The Legal AI Vendor Lock-In Risk Report 2026: How Deep Is Platform Dependency Across Law Firms and Legal Departments — and What Exit Plans Actually Exist

Research briefing — a review of public sources. The Legal Stack did not conduct a survey, benchmark or interviews for this piece.

Summary

There is no credible public dataset that measures how dependent law firms and legal departments are on a single legal AI vendor, how many have tested an exit, or what a migration costs. Vendor contracts in this market are negotiated privately, and we found no published survey of legal AI exit planning. This briefing does not estimate those numbers. It covers what is documented: the market has consolidated fast, at least one well-funded legal AI vendor has gone into distress, and regulators in adjacent sectors have already written detailed rules on exit planning and portability. Legal buyers can borrow those frameworks now.

What the public record shows about concentration

The clearest evidence of vendor risk in legal AI is the market's own churn. Some examples from the public record:

Consolidation by larger platforms. Workday announced its acquisition of the contract-management company Evisort in September 2024 (as reported by Artificial Lawyer) and completed it for approximately $310 million, according to a MarketScreener report of the closing. Evisort customers now depend on the product roadmap of an HR and finance software company.
Vendor distress. Legal IT Insider reported on 28 October 2025 that Robin AI, a London-founded legal AI company that ranked 10th on The Sunday Times 100 Tech list earlier that year, had been listed for a distressed sale on an insolvency marketplace. According to an unnamed source, the company had recently failed to raise $50 million. The listing claimed $10 million in annual recurring revenue. The article reported that the company was "still operational" but said nothing about continuity for customers.

These are only examples, but they make the point. A legal AI vendor relationship can change owner, strategy or solvency well within a typical multi-year contract term. The question is not whether a vendor change will happen but whether the customer can move its data and workflows when it does.

Why legal AI lock-in may differ from ordinary software lock-in

The following is The Legal Stack's analysis, not survey data.

Most enterprise software lock-in comes from data formats and integrations. Legal AI adds three layers on top:

Configured knowledge. Playbooks, clause libraries, prompt templates and review instructions often represent years of a team's legal judgment. Even if the contract says the customer owns them, they may exist only in a format that one vendor's product can read.
Workflow logic. Automated intake, routing and approval chains are rarely exportable in any useful way. A replacement vendor has to rebuild them.
Evidence and audit trails. Logs of what an AI tool produced, and which human reviewed it, may matter for supervision, privilege or later disputes. If those logs live only on the vendor's platform, leaving the vendor puts them at risk.

How severe each layer is varies by workflow. Legal research tools sit on largely standardised primary law, so switching mainly costs retraining. Contract-management and matter-management deployments embed more customer-specific configuration. That is an analytical judgement, not a measured multiplier. We are not aware of any public study that quantifies switching costs by workflow type.

Regulators have already defined what good exit terms look like

Legal buyers don't need to invent exit standards. Three frameworks from other sectors are directly useful as templates.

EU Data Act switching rules. The Data Act's obligations, including its rules on switching between data processing services, became applicable on 12 September 2025, according to an Alston & Bird advisory of 16 September 2025. Under those rules:

The customer's notice period can be no more than two months.
The maximum transitional period is 30 days.
Contracts must include an exhaustive list of the categories of data and digital assets that can be ported.
Providers must support the customer's exit strategy and give reasonable assistance.
Switching charges are capped at the provider's direct costs until 12 January 2027, after which providers generally cannot impose them. Early-termination penalties remain allowed.

Whether a particular legal AI product falls within the Act's definition of a data processing service is a question for counsel. Either way, the provisions are a ready-made checklist for any negotiation.

U.S. banking third-party guidance. On 6 June 2023 the Federal Reserve, FDIC and OCC adopted final Interagency Guidance on Third-Party Relationships: Risk Management, according to an Arnold & Porter advisory. The guidance treats a vendor relationship as a life cycle with five stages: planning, due diligence, contract negotiation, ongoing monitoring and termination. At termination it expects banks to consider options for transitioning services, termination costs and fees, handling of joint intellectual property, and the risks termination poses to the bank and its customers. It also calls for heightened oversight of relationships that support "critical activities."

Model risk management. On 17 April 2026 the Federal Reserve, FDIC and OCC issued revised model risk guidance (SR 26-2), replacing the longstanding SR 11-7 framework. According to Baker Tilly's analysis, the new guidance leaves AI-related risks to be covered by separate guidance. Legal departments inside banks should therefore not assume their model risk function already covers the legal team's generative AI tools.

None of these frameworks was written for law firms. They do, however, set out the questions a careful buyer should be asking.

The professional-responsibility angle

ABA Formal Opinion 512 (29 July 2024) applies the duties of competence, confidentiality and supervision to lawyers' use of generative AI, according to the ABA. It does not address vendor concentration directly. Still, a firm that cannot get client data or AI work-product records back from a failing vendor has a confidentiality and continuity problem the Model Rules already reach. Analytically, an exit plan is part of exercising reasonable care over the tools that hold client information.

Recommendations for GCs, COOs and legal ops leaders

Practical recommendations; illustrative, not benchmarked.

Map your dependencies. List every AI-assisted workflow, the vendor behind it, the data and configuration it holds, and whether that content can be exported in a usable format.
Negotiate exit terms with the Data Act as your baseline. That means a bounded notice period, a defined transition period with vendor assistance, an exhaustive list of exportable data and assets, and clear limits on exit charges. Add explicit portability for playbooks, clause libraries and prompt templates, and post-termination access to audit logs.
Build vendor-distress triggers into your contracts. Change of control, insolvency events and the vendor's own sale of the product should give you termination rights and accelerated export.
Adopt the banking life-cycle model. Plan, diligence, negotiate, monitor and terminate, with heightened oversight for tools that support critical matters.
Run a tabletop exit exercise. Even a half-day session with IT and legal ops will test whether an export actually produces something another tool can use.
Name an owner. Give one person responsibility for vendor concentration risk, with a line to the GC or firm leadership.

What we could not verify

The previous version of this briefing cited specific export windows in named vendors' enterprise agreements, switching-cost ranges and timelines, and the share of organizations with exit plans. We could find no public source for any of these, and they have been removed. If your organization has benchmarked a legal AI migration, that data would be valuable to the market.

Sources

Artificial Lawyer, "HR Company Workday Buys CLM Evisort" (17 Sep 2024): https://www.artificiallawyer.com/2024/09/17/hr-company-workday-buys-clm-evisort/
MarketScreener, "Workday Inc completed the acquisition of Evisort Inc for approximately 310 million" (Oct 2024): https://www.marketscreener.com/quote/stock/WORKDAY-INC-37866670/news/Workday-Inc-completed-the-acquisition-of-Evisort-Inc-for-approximately-310-million-48331527/
Legal IT Insider, "Robin AI listed for distressed sale nine months after making the Sunday Times 100 Tech list" (28 Oct 2025): https://legaltechnology.com/robin-ai-listed-for-distressed-sale-nine-months-after-making-the-sunday-times-100-tech-list/
Alston & Bird, "The Data Act: 5 Things to Know About the Data Act and New Switching Requirements for Providers of Cloud Services" (16 Sep 2025): https://www.alston.com/en/insights/publications/2025/09/eu-data-act-switching-requirements-cloud-services
Arnold & Porter, "Federal Banking Regulators Publish Final Guidance on Third-Party Risk Management" (14 Jun 2023): https://www.arnoldporter.com/en/perspectives/advisories/2023/06/federal-banking-regulators-publish-final-guidance
Baker Tilly, "Updated interagency guidance on model risk management" (4 Jun 2026): https://www.bakertilly.com/insights/updated-interagency-guidance-on-model-risk-management
American Bar Association, "ABA issues first ethics guidance on a lawyer's use of AI tools" (29 Jul 2024): https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/