Powered by
MOMENTUM
MEDIA
For law firms and legal teams weighing up what "defensible" artificial intelligence governance looks, the test is not what the organisation believes about its own safeguards but what it can prove about them to a court or regulator, one expert says.
Last month, in a session at Lawyers Weekly’s AI Innovate event, Relativity APAC government advisor John Wallace spoke with host Jerome Doraisamy about responsible AI governance, and ensuring that processes are defensible by design. The pair also examined how legal teams can establish clear standards for disclosure, oversight, verification, and sign-off – and build governance practices that stand up to scrutiny.
Asked to explain what defensibility means across disclosure, oversight and sign-off, Wallace said the question is not only whether an organisation can withstand hard questions. The "real test", he said, "is going to be when something goes wrong", and the answer to that test comes down to evidence rather than belief.
The central question, he noted, is whether a firm can demonstrate to a court or regulator that its governance was real and was followed. Wallace urged lawyers to turn the question on their own workplaces. "If your firm was accused of having robust and defensible AI governance," he said, the issue is "would there be enough evidence to convict you?"
That question, he continued, should be asked continually and by everyone in an organisation, particularly those who are using AI in their work, given what he described as a shared stake in the issue.
What the evidence looks like
On disclosure, Wallace said firms need to know who must be told when AI is being used, and to whom the use must be disclosed. Those rules should be documented, he said, and followed consistently, with evidence that this is actually happening.
On oversight, he pointed to a named officer or accountable person for each AI use case, alongside regular risk reviews. Both, he said, would show anyone asking questions after a problem that the organisation took the issue seriously and had measures in place. He described the reviews as part of a good risk culture.
Sign-off, Wallace said, is where human review must be genuine. Firms should be able to show that a reviewer has checked and signed off on the output, and that the sign-off is documented. He said this should happen even before deployment, through a defined validation and testing process, so that the organisation can produce a decision record.
"That's the real evidence part of it," he said.
Wallace also warned organisations against what he called "hypocritical risk". Firms, and any organisation, need to be doing what they say they do, he said, and not be unable to live up to the standards they expect of their clients.
Not reinventing the wheel
It was put to Wallace that none of this appears unreasonable or overly onerous for a legal team, and that it resembles what lawyers, firms and legal teams were doing before the age of AI, such as keeping a paper trail and documenting processes, particularly for repeat matters. On that view, good governance in the AI era is less about reinventing the wheel and more about carrying existing processes over to a new technological landscape.
"Spot on," he responded.
It is easy, he said, "to be lulled into a false sense of security because AI is fantastic in terms of its capability and what it can do". Relaxing trust in that way, and "taking your foot off the accelerator in terms of governance", is when risks start to increase and creep in, he said.
"It's not new. It is really just good governance and good due diligence," Wallace said, likening it to the way an organisation treats other risks, including those across its supply chain or in essential services. The processes and the rigour applied to them, he said, are not necessarily different from what organisations already expect, and "we're not reinventing the wheel".
‘I wouldn't just sign it and trust it’
Wallace also recounted a conversation with a lawyer friend who has been practising for a long time, to whom he had discussed defensibility. Before AI, she told him, if a junior or a graduate drafted something for her, whether an affidavit, a statement or a document to be sent out, and it was put under her nose to sign, "I wouldn't just sign it and trust it". She would go through the necessary checks, Wallace said, asking the drafter about any references, citations or other cases being quoted.
"It's very much the same," with AI, he said, adding that with such new technology, lawyers "have just got to be asking those, those questions and just validating that the results that we're putting out there and that we're relying on, that they are defensible and that we can rely on them".
