How to choose legal AI tools: a buyer's checklist for small firms

Why there is no single best legal AI

A ranking answers a question firms are not actually asking. The question is not which logo is ahead this quarter. The question is whether this product can sit in your process without leaking a file, inventing a citation, or sending a draft that nobody signed. A tool that is strong in a demo can still be a poor fit if it trains on your uploads, cannot point at a source page, or emails without a review stop.

One firm needs a draft from a bundle with a pointer to each page. Another needs an enquiry captured onto one list. Another needs dates pulled from an order so a person can confirm them. Those are different jobs. A league table cannot score them honestly. We do not name a winner. We ask the questions below, in writing, before a live file goes in. If the vendor cannot answer, keep the work in the process you already trust. For what safe use looks like in the work itself, read AI for lawyers.

Data handling and storage location

Ask what the tool does with the text you upload. Does it train on that text. Who inside the vendor can read it. How long it is kept. Get the answers in writing before a client file goes in. You need the rule for your workspace, not a generic privacy page.

Ask where the files sit, in which country, and whether subprocessors see them. Name the processors. Name the region. If the vendor cannot do that, do not treat the tool as ready for confidential work. For UK firms, the ICO's guidance on AI and data protection says that if you cannot assess whether a third-party AI tool would be data protection compliant, good practice is to choose a different one. Ask whether a prompt is stored, who can search those logs, and what happens to a deleted matter: gone, marked deleted, or retained for training and support. If the honest answer is that you do not know where the paper went, the tool is a side channel, not part of the process.

Confidentiality terms

The contract should say that client material is confidential, who may access it, and whether it is used to improve the model. The Law Society's guide Generative AI: the essentials makes the same point: some tool agreements let the vendor reuse input data to refine its system, so read the terms of service and privacy policy before a file goes in. If training on customer content is on by default, the off switch must be in the agreement, not only in a dashboard. If staff access for support is allowed, it should be logged, limited, and something you can refuse for a given matter.

Ask how the vendor separates one firm's files from another's. Separate data for each firm is a control you can describe. A shared pool with a filter is not the same thing. If the vendor cannot explain the separation, treat confidentiality as unproven. Do not accept a term that puts the duty only on you while the vendor takes a wide licence to use the content. If the paper is unclear, the file stays out.

Source citations and verifiability

Ask whether each claim in the output points at a page in the source bundle. If it does not, a person has to do that matching before anyone relies on the text. A footnote that names a case not in the papers is not a citation. The product should make the source visible next to the sentence, not in a separate export you only open after something has gone wrong.

Verifiability means a reviewer can sit with the output and the source and finish the check. If the only way to verify is to re-read the whole bundle from scratch, the tool has added a fluent draft on top of the same work. Ask to see this in the pilot, on your papers, not on the vendor's sample file. If the product also answers from the open web, you need a hard line between those modes. A mixed answer that does not say which words came from your papers is not usable on a file.

Audit trail

Ask whether you can see who ran a job, what was uploaded, what came back, and who approved it. An AI legal assistant without a trail leaves the firm unable to say what happened. That is not an abstract governance point. It is the conversation you will have when a draft went out and nobody can remember who pressed send.

The trail should survive a staff change. It should show the version that was approved, not only the latest regeneration. It should record the review, not only the generation. If the vendor's log is a support tool they can see and you cannot export, it is their trail, not yours.

Human review workflow for an AI legal assistant

Ask how the workflow forces a person to review before send or file. A toggle that nobody uses is not a control. The stop has to sit on the path from generate to leave-the-firm: no email, no download for the client, no file-to-court shaped export, until a named person has marked the output reviewed.

Ask who can skip the stop, and whether that skip is logged. If a junior can bypass review by exporting to Word and sending from a personal inbox, the workflow is theatre. The process on the firm's side has to match the product: the reviewed version is the version that moves, and the unreviewed version does not.

PredictaOps is not a law firm. We do not give legal advice, file in court or replace counsel. We will not recommend a tool whose main idea is that the assistant is the reviewer. The assistant drafts. The person signs.

Fit with existing practice management

Ask whether the product works with the practice software or CRM you already use, or whether it needs the firm to move contacts, dates and files into a new system. A second database of the same clients is a new leak. If a tool already holds contacts, connect to it or sit beside it. We are not a partner of those vendors and we do not sell them.

Can an enquiry land on the list you already run. Can a confirmed date sit on the calendar you already trust. Can a draft be stored against the matter you already have. If the answer is a five-step export, that export is part of the cost. The process pages for client intake, deadlines and court dates and legal operations are the jobs to be done. Buy for one of those jobs, not for a platform story.

Security questions

Ask how access is granted, how it is revoked, and whether you can require a second factor. Ask whether data is encrypted in transit and at rest. Ask how you are told if there is a breach, and how quickly. Do not treat a logo on a trust page as the answer. If the vendor will only talk in certificates and not in who can open a file, keep asking about the file.

Exit and export

Ask how you get your files and logs out, in what format, and how long the vendor keeps a copy after you leave. If exit is unclear, the tool owns the work more than the firm does. A pilot that cannot be unwound is not a pilot. It is a migration you have not admitted to yet.

Export should include the outputs, the source uploads, and the audit trail, not only the last chat window. Ask whether deletion on exit is certified in a sentence you can keep, and whether backups retain the data beyond that sentence. Write the exit questions into the same note as the price. They belong together.

Pricing questions

Ask what is included, what counts as a seat or a document, what happens when volume rises, and how the contract ends. We do not publish prices here. The question is whether the vendor will put the commercial answers next to the demo, in writing, before a live file goes in. Watch for a cheap seat that bills the document, the page or the generation on a second line. Ask what happens if a person regenerates a draft while reviewing it, and whether a paused month still bills.

Running a small pilot

Pilot on fictional or anonymised papers, never on a live file. Use papers shaped like your own work, not the vendor's sample. Time the work you already do: draft, check against source, sign off. Then time the same work with the tool in the middle. If the check against source does not get shorter, you have bought a fluent extra step.

Give the pilot an owner, an end date, and a kill rule. If the vendor cannot answer the confidentiality and source questions in writing, stop. If review can be bypassed, stop. If export is a screenshot, stop. One process, one agreed number, as on AI for law firms. Do not pilot three products on three processes at once. The commercial path, if you want a system built around the bottleneck rather than another login, is AI for law firms.