TL;DR When a lawyer leaves, AI work done in the firm's governed tools stays behind. However, AI work done in personal accounts leaves with them, and the agents they set up can keep running with no owner. Firms that can't show how AI was used, by whom and under what rules, can't answer their clients when people walk out. The fix isn't banning AI. It's governing how it's used.
A firm can come apart in weeks. Its AI footprint doesn't.
This Fall, one of Wall Street's most storied firms announced it would wind down after nearly a century. Lawyers moving between firms is the BigLaw business model. What's new is what moves with them: months of AI work on client matters.
Governed AI stays. Shadow AI walks out the door.
When a lawyer does AI work inside the firm's sanctioned tools, the firm keeps it. The history sits in a firm-owned environment, under firm contracts and firm policy. When the lawyer leaves, the work stays where it belongs. That is governance doing its job.
When the same work happens in a personal ChatGPT account, a consumer tool with memory turned on, or an assistant connected to a personal inbox, the picture flips. That history belongs to the individual. It leaves with them. The firm cannot see it, cannot revoke it, and cannot confirm it was ever deleted.
The uncomfortable part is who does this most. Senior partners are the people most likely to route around firm tools, because no one tells them no. They are also the people most likely to move, and to take a book of clients with them.
Ethical screens and conflict checks assume a lawyer's knowledge lives in two places: their head and the firm's files. AI added a third place, and most firms have no record of it.
So whether a departure is a risk is not decided on the day someone resigns. It is decided months earlier, by where the AI work happened.
Who offboards the agent?
People are no longer the only thing that leaves loose ends. Agents are.
A lawyer connects an agent to the document management system to triage a data room. A practice group sets one up to draft first-pass responses on a matter. These agents act on the access someone granted them, or on service accounts tied to a team.
When that lawyer leaves, IT disables their account. That does not necessarily stop what they set in motion. The agent can keep running, still holding access, still touching matter data, with no one left who owns it or remembers it exists.
Offboarding used to mean revoking a person's access. It now also means accounting for everything that person set running on the firm's behalf. In a wind-down, multiply that by every lawyer in the building.
Can you prove the rules were followed?
Clients no longer accept "we have an AI policy." They ask the firm to show them how AI was used on their matter.
That question gets sharper when a lawyer leaves or a firm dissolves. The professional rules already require a firm to account for client matters when an engagement ends. A firm that is going away still owes every client a clear answer.
Shadow AI makes that answer impossible. You can't show the rules held for work done in tools the firm never governed, or for agents no one owns. A written policy proves intent. It doesn't prove behavior.
Proof of governance can't be assembled after the fact. Either the firm enforced its rules at the time, on every AI interaction and every agent action, or it is guessing in front of its clients.
What a governed firm knows before anyone gives notice
The firms that handle departures cleanly will not be the ones with the strictest AI bans. They will be the ones where lawyers use AI freely, inside rules the firm set and enforces. Those firms know three things at all times:
- Where AI work happens. Which tools lawyers use for client work, and whether that use is inside policy.
- What agents do, and for whom. Every agent has an owner, a defined scope, and actions that follow the firm's rules.
- That the rules held. They can show a client how AI was used on their matter, not just that a policy exists.
This is why we built Lumia. Security teams set and enforce policy across employee AI usage and autonomous agents, so AI work happens where the firm can govern it, and every agent action has an owner and a record. When a partner leaves, or a firm faces its hardest week, the answer to the client is already there.
Lawyers will keep moving. Firms will keep merging and, sometimes, closing. The AI work they leave behind should never be the part no one can account for.
