I started building this framework at 2am on a Saturday because something in the data wasn’t making sense.
I’d spent the previous month scanning signals across Reddit, Hacker News, legal press, and VC funding announcements. The pattern that kept showing up wasn’t about technology. It was about the gap between what firms think they’re doing with AI and what they’re actually doing.
A managing partner tells you they’re “using AI.” What does that mean? It could mean their associates are using ChatGPT on personal phones with zero oversight. It could mean they dropped $50K on Harvey last year. It could mean one smart associate built something in Claude that nobody else understands. These are three completely different situations with three completely different risk profiles, and we’ve been treating them like they’re the same thing.
So I mapped it. Five levels. Four dimensions. And the part that made the whole thing click: no firm is uniformly at one level.
Level 1: Unaware
Your associates are using ChatGPT. I promise you they are.
They’re using it on their personal phones, during research, maybe while drafting motions. There’s no policy. There’s no tracking. There’s no audit trail. The managing partner either doesn’t know or doesn’t want to know.
Here’s why Level 1 is more dangerous in 2026 than it was in 2024. Courts aren’t figuring out how to handle AI anymore. They’re writing rules.
Morgan v. V2X required parties to disclose any AI use in document review. That’s a federal protective order, not a suggestion. Sheree Wright got sanctioned in the District of Arizona on April 2nd. Deborah Leslie caught a bar grievance and suspension from the Georgia Supreme Court on March 18th. Two attorneys in the Eastern District of Louisiana were fined and forced to resign. An attorney in the District of Oregon got hit with $109,700, likely the largest single AI-related sanction to date.
Every single one of those attorneys thought they were being careful.
Level 1 isn’t “we haven’t adopted AI.” Level 1 is “we adopted AI already and we don’t know it.”
Level 2: Tool Buyer
You purchased a branded AI platform. Harvey, Legora, CoCounsel, something with a nice pitch deck and a per-seat license. Your firm calls this “AI adoption.” Your associates call it something else.
I spent a month tracking sentiment on r/lawfirm and r/LegalTech. One thread alone, “Pricing: Harvey v Claude v Legora v CoCounsel,” hit 499 engagement points with 168 comments. The consensus word for these platforms is “wrapper.”
Not my word. Theirs.
Six independent users across different threads used the word organically. “Harvey and Legora will get crushed... they are just wrappers and RAG. Paying $2.5k per user per month is comedy.” That’s a real comment with 15 upvotes. Another with 46 upvotes calls Harvey “a heavily overpriced prompt library sitting on top of a generic LLM.”
And then there’s this one, 18 upvotes: “All the associates hated Harvey... partners went with Harvey because they think it’s magic.”
Not a single comment in that 168-reply thread defends the pricing. Not one.
Meanwhile, lawyers are independently moving to Claude. A litigation attorney paying $200/month for Claude Max uses it for “nearly everything.” A contract attorney calls it “a game changer for first passes on indemnity clauses.” A 20-attorney Brazilian firm chose Claude over Harvey because they “need more flexibility.” Someone won $8,000 in court using Claude after firing their attorney. That post got 628 upvotes and 77 comments.
The tool buyer level isn’t wrong. It’s just expensive for what it delivers. And the people actually using these tools every day are figuring that out faster than the partners who signed the contracts.
Level 3: Builder
This is where it gets interesting. And dangerous.
Someone at your firm, usually one associate who’s genuinely good with technology, built custom workflows in Claude or ChatGPT. Real automation. Real time savings. The work gets done faster. The output is actually better than what the branded platform was producing.
The problem is that it lives in one person’s head.
No documentation. No governance framework. No audit trail. If that associate leaves for in-house, and they will eventually, the system dies with them. Everything they built evaporates.
I call this the “bus factor” problem. If one person gets hit by a bus, does the system survive? At Level 3, the answer is no.
This is the level that feels like progress but isn’t yet defensible. It’s a firm that has capability without infrastructure. The smart associate can do amazing things on Tuesday, but the managing partner can’t explain what the AI policy is on Wednesday.
Level 3 firms are actually at higher risk than Level 2 firms in one specific way: they’re producing AI-assisted work product without the compliance scaffolding to protect it. If a court asks how a filing was prepared and the answer is “one of our associates has a really good Claude setup,” that’s not a defense. That’s an exposure.
Level 4: Governed Infrastructure
This is where traditional firms become defensible.
At Level 4, you’ve done the work that doesn’t feel like work. You’ve mapped which tasks are rule-based (what Sequoia calls intelligence) and which require human judgment. Policies are documented and distributed. Workflows have audit trails. There’s a clear answer to “what’s our AI policy?” and it doesn’t require looking anything up.
Most importantly, institutional knowledge compounds instead of dying in folders. When an associate builds something useful, it gets documented. When someone leaves, the system keeps running. The firm’s AI capability isn’t dependent on any single person.
Level 4 is also where compliance catches up with capability. Your engagement letters address AI use. Your discovery protocols have AI-specific language. If a court issued a protective order tomorrow, you could demonstrate compliance in hours, not weeks.
Here’s what Level 4 actually looks like in practice. Your associates open Claude and run a documented workflow. The managing partner can answer any governance question without looking it up. Every AI-assisted work product has an audit trail. When a court issues a protective order, your response time is hours, not weeks. Knowledge compounds instead of dying in folders when someone leaves.
That’s the target. Not Level 5.
Level 5: AI-Native
Level 5 isn’t your goal. It’s your competition.
Crosby raised $85.8 million. Sequoia, Lux Capital, Index Ventures, Bain Capital Ventures all wrote checks. Patrick Collison, the CEO of Stripe, invested personally. Cooley, one of the largest law firms in the world, invested in a company whose entire model eliminates the billable hour.
Crosby reviews contracts in under 60 minutes. Flat fee. Clients tag them in Slack. Their roadmap includes voice agents that negotiate on behalf of clients. This isn’t a law firm that adopted AI. It’s a technology company that happens to have lawyers in the quality control layer.
And Crosby isn’t alone. Arcline. General Legal. LegalOS. These companies were built at Level 5 from day one. You can’t retrofit your way there from a traditional firm.
But your clients are already comparing you to them. Sequoia mapped $60 billion of externally handled legal work that falls into what they call “autopilot territory.” The company that needs an NDA reviewed doesn’t call your firm, doesn’t negotiate an engagement letter, doesn’t wait for a conflicts check. It sends the document to an AI-native service and gets a redline back before the end of the business day.
The firm never gets the call. Not because the client chose someone else. Because the client never considered the firm at all.
The Part That Changes Everything: You’re Not at One Level
Here’s what the framework misses if you treat it as a single score.
No firm is uniformly at one level. You might be Level 3 on workflow because a smart associate built something in Claude, but Level 1 on governance because nobody documented a policy. You might be Level 4 on compliance but Level 1 on infrastructure because your “AI tool” is ChatGPT on someone’s personal phone.
That mix is where the real risk hides.
A firm with great AI workflows and zero compliance is one protective order away from a problem. A firm with strong governance but outdated infrastructure has documented policies that nobody can follow because the tools aren’t there. A firm with everything in place except workflow mapping has spent money on governance and tools but hasn’t figured out where AI actually fits into the work.
The gap between dimensions is where exposure concentrates.
The Four Dimensions
I score firms across four independent dimensions because the gaps between them tell you more than any single score.
Governance. Does a written AI policy exist? Is it distributed? Who owns AI decisions, and is it someone with actual authority? When was the policy last reviewed? A policy written in 2024 and never updated is worse than no policy, because it creates a false sense of compliance.
Infrastructure. What tools are being used? Are they documented? If the person who manages them leaves tomorrow, does the system survive? The difference between Level 2 (branded platform nobody uses) and Level 3 (custom workflows in one person’s head) and Level 4 (documented, resilient systems) isn’t about which tool you bought. It’s about whether the capability is institutional or personal.
Workflow. Have you mapped which tasks are rule-based and which require human judgment? This is the Sequoia split applied to your specific firm. Firms that have done this mapping are completing work in hours that used to take days. Firms that haven’t are using AI ad hoc, which means the ROI is invisible and the risk is unmanaged.
Compliance. Do your engagement letters address AI use? Can you demonstrate compliance to a court? Do you maintain audit trails on AI-assisted work product? This dimension didn’t exist two years ago. Courts created it through protective orders and sanctions. If your compliance score is below Level 3, you have immediate exposure in any litigation practice.
The Speed Advantage (And Why It Won’t Last)
A 5-attorney firm can get to Level 4 in weeks. Write a policy. Document it. Assign ownership. Map your workflows. Update your engagement letters. Add audit trails. None of this requires a committee. None of it requires approval chains. None of it costs $200/seat/month.
A 500-attorney firm needs committees, approvals, pilot programs, and 18 months. By the time they finish evaluating which AI tool to buy, the 5-attorney firm is already operating at Level 4 with Claude at $20/month.
Right now, the window where small firms can move faster than big ones is still open. It won’t last. When BigLaw spins up an internal AI department that operates like Crosby but with a BigLaw network behind it, the speed advantage closes.
The question isn’t whether to move. It’s whether you move while the window is open or after it shuts.
The Data Nobody Is Looking At
Here’s something I keep coming back to. I scanned the top threads on r/lawfirm over the past year looking for conversations about firm economics. Revenue, billing, profit margins, hiring, scaling, recession planning.
I found 24 threads. Detailed discussions about real numbers. Solo practitioners sharing monthly revenue from $7,000 to $770K/year. Firms debating overhead, billing rates, associate compensation.
Zero of those 24 threads mention AI.
Lawyers are planning their firms’ futures without factoring in the thing that’s repricing their work right now. The Sequoia thesis, the sanctions, the $85.8M flowing into AI-native firms, the 28% of legal researchers already using ChatGPT to find attorneys, none of it has entered the economic planning conversation for most firms.
The firms that recognize this gap and close it first will own the next five years. The ones that don’t will wonder what happened.
Where Do You Actually Stand?
I built a 2-minute diagnostic that maps where your firm sits across all four dimensions. 12 questions. Scores governance, infrastructure, workflow, and compliance separately because the mix is where the gaps live.
It’s free. No email gate. You see your results immediately. Most people are surprised by the gaps.