Legal document review is rarely a single shared knowledge base. Different matters, teams, clients and protective orders create boundaries that an AI search system must respect. The design should preserve those boundaries while helping attorneys locate and review relevant evidence.
Map access by matter
Start with the firm’s existing matter permissions and information barriers. Identify which documents may be processed, which users may search them, and what must remain excluded. Avoid moving restricted collections into a shared index without equivalent controls. Test whether a user can infer another matter’s content through snippets, filenames, citations or conversation history.
Review the provider and data path
Record where files, prompts and outputs are processed and retained, including logging and support access. Confirm contractual terms and the applicable client requirements before uploading material. ABA Formal Opinion 512 discusses lawyers’ obligations when using generative AI, including competence, confidentiality and communication. Whether a particular use affects privilege requires counsel’s assessment; technical safeguards cannot provide an absolute privilege guarantee. ABA Formal Opinion 512.
Make attorney review specific
A useful draft links factual assertions to the underlying record and separates source material from inference. The reviewer needs access to the complete passage, surrounding context and document version. For legal authorities, verify that the authority exists and supports the proposition. The workflow should record material corrections without forcing confidential reasoning into broadly accessible logs.
Test the information barrier as an adversarial case
Create test matters with deliberately distinct permissions. Ask a user assigned to one matter questions that could be answered only from another. Include indirect requests, such as identifying whether a document exists or summarizing a person mentioned in several files. The expected result should be defined by the firm’s access policy, not by the model’s willingness to answer.
Then test the review interface with a permitted document. Can the attorney identify the exact passage, inspect the surrounding text and distinguish an extracted fact from a draft inference? If these checks require leaving the workflow and reconstructing the search, the interface is adding review friction that should be measured before rollout.
Keep defensibility proportionate
Record the scope of collection, processing decisions and review responsibilities. Establish a retention plan for source documents, review records and AI-generated drafts that fits the matter. When a source is corrected or access is withdrawn, determine how indexes and cached outputs will be updated. The handover should make these routines operable by the firm.
Before the next decision
Planning checklist
- Matter-level permissions and information-barrier tests
- Documented provider, retention and data-use review
- Attorney verification of facts and authorities
- Matter-specific handling and retention instructions
Sources and further reading
Sources checked 5 October 2026. The design recommendations in this guide are AID’s analysis. Sector obligations depend on the use case and jurisdiction.
Apply this to a defined workflow
AID can implement matter-scoped retrieval and review controls under the firm’s legal and information-security requirements.
