A practical guide to AI adoption for small and midsize law firms
Most writing about legal AI assumes an innovation committee and a budget for a pilot that fails. Firms under about thirty attorneys have neither, which changes the sequence but not the requirements. Here is what actually fits.
The two things that do not shrink
Nearly everything about adopting technology scales down with firm size. Two things do not, and pretending otherwise is where small firms get hurt.
Vendor evaluation is the same size at any headcount. The questions about retention, training use, tenant isolation, and key custody take the same afternoon to ask whether you have twelve attorneys or two hundred. A small firm that skips them has exactly the same exposure under Model Rule 1.6, because the rule is about the client's information rather than the firm's size.
The ethical obligations are identical. Competence, confidentiality, supervision, and candor do not have a small firm exemption. A disciplinary complaint does not weigh headcount, and neither does a malpractice carrier.
The good news is that both are reading-and-deciding work rather than engineering. They need attention, not a technology department.
What small firms should not attempt
Custom software. It is where firms without internal capacity reliably lose money, not because the build fails but because it succeeds and then has to be maintained by someone. A bespoke workflow becomes an obligation the year after it is delivered, when the vendor relationship has ended and the person who understood it has left.
Buy something configurable, configure it, and keep the maintenance burden with the vendor.
The 90-day path
Weeks 1 to 2: inventory and choose
Find out what the firm is already using. Ask directly, without consequence, and expect surprises. Most firms discover tools in active use on client matters that nobody approved. That is not a discipline problem, it is a governance gap, and it changes your task from prevention to migration.
Then pick one workflow. The test: staff time consumed by work that repeats in the same shape, and a before state you can measure today. If you cannot measure it now, you will not be able to prove anything later.
For plaintiff-side and consumer-facing practices this is almost always intake and triage. It is continuous, it is expensive to do badly, and the deadline screen has value from day one. Details in how firms use AI for intake and matter triage.
Weeks 3 to 5: evaluate one vendor, write a short policy
One vendor, properly, beats three superficially. Get written answers on retention, training use, tenant isolation, key custody, subprocessors, breach notification, and willingness to sign confidentiality terms. The full list is in how law firms can implement AI safely.
Then write the policy. For a small firm it can be three pages: approved tools, what may be done with client data, what requires attorney review, who owns it. The eight-section version is in what belongs in a law firm AI use policy, and a small firm can compress several of those sections into paragraphs without losing anything that matters.
Do not skip to week 6. This is the step firms under pressure delete, and it is the only one that cannot be done retroactively. Once client information has entered a tool with broad retention rights, writing a policy the following month does not retrieve it.
Weeks 6 to 9: run it in observe-only mode
Let the tool score, sort, or draft without changing what actually happens to the matter. Your existing process continues. Then compare.
This is the highest-value four weeks in the whole plan and the most commonly skipped. It gives you evidence rather than impressions, and it lets you find the failure modes on matters where a mistake costs nothing. It also produces the number you will need later to defend whatever threshold you enforce.
Track four things:
- Time from intake to a qualified decision, before and after
- Percentage of matters arriving with a complete field set
- Disagreement rate between the tool and your staff
- Whether people were still using it in week four
The disagreement rate is the most informative. High disagreement means either the tool is wrong or your acceptance criteria were never written down, and both are worth knowing. The last metric is the one that predicts whether this survives.
Weeks 10 to 13: switch over and train
If the measurements hold, make it the process rather than an option alongside the old one. Parallel running past the observation period is how pilots die: everyone keeps the familiar path and the new tool becomes a second window nobody opens.
Training here is about boundaries more than buttons. People need to know where the tool's judgment stops and theirs begins. An attorney who does not know which outputs are reliable will either over-trust it or quietly stop, and both look identical from outside: no measurable change.
Budget honestly
The license is usually the smallest line. Two costs get underestimated consistently.
The evaluation and policy hours. Real time from someone senior, typically fifteen to twenty-five hours across the two phases. It is not billable and it is not optional.
The parallel-running dip. Weeks 6 to 9 cost throughput, because staff are doing the work and checking the tool. Firms that do not budget for this abandon in week three, which is exactly when adoption feels worst and just before it starts working. Expect the dip. Name it in advance so nobody reads it as failure.
What to demand from a vendor selling to small firms
Smaller firms get offered worse terms, so a few things are worth insisting on.
- The same isolation guarantees a large firm gets. Ask whether your data can be reached from another customer's account and who holds the encryption keys. A vendor that isolates by firm should be able to say so concretely. Ours seals each firm's integration credentials under a key belonging to that firm alone, in a table that denies all access by default.
- Central configuration of integrations. Credentials entered by individual users end up in accounts nobody tracks. Administrator-configured integrations keep them auditable.
- No computed legal deadlines from unverified rules. Ask directly how the tool handles a jurisdiction or claim type it has not verified. The right answer is that it reports the gap. A tool that always produces a confident date is not more capable, it is less careful.
- An exit. How you get your data out, in what format, and how quickly. Ask before signing, when you still have leverage.
Where this leads
One governed workflow, measured and adopted, is a better position than five tools nobody agreed on. It also gives you a template: the second workflow takes roughly half as long, because the policy exists, the vendor process is known, and staff have seen an adoption cycle succeed.
The broader operating model these steps build toward is described in what makes a firm AI-native.
Frequently asked questions
How can a small firm realistically adopt AI?
One workflow, governed before deployment, measured in observe-only mode for four weeks, then switched over. Inventory what is already in use before anything else.
Does a small firm need a technology team?
No, provided it buys configurable software rather than commissioning custom development. Governance is reading and deciding, and does not scale with headcount.
What does it cost?
Licensing is usually the smaller share. Budget fifteen to twenty-five senior hours for evaluation and policy, plus a throughput dip during the parallel period.
Which workflow first?
Intake and triage for most plaintiff-side practices. First-pass document review for transactional ones. Pick the one you can measure today.
How long does it take?
About 90 days to steady state for one workflow without custom development. Compressing it usually means deleting the observation period, which is the part that produces the evidence.
This article is general information about legal technology operations. It is not legal advice and not an ethics opinion. Firms should consult their own counsel and their state bar's guidance before adopting an AI policy or deploying any tool on client matters.