When AI Acts, Who Is Accountable? The Legal Profession’s Next AI Problem Is Agency

By Asher Njoroge
‍

Yet, as legal technology evolves at a breakneck pace, the critical question confronting legal practitioners, general counsel, ethics committees, and risk officers is no longer whether legal professionals will adopt artificial intelligence. That debate is largely settled. Instead, the legal sector faces a far more profound and fraught paradigm shift: what happens when AI transitions from passively answering queries to actively taking autonomous actions across dynamic, high-stakes legal environments?

From Answering to Acting: Understanding the Shift to Agentic AI

In its first iteration, generative AI operated primarily as a retrieval and text-synthesis engine. A user typed a prompt, and the model returned text—a memo draft, a search summary, or a list of legal precedents. The human user retained complete operational control over every step: reading the output, verifying its contents, deciding whether to copy it into a draft, and determining when and how to send it. The software remained firmly in a supporting role as a tool of assistance.

Agentic AI completely flips this passive dynamic on its head. Modern AI agents are built with multi-step reasoning capabilities, workflow integrations, and permissioned API access to core enterprise software. Today's autonomous legal agents can actively traverse database structures, aggregate evidence across thousands of disparate discovery documents, compile strategic recommendations, trigger automated compliance workflows, negotiate standard contract terms within pre-established parameters, and even execute binding operational transactions on behalf of an organization.

This technological leap from passive text generation to active execution alters the nature of legal and regulatory exposure. The central governance question shifts from “Is the generated output text factual and well-written?” to “Who authorized this specific autonomous action, what legal entity is bound by its outcome, and who bears ultimate accountability when the system acts unexpectedly or commits a critical error?”

Delegating Tasks vs. Delegating Responsibility: The Agency Dilemma

To understand the operational realities of agentic AI in practice, consider a realistic enterprise scenario. A multinational corporation deploys an autonomous contract-remediation agent to review 500 vendor agreements in light of newly enacted privacy legislation. The agent is tasked with scanning each contract, identifying non-compliant indemnification or liability caps, drafting tailored compliance amendments, and emailing those proposed revisions directly to counterparties for signature.

The efficiency gains of such a system are staggering—tasks that previously required hundreds of billable hours from legal associates can now be processed in a matter of minutes. However, the legal and financial risks scale at precisely the same rate. Suppose the agent misconstrues a nuanced choice-of-law provision, erroneously waives a crucial limitation of liability, leaks confidential commercial terms to an unauthorized third party, or sends binding contractual amendments without final executive sign-off. In that event, the organization faces real-world legal exposure, breach of trust, and potential regulatory sanctions.

When challenged by a court, a regulatory body, or an aggrieved counterparty, a licensed attorney or corporate officer cannot simply defect responsibility by claiming, “The algorithm made an autonomous decision beyond our foresight.” Under established principles of legal ethics and agency law, human oversight remains non-negotiable. You can delegate operational execution to automated systems, but you can never delegate professional, ethical, or fiduciary legal responsibility.

Just as a partner in a law firm remains strictly answerable for the work product, filings, and communications prepared by a junior associate or paralegal, legal practitioners remain fully accountable for every action, output, and omission generated by their automated tools and autonomous software agents.

Professional Ethics and Due Diligence in the Age of AI

In many legal circles, attorneys who raise pointed questions about automated software tools are unfairly labeled as technology skeptics or traditionalists resisting legal innovation. However, probing deeply into risk profiles, data lineage, hallucination rates, security architecture, and regulatory compliance is not an impediment to innovation—it is the core fulfillment of professional legal due diligence.

Judicial bodies and bar associations across global jurisdictions are increasingly making it explicit that core ethical duties—including the duty of competence, the duty of confidentiality, the duty of candor to the court, and the duty to supervise non-human assistants—apply with full force to AI-assisted legal work. Relying on an unverified AI output that includes fictitious case law citations or inaccurate statutory interpretations constitutes a direct breach of professional conduct rules, regardless of the sophistication of the underlying technology.

Managing the Hallucination Hazard: Treat AI Like an Eager Intern

The Illusion of Certainty

One of the most treacherous aspects of modern artificial intelligence models is their persuasive fluency. AI models construct sentences with persuasive clarity and unyielding confidence, even when generating inaccurate factual claims or completely fabricated legal citations (hallucinations). For busy legal practitioners working under tight litigation deadlines, this authoritative tone creates a dangerous temptation to accept recommendations at face value.

The most effective mental model for legal professionals integrating AI into their workflows is to treat AI like an exceptionally bright, highly energetic, but inexperienced intern. An intern can process massive amounts of raw information at incredible speed, draft detailed initial outlines, and surface relevant facts across complex materials. However, no prudent senior lawyer would ever take a junior intern’s research memo, sign their name to it, and submit it directly to a judge or client without checking every legal citation, validating every factual assertion, and reviewing the core logic line by line. The same level of rigorous human verification must be applied to every AI-generated artifact.

Building Institutional AI Playbooks: Governance, Boundaries, and Risk Mitigation

Sustainable and safe AI implementation requires far more than encouraging staff to experiment with prompt engineering. Robust enterprise adoption demands clear, enforceable institutional playbooks. The most resilient legal departments and law firms do not leave AI governance to individual discretion; instead, they establish comprehensive policy frameworks that define exact boundary conditions, approval hierarchies, operational safeguards, and data handling protocols.

A well-structured AI Playbook must establish explicit rules across several core operational vectors:

1. Clear Authorization Thresholds: Define precisely which legal tasks may be assisted by AI (e.g., initial document review, preliminary research drafting) versus tasks where AI usage is strictly restricted or outright prohibited (e.g., final client advisory opinions, court filings, binding settlement approvals).
2. Mandatory Human-in-the-Loop (HITL) Gateways: Mandate specific operational checkpoints where a qualified human attorney must review, validate, and sign off before an automated action can be executed or transmitted outside the firm.
3. Auditability and Logging Protocols: Maintain detailed, immutable digital logs of all prompts, model configurations, data inputs, and system outputs to ensure complete auditability in the event of subsequent legal or regulatory disputes.
4. Data Quality and Knowledge Base Curation: Recognize that automating processes on top of outdated precedent files or flawed internal records only accelerates mistakes at scale. Organizations must continuously audit and clean the core document repositories used for retrieval-augmented generation (RAG) systems.

Data Privacy, Privilege, and Cybersecurity Constraints

Protecting Confidential Information in Automated Systems

Pasting sensitive commercial agreements, proprietary client strategy memos, unannounced M&A transaction details, or personally identifiable information (PII) into public or unvetted commercial AI interfaces creates severe legal, regulatory, and ethical risks. Inadvertently exposing confidential client data to third-party model providers can result in a waiver of attorney-client privilege, breaches of non-disclosure agreements, and heavy penalties under global privacy frameworks such as the GDPR or regional data protection acts.

Prior to deploying any AI system, legal organizations must conduct comprehensive technical and legal due diligence regarding data governance. Key contractual and operational safeguards must include explicitly opting out of third-party model training on user data, securing enterprise-grade encryption for data in transit and at rest, establishing role-based access controls within internal legal tools, and verifying compliance with cross-border data transfer regulations.

The Nendo Takeaway: Strategic Governance Framework

The Five Pillars of AI Legal Agency

As artificial intelligence transitions from generating static content to performing autonomous tasks across enterprise environments, every legal executive, risk committee, and law firm managing partner must establish definitive answers to five foundational governance questions:

1. 1. What can the AI see? What exact repositories, database structures, client records, and confidential files are accessible to the system, and what data masking or access controls are enforced?
2. 2. What can the AI decide? What internal choices or risk assessments is the agent authorized to calculate, and where are its logical parameters strictly circumscribed?
3. 3. What can the AI do? Which operational workflows, draft transmissions, or transactional executions is the agent permitted to trigger autonomously within the enterprise software ecosystem?
4. 4. When must it escalate to a human? What specific confidence thresholds, risk indicators, or anomaly triggers mandate an immediate halt to automated execution and require human attorney intervention?

5. Who remains accountable when things go wrong? Which specific human partner, corporate officer, or practice group leader holds ultimate legal, ethical, and financial responsibility for the system's actions?

1. What can the AI see?
2. What can the AI decide?
3. What can the AI do?
4. When must it escalate to a human?
5. Who remains accountable when things go wrong?

While artificial intelligence drastically accelerates legal research speed, contract processing, and operational productivity, human judgment, ethical reasoning, and strategic counsel remain fundamentally irreplaceable. By deploying AI as an advanced capability multiplier while maintaining strict institutional playbooks, rigorous human oversight, and clear lines of professional accountability, the modern legal profession can confidently navigate the frontier of agentic AI without compromising its core ethical standards.

‍