The first step is to discover how AI is already being used

Before designing a strategy, the firm should assume that informal uses probably already exist.

Lawyers and administrative teams may be using general-purpose tools to summarize documents, prepare emails, conduct research, translate, draft publications or review contracts.

The diagnosis should not begin as a disciplinary investigation. It should help the firm understand habits, needs and risks.

Initial inventory

• Tools being used and the type of account.
• Departments, practices and functions using them.
• Tasks users are trying to solve.
• Information being entered.
• Outputs being generated.
• Form of human review.
• Existing vendors or integrations.
• Recurring incidents, errors or questions.
• Clients with specific restrictions.
• Processes with the greatest time consumption.

Not every law firm should begin at the same level

A firm operating at the informal level does not need to begin with an autonomous agent. It needs to regain control. A firm with standardized processes can focus on redesigning services and measuring value.

Maturity is not measured by the sophistication of the tool. It is measured by the firm’s ability to explain who uses it, for what purpose, with which information and under which controls.

The first pilot should be useful, repeatable and sufficiently safe

Choosing the most impressive use case is usually a mistake. The first pilot should allow the firm to learn without compromising a critical decision.

Criteria for selecting a use case

• It occurs frequently enough to be measured.
• It has an identifiable current process.
• It consumes visible amounts of time.
• It has reference documents or criteria.
• It permits human review before the output is used.
• It does not require unnecessarily sensitive information.
• It has an owner willing to test and document it.
• It can be compared against a baseline.

Each use case needs a risk classification

The same tool may be low risk when summarizing a public article and high risk when analyzing confidential information before a hearing.

The classification should determine which tools may be used, which level of lawyer must review the output, which evidence must be retained and whether the client needs to be informed or asked for authorization.

Evaluating a tool requires more than attending a sales demonstration

The firm must assess how the product operates within its architecture, obligations and contractual framework.

Evaluation checklist

• Purpose and permitted use cases.
• Sources or databases used by the system.
• Location and conditions of processing.
• Retention and deletion of prompts, documents and outputs.
• Use of information for training.
• Subprocessors and transfers.
• Access controls, authentication and administration.
• Encryption, backups and incident handling.
• Logs, traceability and export capabilities.
• Integrations with email, documents and internal systems.
• Ownership and licenses over inputs and outputs.
• Liability, indemnification and contractual limitations.
• Auditability and termination rights.
• Support, continuity and product changes.

The minimum policy should be short, clear and usable

A fifty-page document that nobody consults does not control behavior. The policy should establish understandable rules and link to more detailed procedures where necessary.

Minimum contents

• Scope: covered individuals, tools, devices and activities.
• Tools: approved, restricted and prohibited platforms.
• Information: data that may or may not be entered.
• Use cases: permitted tasks and uses requiring authorization.
• Review: human responsibility and approval level.
• Sources: obligation to verify facts, authorities and citations.
• Clients: criteria for communication, consent and restrictions.
• Fees: rules on time recording, costs and transparency.
• Incidents: channel and deadline for reporting errors or exposure.
• Training: requirements before accessing tools.
• Supervision: owners responsible for updates and compliance.

ABA Formal Opinion 512, although it does not regulate legal practice in Mexico, provides a useful framework: competence, confidentiality, client communication, supervision, accuracy and reasonable fees continue to apply when AI is used.

“Reviewed by a lawyer” must mean something specific

Human review cannot be reduced to quickly reading generated text and approving it because it appears correct.

The control should correspond to the use and its risk level.

Human review does not exist to correct style. It exists to restore the context, judgment and accountability the tool cannot assume.

A 90-day plan allows the firm to learn without attempting to transform everything at once

The pilot needs an owner

Responsibility cannot remain divided among IT, innovation, marketing and an interested partner. One person must coordinate decisions, documentation and escalation.

The baseline must exist before the pilot begins

The firm needs to know the current time, number of reviews, error rate, cost, satisfaction and outcome. Without that reference, any claimed improvement will remain an impression.

Efficiency must appear in the proposal and in the client conversation

A firm does not need to disclose every tool it uses. It does need to explain when the method affects information, scope, price, vendors or client instructions.

The conversation may cover

• Which task will be supported by AI.
• Which information will be processed.
• Which platform and controls will be used.
• Which review the team will perform.
• Which benefit the client will receive.
• How it will affect timing and fees.
• Which restrictions the client may impose.

Pricing should be reviewed alongside the process

The ABA has stated that the use of AI does not permit billing hours that were not actually worked and that charges related to tools should be explained reasonably. That guidance does not replace Mexican regulation, but it illustrates the tension firms need to resolve.

The pilot may evaluate:

• Fixed fees by deliverable.
• Phase-based pricing.
• Subscriptions for recurring services.
• Volume pricing with defined criteria and exceptions.
• Hybrid models for automatable work and senior advice.

Training should produce observable behavior

A general conference may create awareness, but it does not guarantee correct use.

Training should work with the firm’s real documents, risks and decisions.

Users should demonstrate competence through exercises and review, not simply confirm that they attended a session.

The program must measure more than time saved

The firm should decide in advance which result would justify scaling and which condition would require the pilot to stop.

Mistakes that turn implementation into a permanent experiment

• Starting with the tool. The firm purchases capability without defining the problem.
• Trying to cover every practice. The program loses focus, ownership and measurability.
• Failing to establish a baseline. Savings are claimed but cannot be demonstrated.
• Using real information too early. The pilot increases risk before controls have been validated.
• Depending on one enthusiastic user. The process only works while that person continues to drive it.
• Training only once. Tools change and good habits deteriorate.
• Failing to review vendor contracts. The sales demonstration replaces legal and technical evaluation.
• Measuring only speed. The team works faster, but it may also produce errors faster.
• Failing to connect the program with pricing. Efficiency exists, but the commercial proposition remains unchanged.
• Scaling before documenting. The firm multiplies a process that still depends on exceptions.

Frequently asked questions about implementing AI in law firms