Inside Litera’s AI agent: what it takes to govern AI in practice
TL;DR
Litera’s legal team closed the gap between AI policy and practice by building LEA, a Copilot agent connected to LawVu that informs, triages, and routes – but never advises. The lessons: design for “I don’t know,” fix your taxonomy first, treat IT security as a build partner, and start by mapping one process end to end.
Adoption of legal AI software has doubled in the last year, going from 23 percent to 52 percent according to NatLawReview. While legal teams are reaping the benefits that legal technology presents, there is concern that adoption is steamrolling ahead without suitable guardrails. Consilio’s 2026 Global Survey Report states that only seven percent of legal teams have a documented AI governance framework that’s actively followed.
In a recent webinar, Vivek Mali, Senior Deputy General Counsel at Litera, walked Josie Norris, Head of Legal Risk and Compliance at LawVu, through how his team created sufficient guardrails by building and governing a live AI agent.
What is shadow AI?
Shadow AI is any AI tool used without IT or security’s approval or knowledge. For example, a contract pasted into a personal ChatGPT account, or an AI feature quietly switched on inside a vendor’s product.
For legal teams, Shadow AI poses a serious risk as it allows confidential data to move through systems nobody is watching.
Mali notes that the parameters needed to govern shadow AI are very different to that of an agent. “A chatbot answers questions. An agent is given a defined process, a set of tools, permissions, instructions,” explains Mali. “The agent we’ve built creates matters, it assigns tasks, it routes requests for legal review.
Why isn’t an AI policy enough on its own?
Mali is an advocate for the use of an agent in the legal context, because the amorphous use of shadow AI will always operate outside of the legal team’s control, no matter what policy is in place.
Sure, a policy determines rules, but it doesn’t stop someone from pasting a contract into ChatGPT and exposing confidential client and organizational data.
Mali believes good governance fails in the gap between policy and practice, and that gap lives in everyday workflows. Building an agent is a way to close that gap, by providing people with a sanctioned tool that’s easier than the workaround.
At Litera, the gap was intake. “Requests came in through email, Teams’ messages, and hallway conversations. There was no standardization, no triage, no visibility, or way to see who was doing what.” Sometimes requests were even duplicated; Mali recalls two counsel working on the same matter.
How did Litera build and govern its legal AI agent?
Litera’s legal team built its Legal Intelligence Agent, aptly named LEA, in Microsoft Copilot and deployed it in Teams as legal’s single front door and connected it to LawVu through an MCP.
LEA opens requests, checks matter status, finds executed contracts, and answers questions grounded in the legal team’s FAQs. LEA can create matters, and LawVu workflows assign those matters using a triage matrix, even rerouting to a backup when a lawyer is on PTO.
The guardrail: inform, triage, route – never advise
Mali recognized the general concern about AI hallucinations and providing answer’s confidently even when they are wrong. Bearing this in mind, he built LEA with a “no fabrication rule.” It was built with the guardrails of “inform, triage and route – but it can’t advise.”
LEA can share legal’s standard positions, but it can’t tell a salesperson whether to accept a customer’s proposed language. When LEA hits the edge of its knowledge, it opens a matter for Mali to review.
The taxonomy lesson
A lesson that Mali found in the iteration stages of LEA revolved around taxonomy.
Early on, 63 percent of incoming matters were classified as ‘other.’ When the team reclassified them, 71 percent of the “other” pile turned out to be revenue-enabling deal work. Litera removed the ‘other’ entirely.
Lesson: fix your taxonomy before you build.
The permissions mistake
Mali built LEA before involving IT security, and as a result LEA was put it “in the penalty box” for about six weeks. It turns out that LEA authenticated through a shared legal services account with organization-wide admin rights, bypassing LawVu’s role-based access controls. Anyone using LEA could effectively reach every matter and document.
Upon reflection, Mali advises involving IT from the inception phase of building an AI agent. He sees IT as a building partner, not a blockade.
What does an AI governance framework look like in practice?
Think of governance in three layers:
- Policy (the rules)
- Controls (permissions and guardrails)
- Environment (the live systems where AI does the work)
Most legal teams only create AI governance at the policy level. What makes Litera different is that their governance framework spans across all three layers.
Mali believes a comprehensive AI governance framework also splits responsibility into three lanes:
- Legal owns the knowledge base, routing logic, and output quality
- IT and security own infrastructure, authentication, permissions, and deployment
- Business users own input quality: in other words, if they give LEA a vague request, the quality of the triage will no doubt be vague
How did one agent scale across the company?
Once Litera’s IT department approved of LEA in action, other departments wanted agents too.
The IT team built a parent orchestration agent called Newton, with LEA, an IT agent, and a facilities agent underneath. A standing AI governance board now reviews non-conformities, and a monthly board-level AI scorecard lists LEA as a line item.
Where should legal teams start with AI governance?
“You don’t need to be ready. I think you just need to start,” Mali says. He advises picking one repeatable process and mapping it end to end. That could be the questions you ask, what drives routing, your legal team’s standard positions, and escalation points.
Once that’s written down, you have nearly half an agent’s instructions. Then find whoever owns your organization’s AI mandate and talk to them before you build. For the bigger picture, see our guide to AI governance for legal teams.
See where a governed legal agent runs.
LawVu is the operating system for in-house legal – one front door for requests, connected to the AI tools your teams already use.
