AI Is the Future of Law. Treat It With Absolute Caution. Both Are Right.

Two headlines, twenty-four hours apart.

Yesterday, May 17, 2026, the Washington Post published an opinion piece by Damien Charlotin, a senior research fellow at HEC Paris who has spent the last year cataloging AI hallucination sanctions cases in the courts. His thesis: AI is not the end of the legal profession. It is the future of it. He notes Anthropic's recent expansion of Claude for Legal, the steady arrival of new tools, and a profession that is past arguing about whether AI belongs in legal work.

Today, May 18, 2026, the Bar Standards Board, the regulator for barristers in England and Wales, issued its first detailed formal guidance on AI use in legal practice. The headline instruction on agentic AI systems, the ones that plan and execute multi-step work with limited human oversight, was three words long: absolute caution.

What the two headlines actually say

The Washington Post piece is a comfort message for a profession that has spent two years asking whether AI will replace it. Charlotin's catalog of over a thousand sanctions cases is presented not as evidence of catastrophe but as evidence that the bar has begun to enforce a standard. Lawyers are using AI. Some are being disciplined for using it badly. Most are not. The profession is adjusting in the ordinary way professions adjust.

The Bar Standards Board guidance is something different. It is a regulator telling its members, in plain language, that the next generation of AI tools, the agentic ones, requires a different posture than the chatbot generation. The guidance points to the Ayinde v. London Borough of Haringey judgment, where AI-generated content found its way into court filings with predictable consequences, and it tells barristers to ensure that their existing professional duties under the BSB Handbook are applied to AI use, not suspended for it. The phrase "absolute caution" is the word the regulator chose for the moment when an AI system stops being a tool a lawyer uses and starts being something closer to a colleague making decisions inside a matter.

A solo or small firm reading both pieces could be forgiven for confusion. One says AI is normal now. The other says the latest version of AI requires more discipline than the prior version. They are not in conflict. They are describing different layers of the same problem.

The governance gap

The gap is this. AI is widely adopted. Regulators expect lawyers to use it. Courts expect lawyers to verify it. Clients expect firms to be using it well. None of that tells a small firm what to actually do on Monday morning.

A reasonable small-firm lawyer asks a sequence of practical questions. Which tools are approved in our firm? Who decided? On what basis? What happens to client information when it goes into the tool? Who checks the output? What gets logged? What happens if something goes wrong, and can the firm show, after the fact, that its process was reasonable?

These are not exotic questions. They are the same questions firms have been answering for decades about conflicts, calendaring, client funds, and supervision of non-lawyer staff. AI sits in the same category. The California Bar's proposed rule amendments, released for public comment in March 2026, name this directly: managerial lawyers are expected to have procedures governing the use of AI, in the same way they have procedures governing the other functions of the firm.

The Florida Bar's Ethics Opinion 24-1 and ABA Formal Opinion 512 reach the same conclusion through different language. Both say that the existing rules of professional conduct already cover this. Competence. Confidentiality. Supervision. Candor. Communication with clients. None of the duties is new. The application is.

What "defensible governance" looks like

The phrase I keep coming back to, borrowed from compliance practice, is "defensible." Not perfect. Not exhaustive. Not a binder no one reads. Defensible means that if a court, a regulator, a client, or an opposing party asks how the firm decided to use this tool on this matter, the firm has an answer. The answer is in writing. The answer was decided before the question was asked. The answer holds up.

For a solo or small firm, defensible governance has about six moving parts.

1. A current inventory of every AI tool in use, including the AI features embedded in tools the firm already pays for, like the legal research suite, the email client, the document management system, and the meeting platform.
2. A short, plain-language policy that tells everyone in the firm what is allowed, what is not, and what requires permission. The policy says what to do, not what to feel.
3. A verification standard. Every AI output that touches a client matter is reviewed by a human who is competent to evaluate it. The standard names who, when, and what gets recorded.
4. A confidentiality protocol. What information can enter which tools. How free-tier products are handled differently from enterprise products. How client consent is documented when relevant.
5. A supervision structure. Who decides which tools the firm uses. Who trains the firm on them. Who handles the question when a new tool appears or a vendor changes its terms.
6. A record. Not a binder. A record. Decisions, dates, signatures or initials, kept in the ordinary course so that the firm's process is reconstructable later if needed.

None of these requires a technology background. All of them require a decision and a writing.

Why this matters more for small firms than for large ones

The large firm response to AI governance is to hire a director of AI strategy, retain outside consultants, run six-month pilots, and produce a 40-page policy. That response is available to firms that can afford it.

The small-firm response cannot mirror the large-firm response. The work has to be lighter, faster, and oriented toward the actual decisions the firm actually faces. But the duty is the same. The bar associations have not written a smaller version of the rules for smaller firms. The ABA Formal Opinion 512 standard applies to the solo office and to the AmLaw 100 in the same words.

The risk profile is also different. A large firm has the institutional muscle to absorb a single hallucinated citation as a story for the partner retreat. A small firm absorbs the same incident as a malpractice claim, a bar complaint, or a lost client. The marginal cost of getting AI governance wrong is higher for the firm with fewer matters in flight.

This is the reason the small firm should be the first to write down what it is doing, not the last.

The honest summary

Yesterday's Washington Post piece and today's Bar Standards Board guidance describe the same reality from two angles. AI is part of how legal work is done now. The way it is governed inside the firm is what separates the firms that absorb it from the firms that get embarrassed by it.

The technology is not the problem to solve. The decision-making process around the technology is. That process can be built in a few weeks. It cannot be built after the question gets asked.

This article is for informational purposes only and does not constitute legal advice. Consult qualified counsel for guidance specific to your situation. The six-part defensibility framework above is the foundation of JDAI Consultants' methodology, built around ABA Formal Opinion 512 and the corresponding state-level guidance, and developed at length in Responsible AI for the Small Law Firm (2026).

---