Harvey's AI Governance Framework: What Small Law Firms Can Take From Big Law's Playbook

Published: June 2026 | By: The Crossing Report

Big Law firms using Harvey aren't just running AI — they're governing it. They have written policies specifying which tasks go to which tools. They have review standards that define who checks AI output before it reaches a client. They're tracking ROI not to satisfy a vendor, but because their managing partners demand proof that the investment is working.

The 10-attorney firm in Indianapolis or the estate planning shop in Charlotte has the same professional responsibility obligations. The same ABA Model Rules apply. The same clients deserve the same level of oversight. What the small firm doesn't have is a governance committee, a Chief Innovation Officer, or a dedicated IT team to build the framework.

Harvey Forum's governance framework solves this — and it translates directly to a firm of any size. Here's what Big Law is now doing, and the one-page version you can implement this week.

---

Why Big Law Is Formalizing AI Governance Now

Harvey is used by hundreds of Am Law firms and tracks more than 18,000 pre-built agent workflows. In mid-2026, Harvey introduced governance and measurement tooling to help legal teams audit AI outputs, track ROI, and document oversight policies at scale.

The reason for the timing is straightforward. AI has moved from experiment to production at the largest firms. Research associates are using it daily. Junior attorneys are using it. Paralegals are using it. Without governance, the result is inconsistent: some partners have documented workflows, others are running ad hoc prompts with no review standard, and the firm has no way to know whether AI is helping or creating liability exposure.

The governance push at large firms is also being driven by two external forces:

ABA Model Rules. Rule 1.1 (competence) now requires attorneys to understand the benefits and risks of technology relevant to representation. Rule 5.3 requires supervising attorneys to ensure that non-attorney work — including AI-assisted work — complies with the rules of professional conduct. These rules don't require you to use AI. They require you to understand it and supervise it if you do.

Client expectations. Large institutional clients are beginning to ask their outside law firms directly: what is your AI governance policy? Enterprise legal departments have their own governance requirements and want to know that sensitive matter work isn't flowing through non-enterprise AI tools without oversight.

For a 5–20 attorney firm, the client pressure may be less formal — but the professional responsibility obligations are identical.

---

The Four Elements of Legal AI Governance

Harvey Forum organizes AI governance around four operational elements. Each one corresponds to a specific risk that a firm has to manage.

1. Written AI Use Policy

A written policy does two things: it creates a record that you have a governance framework (which matters for ABA 5.3 compliance), and it forces clarity about what is and isn't allowed.

At a minimum, the policy should cover:

• Authorized tools. Which AI products are approved for firm use. This should be a specific list, not a category. "ChatGPT, Claude, Harvey" is a policy. "AI tools generally" is not.
• Prohibited inputs. What cannot be entered into non-enterprise tools. At minimum: client names, matter numbers, confidential facts, court filing contents. Enterprise tools with data processing agreements are a separate category — document which tools have signed DPAs.
• Task scope. Which types of work AI can support versus which require full attorney authorship. Research and summarization are typically lower risk. Legal analysis, strategy advice, and court filings are higher risk and require explicit review standards.

For a small firm, this document can be one page. The goal is not exhaustiveness — it's specificity.

2. Workflow Designation (Which Tasks, Which Tools)

A governance policy tells you what's allowed. Workflow designation tells you what actually happens.

Large firms using Harvey build this through formal workflow libraries — the 18,000+ pre-built agents in Harvey's catalog are, in many cases, the output of workflow designation decisions made by those firms' governance teams. Each workflow specifies: the task type, the AI tool, the inputs allowed, and the review step required.

For a 5-attorney firm, this doesn't need to be a library. It needs to be a habit. Before you assign an AI tool to a task type, ask: what are the inputs, what is the output, who reviews it, and what happens if the AI is wrong? Document the answers once. That's your workflow designation.

Common task designations for a small firm:

Task	Tool	Review Required
Case law research summary	Claude or Harvey	Attorney spot-checks 3–5 cited cases
First draft of contract clause	AI drafting tool	Attorney line review before client send
Client intake summary	AI summarization	Paralegal review for accuracy
Discovery document review	AI review tool	Attorney review of flagged documents
Court filing draft	AI drafting	Full attorney authorship review

The table takes 20 minutes to build and eliminates the ambiguity that leads to inconsistent use across the firm.

3. Output Review Standards

The most common AI governance failure in small firms is not using AI — it's using AI without a review standard that matches the risk level of the output.

Harvey Forum distinguishes between three output risk tiers:

• Low-risk outputs (internal summaries, research digests, draft notes): review for factual accuracy before use.
• Medium-risk outputs (first-draft clauses, client correspondence, analysis memos): attorney review and revision before client delivery.
• High-risk outputs (court filings, opinion letters, strategic advice): attorney must be the author of record; AI can assist but the attorney drafts, reviews, and signs.

For ABA 3.3 purposes (candor toward tribunals), anything filed with a court requires attorney authorship and review at a standard that makes the attorney responsible for its accuracy. That standard doesn't change because AI helped draft it.

4. ROI and Measurement Tracking

The fourth element is where most small firms have nothing. According to the Thomson Reuters 2026 AI in Professional Services Report, 82% of professional services firms fly blind on AI ROI — they're using AI without tracking whether it's working. Only 18% track AI ROI formally.

This is a governance failure, not just a measurement failure. If you can't track whether AI is saving time, improving output quality, or changing client outcomes, you have no basis for making deployment decisions — which tools to expand, which to retire, or whether the investment is worth continuing.

Large firms using Harvey have ROI dashboards. A small firm needs a spreadsheet.

---

The Small-Firm Translation: A One-Page Governance Checklist

Here is the Harvey Forum framework translated into what a 5–20 attorney firm can actually implement this week:

Written Policy (30 minutes)

• List authorized AI tools by name
• State prohibited inputs (client names, matter details, confidential facts in non-enterprise tools)
• Define three task tiers: AI-supported, AI-assisted with review, attorney-authored
• Include a single sentence on each: competence obligation, supervision obligation, confidentiality obligation

Workflow Designation (20 minutes)

• List your top 10 recurring task types
• For each: assign tool, define permitted inputs, specify review step
• Share the table with all attorneys and staff who use AI

Output Review Standard (10 minutes)

• Apply the three-tier model (low/medium/high risk)
• Any client-facing output is medium or high by default
• Any court filing is high — attorney reviews every line

ROI Tracking (10 minutes to set up, 5 minutes weekly)

• Create a shared spreadsheet with columns: Date, Task, Tool, Time Before (estimated), Time After, Revision Rounds, Notes
• Ask anyone using AI to log tasks for 60 days
• Review at 30 and 60 days

Total setup time: under 90 minutes. That's your one-page governance framework.

---

How to Measure Whether Your AI Is Working

Firms with a formal AI strategy are 3x more likely to see positive ROI (Thomson Reuters 2026 AI in Professional Services Report). The gap between firms that govern AI and firms that don't isn't just about liability — it's about results.

The three metrics that work for small firms without complex measurement infrastructure:

1. Time redeployed. How long did this task take before AI? How long does it take now? What is the recaptured time being used for? This is the most direct measure of value. A research task that dropped from 4 hours to 45 minutes creates 3.25 hours. The question is whether that time is being used on client work that generates revenue, or absorbed by something else.

2. Output quality change. How many revision rounds does AI-assisted work require compared to prior baseline? Are clients flagging more or fewer issues on AI-assisted deliverables? You can track this informally by noting revision counts in your spreadsheet. A downward trend in revisions is evidence of quality improvement. A flat or upward trend is a signal to recalibrate the review standard.

3. Client response. Are clients reporting satisfaction at the same or higher rate on AI-assisted matters? This is hard to isolate, but a single question in your post-matter review process — "Was the work product clear and actionable?" — will tell you over time whether AI-assisted output is hitting the mark.

These three metrics don't require software. They require 5 minutes of logging per task and a 30-minute monthly review.

The Harvey LAB benchmark provides an external reference point for quality by practice area — if your litigation output is underperforming relative to LAB scores for litigation tasks, that's a signal to review your prompting approach or your tool selection.

---

The Governance-Measurement Connection

The 82% of firms flying blind on AI ROI share a common trait: they don't have a governance framework either. They're running AI ad hoc — different attorneys using different tools for different tasks with no shared standard — and measuring nothing because there's nothing systematic to measure.

The 18% that track ROI are almost exclusively the same firms that have written policies, workflow designation, and output review standards. Governance and measurement are the same function viewed from different angles. Governance defines what you're doing. Measurement tells you whether it's working.

This connection explains the 3x ROI differential. Firms that formalize AI governance aren't just managing liability — they're building the operational discipline that makes AI scale. They know which workflows are saving the most time. They know which tools are underperforming. They know where to invest next.

For a 5-attorney firm, the ROI is also more concentrated. If two attorneys save 6 hours a week on AI-assisted research and drafting, that's 12 hours a week — 600 hours a year — of recaptured capacity. At a $300/hour equivalent rate, that's $180,000 in recovered capacity annually. Whether that translates to more client work, faster turnarounds, or the ability to handle more complex matters without adding staff depends on whether you're governing and measuring the work at all.

The firms that will look back on 2026 as the year they pulled ahead are the ones that didn't just start using AI — they started governing it.

---

Frequently Asked Questions

What is AI governance for a law firm?

AI governance for a law firm is the combination of written policies, workflow rules, output review procedures, and ROI tracking that governs how AI tools are used in the practice. It answers four questions: Which tools are authorized? Which tasks can AI handle? Who reviews AI output before it goes to a client? And how do you know whether AI is actually improving your firm's performance? Even a 5-attorney firm needs a documented answer to all four.

What does Harvey's governance framework require firms to do?

Harvey Forum's governance framework is built around four elements: a written AI use policy, workflow designation (which specific tasks go to which AI tools), output review standards (who checks what before client delivery), and ROI and measurement tracking (how time savings and quality changes are recorded). Large firms using Harvey typically formalize these through internal governance committees. A small firm can implement the same framework with a one-page document and a shared spreadsheet.

How should a small law firm measure AI ROI in 2026?

The three metrics that work for small firms are: (1) time redeployed — tracking how long tasks took before and after AI, and what the recaptured time is used for; (2) output quality change — tracking revision rounds and error rates on AI-assisted work versus prior baseline; and (3) client response — noting whether clients flag issues or request revisions at the same or lower rates. A shared Google Sheet with columns for task, tool, time before, time after, revision count, and notes gives you enough data to evaluate ROI within 60 days.

What's the minimum AI governance policy a 5–20 attorney firm needs?

A minimum viable AI governance policy for a 5–20 attorney firm covers four areas: (1) authorized tools — a specific list of which AI products are approved for firm use; (2) task categories — which types of legal work AI can support versus which require full attorney authorship; (3) review standard — a statement that all AI-assisted work product must be reviewed by a licensed attorney before client delivery; and (4) confidentiality rule — a prohibition on entering client names, matter details, or confidential facts into non-enterprise AI tools. This fits on one page and satisfies ABA Model Rules 1.1 and 5.3.

How does Harvey Forum's governance framework differ from ABA ethics rules?

ABA Model Rules 1.1 (competence) and 3.3 (candor) establish the professional responsibility floor — attorneys must understand the tools they use and cannot make false statements to tribunals. Harvey Forum's governance framework is operational, not ethical. It tells you how to actually run AI at the firm level: which tools for which tasks, how to review, and how to measure. The ABA rules tell you what you're liable for. Harvey Forum tells you how to build the system that keeps you compliant with those rules while actually getting value from AI.

---

The Crossing Report is a weekly newsletter for professional services firm owners navigating AI adoption. One issue every Monday. Subscribe here.