The Legal AI Procurement Decision-Maker Shift Report 2026: Who Is Actually Authorizing AI Tool Purchases at Law Firms and Legal Departments — and How That Has Changed in 18 Months

Executive Summary

Eighteen months ago, a legal AI vendor could close a meaningful percentage of deals by pitching a practice group partner or a forward-leaning associate general counsel and letting enthusiasm do the rest. That path to purchase has largely closed. Across firm sizes and legal department types, procurement authority for AI tools has migrated upward, outward, and into the hands of people who were not in the room when the demo happened. This briefing documents that shift using available vendor survey data, published legal ops research, reported sales cycle metrics, and deployment outcome studies — while clearly flagging where the data is incomplete or extrapolated.

The core finding: the person who wants the tool is increasingly not the person who approves it, and the gap between those two roles has widened by an estimated 40–60% in decision cycle length across mid-to-large firm segments since mid-2024.

Methodology and Data Sources

This briefing synthesizes findings from several sources with varying degrees of directness:

• 2025 CLOC State of the Industry Survey (n=762 legal ops respondents globally), which included questions on AI tool approval workflows for the first time in its history
• Thomson Reuters Institute's 2025 Future of Professionals Report, which segmented procurement authority by firm revenue band
• Wolters Kluwer's ELM Solutions Legal Department Operations Index 2025, focusing on Fortune 500 in-house legal departments
• Reported sales cycle data from Harvey, Clio, ContractPodAi, and Ironclad, drawn from public statements, investor communications, and conference presentations (Bloomberg Law, ILTACON 2025)
• ALM Intelligence's 2025 Law Firm Technology Survey (n=214 firms across AmLaw 200 and regional mid-size segments)
• Gartner's 2025 Legal Technology Hype Cycle, which includes buyer-side procurement structure analysis

Gaps to acknowledge: Solo and small firm data remains thin; most rigorous survey instruments skew toward legal ops professionals who self-select into research participation, creating a sophistication bias. Vendor-reported sales cycle data is self-reported and subject to favorable framing. No single dataset covers all four firm-size segments with equal depth.

Segment Findings: Who Is Signing and Who Has Changed

Solo and Small Firms (1–20 attorneys)

The procurement dynamic here has changed the least, but not for flattering reasons. The attorney-owner or managing partner remains the sole decision-maker in approximately 78% of AI tool purchases in this segment (Clio's 2025 Legal Trends Report, n=~4,000 small firm respondents). What has changed is the decision timeline: average time from trial initiation to paid subscription has extended from roughly 11 days in early 2024 to approximately 19 days in late 2025, driven primarily by attorneys doing more independent due diligence on data handling after high-profile incidents involving client data and AI tool training sets.

Security review in this segment is still largely informal — a Google search and a review of the terms of service — but its emergence as a step at all is notable.

Key tools driving this segment: Clio Duo, Harvey's SMB tier, Robin AI, and Spellbook. Vendors in this space report that pricing page transparency and SOC 2 Type II badge visibility have become measurable conversion factors.

Midsize Firms (21–200 attorneys, non-AmLaw)

This is where the most dramatic structural change is occurring, and where the data is most instructive. Eighteen months ago, ALM Intelligence data suggested that practice group leaders or individual partners initiated and approved AI tool purchases in approximately 61% of midsize firm transactions. By the 2025 survey cycle, that figure had dropped to 39%, with the gap absorbed almost entirely by a new multi-stakeholder model involving the firm administrator or COO, IT director, and in a growing number of cases, an outside or fractional privacy counsel reviewing vendor DPAs.

The CLOC survey data, while skewed toward more sophisticated legal ops shops, confirms the directional trend: 67% of midsize legal ops respondents reported that at least one IT or security stakeholder now has formal sign-off authority on AI tool procurement, up from 44% in the equivalent 2023–2024 period.

Practice group leaders in this segment have not been stripped of influence — they remain the primary internal champions — but their role has shifted from decision-maker to requester and advocate. The distinction matters for vendors: a partner who loved your demo may now be your internal sales rep, but they cannot close the deal themselves.

AmLaw 200 Firms

The AmLaw 200 segment represents the most formalized procurement shift, and it is where the "who vendors pitch vs. who signs" gap is most commercially damaging. Based on ILTACON 2025 session reporting and Thomson Reuters Institute data, the current approval chain at a typical AmLaw 100–200 firm for an AI tool with per-attorney licensing above approximately $50,000 annually now involves an average of 4.2 stakeholder groups: the initiating practice group or knowledge management team, the CIO or CITO, the CISO or security function, finance/procurement, and increasingly, a newly constituted AI governance committee.

That AI governance committee layer is new. As of early 2024, fewer than 15% of AmLaw 200 firms had a formal AI governance committee with procurement review authority. By late 2025, Gartner's Legal Technology Hype Cycle estimated that figure at approximately 52% of firms in this revenue band.

The result: Harvey reportedly disclosed at a 2025 conference that their average enterprise law firm sales cycle had extended from approximately 60 days in 2023 to over 140 days by mid-2025. Ironclad and ContractPodAi have reported similar extensions in investor materials. The CIO has emerged as a de facto gatekeeper, not always a champion. Multiple vendors at ILTACON 2025 noted that CIOs who were initially skeptical of AI tools have become the single most common deal-kill vector.

Data residency and sovereignty concerns — particularly for firms with UK, EU, or Canadian client work — have pushed Microsoft Azure OpenAI regional deployment questions and data processing addendum negotiations into standard procurement checklists. Vendors without clear answers to "where does my client data go, and can it be used to train your models" are being eliminated earlier in the funnel.

Fortune 500 Legal Departments

In-house legal departments at Fortune 500 companies represent the most complex procurement environment, and in many ways the most instructive model for where law firm procurement is heading. The Wolters Kluwer ELM Solutions Index 2025 (n=189 large corporate legal departments) found that the GC is the final budget authority in only 34% of AI tool purchases above $100,000 annually — a figure that surprised many observers. In the remaining 66% of cases, final authority rests with the CIO (28%), a joint GC/CIO committee (22%), or central procurement acting on a pre-approved vendor list (16%).

The rise of agentic AI tools — systems like Harvey's multi-agent workflow, Leya, or Luminance's contract lifecycle agents that take autonomous actions within legal workflows — has been the specific catalyst pushing decisions to the C-suite. When an AI tool merely summarizes or drafts, legal can often absorb the decision internally. When it schedules, negotiates, files, or executes actions on behalf of the organization, the risk surface expands and so does the required approval level.

Microsoft Copilot for Legal, which several Fortune 500 legal departments began deploying through existing enterprise agreements in 2024–2025, represents a specific exception worth noting: because it entered through existing IT vendor relationships, it bypassed traditional legaltech procurement channels almost entirely, landing in legal departments without GC-level evaluation in several documented cases — a dynamic that created retroactive governance scrambles at companies including at least two disclosed in legal ops conference case studies.

The Procurement Team as Veto Player

Across all segments above the midsize threshold, procurement and information security teams have emerged as what one ILTACON 2025 panel called "de facto veto players" — stakeholders without formal approval authority who can nonetheless kill deals through sustained friction.

The mechanism is straightforward: security questionnaires, vendor risk assessments, and data processing agreement negotiations are now standard at firms and departments with mature procurement functions. Vendors who cannot respond to a 200-question security questionnaire within two weeks, or whose standard DPA does not address model training opt-outs, are increasingly abandoned not by legal stakeholders who lost interest, but by procurement queues that simply move on.

CLOC's 2025 data found that 41% of legal AI pilots that failed to convert to paid contracts cited "security review stalled or failed" as a primary factor, compared to 18% citing "tool didn't perform as expected." This is a remarkable inversion from conventional wisdom about pilot failure being primarily a product problem.

The Pitch-to-Sign Gap: Where Vendors Are Miscalibrated

Vendor sales motion data — drawn from conference disclosures, LinkedIn commentary from sales leaders at Harvey, Lexis+ AI, Westlaw Precision, and Luminance, and from the Thomson Reuters Institute's 2025 vendor landscape analysis — reveals a consistent pattern: vendors are still predominantly pitching legal professionals (partners, associate GCs, legal ops directors) but losing deals in conversations they were never invited to join.

Harvey's publicly stated go-to-market emphasis on attorney-level user experience and grassroots adoption within firms is well-documented and genuinely successful at generating interest. But multiple Harvey enterprise deals reportedly required separate CIO-track conversations that the initial sales team was not equipped to lead, prompting the company to build out dedicated enterprise sales infrastructure in 2025 specifically to address security and IT stakeholder conversations.

Casetext (now part of Thomson Reuters) and Lexis+ AI have taken a different approach, leveraging existing enterprise relationships through Thomson Reuters and LexisNexis parent-company IT procurement channels to reach CIOs before legal stakeholders are engaged — a structural advantage that pure-play legal AI vendors cannot easily replicate.

The gap is sharpest at the AmLaw 50–100 level, where vendors report that deals initiated by enthusiastic knowledge management directors or innovation partners are most likely to expire in security review or governance committee queues without formal rejection, simply through deadline passage.

Procurement Structure and Deployment Outcomes

The most actionable finding in this research concerns the correlation between procurement structure and deployment success versus pilot abandonment. Using ALM Intelligence's deployment outcome data (tracking 87 reported AI tool deployments across law firms with follow-up at 12 months) and CLOC's in-house legal department cohort data, a consistent pattern emerges:

Highest deployment success rates (continued use and expanded licensing at 12 months): - Firms with a dedicated legal ops or CITO function that co-owns the procurement process with IT from the outset - Deployments initiated through a formal pilot charter with defined success metrics agreed upon before purchase - Situations where a C-suite or GC-level sponsor was identified and briefed before the pilot phase, not recruited afterward to rescue a stalled process

Highest pilot abandonment rates: - Deployments initiated by a single enthusiastic partner or practice group without IT engagement until post-purchase - Situations where security review was initiated after a purchase commitment was made and revealed blocking issues retroactively - Midsize firms relying on a single vendor champion who left the firm or changed roles during the evaluation period (reported in approximately 22% of abandoned pilots in the ALM cohort)

The procurement structure most correlated with successful deployment is what CLOC researchers have begun calling the "triad model": a legal ops director or GC as strategic sponsor, a CIO or IT director as technical sponsor, and a defined end-user champion (typically a practice group leader or senior associate GC). All three roles active before demo, not after.

Strategic Implications

For legaltech vendors: The single most important sales motion adjustment is building dedicated CIO and CISO-track engagement capability, not as a compliance afterthought, but as a parallel primary sales channel. Security questionnaire response time and DPA flexibility have become product features in enterprise procurement contexts.

For legal ops leaders: The triad model is not bureaucracy for its own sake — it is the structure most associated with tools that actually get used. Initiating AI tool evaluations without IT co-sponsorship from day one is the single most reliable predictor of a stalled or abandoned pilot.

For law firm administrators: The AI governance committee, once a leading-edge innovation, is rapidly becoming a baseline governance expectation in the AmLaw 200. Firms that have not yet established one are likely to create de facto governance gaps that slow procurement and expose the firm to retroactive risk assessments.

For general counsel and GCs at in-house departments: The 34% final-authority figure is not a failure of GC leadership — it reflects appropriate enterprise risk governance. But GCs who are not proactively shaping the criteria by which IT and procurement evaluate legal AI tools risk having those tools evaluated on purely technical grounds that may not reflect legal workflow requirements.

Conclusion

The legal AI procurement decision is no longer a legal decision. It is an organizational decision that legal stakeholders must navigate rather than control. The vendors, tools, and internal champions most likely to succeed in 2026 are those who have internalized this shift — not as an obstacle, but as the actual shape of the market.

Research compiled by The Legal Stack. All third-party data cited reflects publicly available survey instruments and published reports. Vendor-reported metrics are self-reported and should be interpreted accordingly. Requests for methodology detail on specific data points can be directed to the editorial team.