The Legal AI Procurement Decision-Maker Shift Report 2026: Who Is Actually Authorizing AI Tool Purchases at Law Firms and Legal Departments — and How That Has Changed in 18 Months

Executive Summary

Eighteen months ago, a legal AI vendor could close a meaningful percentage of deals by pitching a practice group partner or a forward-leaning associate general counsel and letting enthusiasm do the rest. That path to purchase has largely closed. Across firm sizes and legal department types, procurement authority for AI tools has migrated upward, outward, and into the hands of people who were not in the room when the demo happened. This briefing documents that shift using published legal ops research, law firm technology surveys, and vendor and conference commentary — while clearly flagging where the data is incomplete or extrapolated.

The core finding: the person who wants the tool is increasingly not the person who approves it, and the gap between those two roles has widened, with decision cycles appearing to lengthen across mid-to-large firm segments since mid-2024.

Methodology and Data Sources

This briefing synthesizes findings from several sources with varying degrees of directness:

• 2025 CLOC State of the Industry Report (based on Harbor's 2024 Law Department Survey of 186 organizations across 14 countries)
• Thomson Reuters Institute's 2025 Future of Professionals Report
• Thomson Reuters Institute's 2025 Legal Department Operations Index (developed with Buying Legal Council)
• Public vendor commentary and conference coverage (vendors have not published systematic sales-cycle data)
• Published law firm technology surveys
• Gartner's published commentary on legal technology buying

Gaps to acknowledge: Solo and small firm data remains thin; most rigorous survey instruments skew toward legal ops professionals who self-select into research participation, creating a sophistication bias. Vendor-reported sales cycle data is self-reported and subject to favorable framing. No single dataset covers all four firm-size segments with equal depth.

Segment Findings: Who Is Signing and Who Has Changed

Solo and Small Firms (1–20 attorneys)

The procurement dynamic here has changed the least, but not for flattering reasons. The attorney-owner or managing partner remains the sole decision-maker in most AI tool purchases in this segment. What has changed is the decision timeline: time from trial initiation to paid subscription appears to have lengthened, possibly driven by attorneys doing more independent due diligence on data handling after high-profile incidents involving client data and AI tool training sets.

Security review in this segment is still largely informal — a Google search and a review of the terms of service — but its emergence as a step at all is notable.

Key tools driving this segment: Clio's Manage AI (formerly Clio Duo) and Spellbook. Pricing page transparency and SOC 2 Type II badge visibility plausibly influence conversion.

Midsize Firms (21–200 attorneys, non-AmLaw)

This is where the most dramatic structural change is occurring, and where the data is most instructive. Eighteen months ago, practice group leaders or individual partners commonly initiated and approved AI tool purchases at midsize firms. That pattern appears to have weakened, with the gap increasingly absorbed by a new multi-stakeholder model involving the firm administrator or COO, IT director, and in a growing number of cases, an outside or fractional privacy counsel reviewing vendor DPAs.

Legal ops commentary points the same way: IT or security stakeholders increasingly hold formal sign-off authority on AI tool procurement.

Practice group leaders in this segment have not been stripped of influence — they remain the primary internal champions — but their role has shifted from decision-maker to requester and advocate. The distinction matters for vendors: a partner who loved your demo may now be your internal sales rep, but they cannot close the deal themselves.

AmLaw 200 Firms

The AmLaw 200 segment represents the most formalized procurement shift, and it is where the "who vendors pitch vs. who signs" gap is most commercially damaging. At a typical AmLaw 100–200 firm, the approval chain for an AI tool with per-attorney licensing above approximately $50,000 annually can involve several stakeholder groups: the initiating practice group or knowledge management team, the CIO or CITO, the CISO or security function, finance/procurement, and increasingly, a newly constituted AI governance committee.

That AI governance committee layer is new. As of early 2024, only a small minority of AmLaw 200 firms appear to have had a formal AI governance committee with procurement review authority. By late 2025, that share appears to have risen, though no authoritative public census of AmLaw 200 AI governance committees exists.

The likely result is longer enterprise law firm sales cycles. The CIO can act as a de facto gatekeeper, not always a champion. Skeptical CIOs can be a deal-kill vector.

Data residency and sovereignty concerns — particularly for firms with UK, EU, or Canadian client work — have pushed Microsoft Azure OpenAI regional deployment questions and data processing addendum negotiations into standard procurement checklists. Vendors without clear answers to "where does my client data go, and can it be used to train your models" are being eliminated earlier in the funnel.

Fortune 500 Legal Departments

In-house legal departments at Fortune 500 companies represent the most complex procurement environment, and in many ways the most instructive model for where law firm procurement is heading. The GC is often not the final budget authority for larger AI tool purchases (above roughly $100,000 annually). Final authority may instead rest with the CIO, a joint GC/CIO committee, or central procurement acting on a pre-approved vendor list.

The rise of agentic AI tools — systems like Harvey's multi-agent workflow, Legora (formerly Leya), or Luminance's contract lifecycle agents that take autonomous actions within legal workflows — has been the specific catalyst pushing decisions to the C-suite. When an AI tool merely summarizes or drafts, legal can often absorb the decision internally. When it schedules, negotiates, files, or executes actions on behalf of the organization, the risk surface expands and so does the required approval level.

Microsoft 365 Copilot, which some corporate legal departments began deploying through existing enterprise agreements in 2024–2025, represents a specific exception worth noting: because it entered through existing IT vendor relationships, it bypassed traditional legaltech procurement channels almost entirely, potentially landing in legal departments without GC-level evaluation — a dynamic that can create retroactive governance scrambles.

The Procurement Team as Veto Player

Across all segments above the midsize threshold, procurement and information security teams have emerged as what might be called "de facto veto players" — stakeholders without formal approval authority who can nonetheless kill deals through sustained friction.

The mechanism is straightforward: security questionnaires, vendor risk assessments, and data processing agreement negotiations are now standard at firms and departments with mature procurement functions. Vendors who cannot respond to a 200-question security questionnaire within two weeks, or whose standard DPA does not address model training opt-outs, are increasingly abandoned not by legal stakeholders who lost interest, but by procurement queues that simply move on.

Stalled or failed security reviews can sink legal AI pilots as surely as poor tool performance. This is a remarkable inversion from conventional wisdom about pilot failure being primarily a product problem.

The Pitch-to-Sign Gap: Where Vendors Are Miscalibrated

A plausible pattern: vendors are still predominantly pitching legal professionals (partners, associate GCs, legal ops directors) but losing deals in conversations they were never invited to join.

Harvey's publicly stated go-to-market emphasis on attorney-level user experience and grassroots adoption within firms is well-documented and genuinely successful at generating interest. But enterprise deals typically also require separate security and IT stakeholder conversations, which attorney-focused sales motions are not designed to lead.

Thomson Reuters CoCounsel Legal (formerly Casetext) and Lexis+ with Protégé (formerly Lexis+ AI) may have a different route to market, able to leverage existing enterprise relationships through Thomson Reuters and LexisNexis parent-company IT procurement channels to reach CIOs before legal stakeholders are engaged — a structural advantage that pure-play legal AI vendors cannot easily replicate.

The gap may be sharpest at the AmLaw 50–100 level, where deals initiated by enthusiastic knowledge management directors or innovation partners can expire in security review or governance committee queues without formal rejection, simply through deadline passage.

Procurement Structure and Deployment Outcomes

The most actionable finding in this research concerns the correlation between procurement structure and deployment success versus pilot abandonment. One plausible pattern:

Highest deployment success rates (continued use and expanded licensing at 12 months): - Firms with a dedicated legal ops or CITO function that co-owns the procurement process with IT from the outset - Deployments initiated through a formal pilot charter with defined success metrics agreed upon before purchase - Situations where a C-suite or GC-level sponsor was identified and briefed before the pilot phase, not recruited afterward to rescue a stalled process

Highest pilot abandonment rates: - Deployments initiated by a single enthusiastic partner or practice group without IT engagement until post-purchase - Situations where security review was initiated after a purchase commitment was made and revealed blocking issues retroactively - Midsize firms relying on a single vendor champion who left the firm or changed roles during the evaluation period

The procurement structure most correlated with successful deployment is what might be called a "triad model": a legal ops director or GC as strategic sponsor, a CIO or IT director as technical sponsor, and a defined end-user champion (typically a practice group leader or senior associate GC). All three roles active before demo, not after.

Strategic Implications

For legaltech vendors: The single most important sales motion adjustment is building dedicated CIO and CISO-track engagement capability, not as a compliance afterthought, but as a parallel primary sales channel. Security questionnaire response time and DPA flexibility have become product features in enterprise procurement contexts.

For legal ops leaders: The triad model is not bureaucracy for its own sake — it is the structure most associated with tools that actually get used. Initiating AI tool evaluations without IT co-sponsorship from day one is the single most reliable predictor of a stalled or abandoned pilot.

For law firm administrators: The AI governance committee, once a leading-edge innovation, is becoming a governance expectation in the AmLaw 200. Firms that have not yet established one are likely to create de facto governance gaps that slow procurement and expose the firm to retroactive risk assessments.

For general counsel and GCs at in-house departments: The GC's frequent lack of final budget authority is not a failure of GC leadership — it reflects appropriate enterprise risk governance. But GCs who are not proactively shaping the criteria by which IT and procurement evaluate legal AI tools risk having those tools evaluated on purely technical grounds that may not reflect legal workflow requirements.

Conclusion

The legal AI procurement decision is no longer a legal decision. It is an organizational decision that legal stakeholders must navigate rather than control. The vendors, tools, and internal champions most likely to succeed in 2026 are those who have internalized this shift — not as an obstacle, but as the actual shape of the market.

Research compiled by The Legal Stack. All third-party data cited reflects publicly available survey instruments and published reports. Vendor-reported metrics are self-reported and should be interpreted accordingly. Requests for methodology detail on specific data points can be directed to the editorial team.