. Accept vendor DPAs, subprocessor lists and security certifications as evidence. Reserve a right to request them.
• Address consent for self-learning tools. Prohibit tools that train on inputs unless you give written consent, which tracks Opinion 512.
• State the billing rule. For example, bill no learning time and charge no AI subscription costs as disbursements without prior approval. For fixed-fee work, invite proposals that reflect AI efficiencies.
• Keep notice periods workable. Instead of advance notice for every tool update, require notice when the firm adds a new vendor or model provider, or changes processing region.

Guidance for law firms receiving OCGs

These recommendations are also our analysis.

• Map every OCG AI clause to a specific tool configuration before signing. Where a clause cannot be met as written, for example an absolute no-retention clause, propose wording tied to documented controls.
• Hold vendor documents ready. Keep DPAs, subprocessor lists and retention settings for each approved tool, so that disclosure requests can be answered quickly and accurately.
• Keep a matter-level record of AI use. Opinion 512 requires disclosure when clients ask. That is far easier to do if the information is captured as the work happens.

Bottom line

The public record cannot tell you how many OCGs contain a given AI clause. It does show that:

• clients mostly don't know whether their firms use AI
• ABA Opinion 512 says lawyers must comply with disclosure terms in OCGs and engagement agreements
• major vendors publish specific, checkable data commitments

OCG provisions built around those checkable commitments, rather than around absolute guarantees, are the ones firms can actually comply with.

Sources

• Association of Corporate Counsel, "ACC GenAI report: corporate law departments' AI use (with Everlaw)" (14 Oct 2025): https://www.acc.com/about/newsroom/news/acc-genai-report-corporate-law-departments-ai-use-everlaw
• Thomson Reuters, "2025 Generative AI in Professional Services report" (15 Apr 2025): https://www.thomsonreuters.com/en-us/posts/technology/genai-professional-services-report-2025/
• Bloomberg Law (Isabel Gottlieb), "Law Firms Wrestle With How Much to Tell Clients About AI Use" (29 Nov 2023): https://news.bloomberglaw.com/business-and-practice/law-firms-wrestle-with-how-much-to-tell-clients-about-ai-use
• Freeman Mathis & Gary, "ABA issues formal guidance for lawyers' use of generative AI" (2024): https://www.fmglaw.com/professional-liability/aba-issues-formal-guidance-for-lawyers-use-of-generative-ai/
• OpenAI, "Your data" (API platform documentation, accessed Oct 2026): https://developers.openai.com/api/docs/guides/your-data
• Harvey, "How Harvey's building a culture of privacy" (19 Aug 2025): https://www.harvey.ai/en-US/blog/how-harveys-building-a-culture-of-privacy