AI risk escalates not when a model is connected to a system, but when it touches sensitive data, forms judgements and embeds results into contracts, approvals and risk controls. Cao Haiyang, board member of the International Corporate Counsel Association and founder of a legal executive AI community, and Xie Dong, chief scientist at NewMofang and former global research and development vice president at IBM, plot a new AI governance paradigm for corporate legal and compliance departments
In the past year, corporate legal leaders have repeatedly talked about one change: AI is no longer limited to simply answering questions. It is beginning to take on entire segments of work. It can read thousands of pages of material, break down contract review or due diligence into distinct steps, and produce conclusions that can move forward through the workflow.
As technology moves a step forward, the governance challenges also shift. What companies now need to think through is no longer only which AI tools are allowed, but which tasks AI is performing within the department, what data it can access, how far it can go, and who is responsible when something goes wrong. Shifting the unit of governance from “tools” to “tasks” is precisely the key to answering these questions.
Change of AI’s role
The three signals of this wave of changes are now clear enough.
First, the workflow of AI tools has become significantly extended. In the past, AI interaction was mainly a question and answer exchange. Now, a model can plan steps around a due diligence or contract review task, process materials in batches, and finally produce a complete deliverable. The output is no longer just a piece of text; it becomes a work product that can move into the next stage of the workflow.
Second, results are increasingly expected to be verifiable. A model must be able to recognise when a question does not apply, rather than forcing a formally complete answer. Important conclusions should be traceable back to the facts or source text that support them, so that reviewers have a clear path for verification.
Third, knowledge and experience are beginning to accumulate and be reused. Past cases, expert opinions and previous approval experience can be incorporated into the system. The next task does not have to start from zero, and the overall cost of completing a single task can fall significantly.
The true shift from an AI that “answers questions” to one that “takes on tasks” happens only when these three signals converge. Since that is now the case, the permission, review and responsibility arrangements that companies previously used to manage human work should also be extended to the tasks in which AI participates.
Risk of process misalignment
The enhancement of AI capabilities does not automatically create risk. The trouble often arises at the handoff points: AI has already entered business processes, while the original control mechanisms have not been embedded into them.
Consider a lawyer who, for convenience, pastes an entire cross-border procurement contract into a personal AI account. Even if the model’s comments do not appear to present any obvious problem, the pricing terms, payment arrangements and technical details in the contract may already have entered an external environment that the enterprise can neither delete nor retrieve. The core issue is not whether the legal opinion is accurate. It is that the data and work context have moved outside the company’s control.
Another type of scenario is more subtle. AI aggregates company registration information, litigation records and historical transaction materials and produces a due diligence report that looks structurally complete. Yet the process has not specified which citations must be verified, or which judgements require human confirmation. The report can easily be treated as a “completed task” and adopted directly. Rather than blaming users for being careless, it is more accurate to recognise that the process itself has not reserved a proper place for review.
Both scenarios point to the same issue: the focus of risk has expanded from “whether the answer is correct” to the entire task lifecycle. It now includes where the data comes from, how much permission is granted, who verifies the conclusions, which steps must pause for human judgement, and who ultimately bears responsibility. If any one of these links is left undefined, AI use is more likely to become uncontrolled.
Governance shift
Focusing only on which models to approve and which products to prohibit is often insufficient to cover the risks that actually arise. The same tool may be used merely to retrieve a public legal provision, or it may be used to analyse a non-public merger and acquisition agreement. The level of risk is entirely different. Asking AI to draft revision suggestions is also very different from allowing it to directly change the approval status in a contract management system. The difference does not lie in the tool itself, but in the task.
This perspective becomes immediately concrete in the common context of contract review. Can the contract be uploaded into the system? Can the model access internal price limits and negotiation records? Are the opinions for human reference only, or can they be pushed directly into the approval workflow? If there is an error in judgement, who reviews and takes responsibility for it?
In broad terms, the risk level of an AI task depends mainly on three factors: the sensitivity of the data it touches; the scope of the authority it is granted; and whether the consequences of an error would be significant and reversible.
Five control points
Once the task becomes the unit of governance, controls have a concrete place to land. Across the full lifecycle of a task, five control points should be established.
Data: control the boundary of inputs. First define which contracts, cases, client information and trade secrets may be input into the AI system, who is authorised to approve their use, whether they may be transmitted to external service providers or used across borders, and how they will be retained or deleted after the task ends. Where there is uncertainty about the materials, the default should be the principle of minimum necessity.
Permissions: control the scope of action. Being able to read does not mean being able to edit. Being able to suggest does not mean being able to execute. Companies should set whitelists for the systems and tools that AI may call on, and specify whether AI may only read information or whether it may modify status, send information externally, generate formal documents or trigger subsequent workflows.
Traceability: control the basis for verification. Important judgements should be traceable to authentic, valid and relevant source text or facts. The inputs, data version and reasoning basis at the time should also be recorded. This gives reviewers a path to follow and provides evidence if accountability is later required.
Decision making: control the checkpoints. Low-risk and reversible steps can be entrusted to automation. For processes involving major transactions, external commitments or regulatory obligations, human confirmation should be mandatory. This makes clear the boundary between judgment authority and action authority.
Responsibility: define fallback arrangements. The company should identify in advance who approves the task to go live, who reviews the output, who accepts exceptions and who has the authority to halt the process and coordinate remediation when anomalies occur. AI can take on more work, but the institutional responsibility cannot become lighter as a result.
Together, these five points form a closed loop. Data determines what AI can see. Permissions determine how far it can go. Traceability ensures the process can be checked. Decision making defines where humans must remain involved. Responsibility ensures that every step has an owner. If any link is missing, the chain may break at that point.
Starting with an ‘AI task list’
Rather than rushing to draft an even thicker AI use policy, it is better to first clarify what AI is already doing within the department. The method is simple: build an AI task list, and fill in five fields for each task – what data it processes, what permissions it has, who verifies the output, which steps require human confirmation and who is ultimately responsible.
Take the common example of preliminary contract review. Only redacted contracts and the standard clause library are allowed into the system. The model has read-only access. It can generate revision suggestions but cannot change the status in the system. Draft opinions must first be reviewed by the responsible lawyer.
Any external transmission or submission for approval must wait for human confirmation. Final responsibility rests with the compliance leader of the relevant business line. When tasks are listed in this way, it becomes immediately clear which categories of tasks carry higher risk, which controls are still missing and where the priorities lie.
After the inventory review is complete, controls should be set according to risk levels. Low-risk tasks such as public legal research and initial screening of routine clauses can be safely entrusted to automation. Tasks involving trade secrets, major transactions or external commitments should be subject to stricter controls, including whitelist-based authorisation, approval for key actions, exception-escalation mechanisms, and full process records. The level of control should follow the risk of the task, not the popularity of the tool.
There is one more matter that should be addressed sooner rather than later: company context such as case backgrounds, contract archives and approval records should be continually accumulated in an environment that is controlled, authorised and traceable by the company. Models can always be replaced. These growing stocks of knowledge assets are the real defensible foundation of a legal and compliance department.
AI convergence is a collaborative series jointly launched by China Business Law Journal, the International Corporate Counsel Association and Aivigate. It is a cross-disciplinary dialogue platform at the intersection of legal practice and artificial intelligence, bringing together practical insights of general counsel, frontier assessments of technology experts, and the first-principles thinking of scientists. Participating in and chronicling this transformation, the series aims to facilitate a meaningful integration of technological rationality and legal values, contributing a pragmatic intellectual voice to the age of legal AI.
