Last updated: October 2026 · Reading time: about 7 minutes
What this post covers
The gap in the hard-stops framing
Our guide to how agentic AI is changing plaintiff law firm workflows argued that firms deploying agents need hard human checkpoints — before matter creation, before any deadline is set, before any external communication, before any filing, before any case decline.
That framing is correct as far as it goes. But it answers a technical question: where does the workflow stop?
It doesn't answer the question that matters when the agent does something wrong within those stops. Who is responsible for what happens next? Whose name is on the supervision record when the bar asks? Who gets the call at 9pm when the agent has just sent something it shouldn't have?
In software terms, the firm has configured the guardrails. It has not assigned an owner. Those are different things, and the second one is what ABA Formal Opinion 512 actually requires.
Why ABA 512 makes this a supervision question
ABA Formal Opinion 512 addresses lawyers' use of generative AI and sets out duties around competence, confidentiality, communication, and fees. For agentic tools — systems that take actions rather than produce text — the duty that bites hardest is supervision.
The supervision duty in the Model Rules applies to non-lawyer assistants. A software agent acting on the firm's behalf, sending communications, setting deadlines, creating records, falls within the same logic: the firm is responsible for what the agent does, in the same way it is responsible for what a paralegal does.
Which is fine as a principle. The problem is that "the firm" is not a person, and the supervision duty requires a person. Firms that answer "our attorneys review the output" have not satisfied the duty — they have restated it. The duty requires that a specific, named human is accountable for what the agent does, has the authority to stop it, and can show they checked.
That is not a compliance formality. It is the difference between a firm that can answer a challenge ("Ms Chen owns this agent; here is the register entry and her last review") and a firm that cannot.
What "owner" actually means
An owner is not a reviewer. A reviewer checks output after the fact. An owner is accountable for the agent's behaviour as if they had taken the actions themselves.
In practical terms, an owner does five things:
- Approves the agent's scope. What it is allowed to do without human confirmation, and what it must stop for. This is a written decision, not a default configuration.
- Owns the failure mode. If the agent sends a client communication it shouldn't have, the owner is the person who answers internally, not the vendor and not "IT."
- Reviews on a schedule. Monthly at minimum for agents in active use. Review means checking what the agent did, not just that it is still running.
- Has the authority to pause. The off-switch belongs to the owner, not to whoever administers the platform account. If pausing requires a support ticket, the owner does not really own the agent.
- Is named in the register. There is no ownership if there is no name on the record. "Attorney oversight" is not a designation — "Sarah Chen, supervising partner, PI group" is.
For firms evaluating which platform to use, the ownership model is a criterion. A platform where the off-switch sits inside the tool and can be operated by a partner — not a support engineer — is fundamentally different from one where it can't. Our comparison of Clio, Filevine and Litify covers how configurable each platform's action controls are.
The agent register
The practical structure that makes ownership real is a single document — the agent register — listing every agent in production with its scope, its owner, and its last review date. Nothing more complicated than that, but kept up to date.
The register is what a firm shows a bar auditor, an insurer, or a judge if the agent's behaviour is challenged. It is the difference between an answer and a shrug.
What every entry in the agent register must contain
- Agent name and vendor — what it is, who supplies it
- Named owner — a person, with their role, not a team
- Scope of permitted actions — the specific list of what it can do without human confirmation
- Hard stops — what it must always stop for, listed explicitly
- Data it touches — including whether any of it is PHI (and if so, the BAA reference)
- Off-switch procedure — how the owner pauses it, in writing
- Last review date — and what the review found
- Next review date — monthly or as agreed
- Approval record — who approved the original scope, and when
Nine fields. One row per agent. That's the whole structure.
The register works because it forces the two questions that firms skip: who owns this and what is it allowed to do. Both have to be answered in writing before an agent is deployed, and both are reviewed on a schedule. Firms that fill out nine fields per agent have done more AI governance than most firms with a 40-page AI policy document and no register.
The data field matters more than it looks. Any agent touching medical records brings HIPAA obligations — a BAA, a SOC 2 Type II report, a subprocessor list. Those are covered in our guide to HIPAA and SOC 2 compliance for legal AI tools. The register should reference that evidence rather than duplicate it.
What counts as "leaving the building"
One threshold that matters more than any other in the register is whether the agent can act outside the firm. Internal actions are recoverable — you can undo a task assignment, correct a case record, reverse a deadline. External actions usually are not: a client email, a letter to an insurer, a filing, an intake response all leave the building, and once they do the firm cannot recall them.
The distinction is not "internal vs external agent." Most agents do both. The distinction is per action: does this specific action leave the building? Every action on the register's scope list should be tagged one way or the other, because the hard stops required are different for each.
| Action type | Recoverable? | Hard stop required |
|---|---|---|
| Create or update an internal matter record | Yes — reversible | Owner review within 24 hours |
| Assign a task or set a reminder | Yes — reversible | Weekly owner sample check |
| Set a legal deadline | No — a wrong date propagates | Owner confirms before it is stored |
| Send an internal message to staff | Yes — retractable | Weekly owner sample check |
| Send an external communication | No — cannot be recalled | Owner approves every send |
| File any document with a court | No | Owner signs off; no automated filing |
| Decline or close a case | No — lost client | Owner approval only |
The pattern is that recoverable actions can be sampled; unrecoverable actions must be approved. That's a simpler rule than it sounds, and it scales. A firm with 15 agents in production can apply it consistently if the register has tagged each action.
How to implement it this month
The register is the kind of thing firms plan to do and then don't. Five steps to actually finish it:
- List every agent in production right now. This includes tools the firm thinks of as "AI features" rather than agents — the draft-letter tool, the intake chatbot, the deadline extractor in the case management platform. If it can act without a click, it goes on the list.
- Assign a name to each one. Not a team. Not a department. A person with a role. If no single person is willing to own the agent, that is a signal the firm should not be running it.
- Write down the scope for each. What can it do without confirmation, what must it stop for. Use the recoverable/unrecoverable rule above to decide.
- Set a review date. Monthly for anything making external actions; quarterly for internal-only. Put it in a calendar owned by the named owner.
- Keep it somewhere the firm can find it. A shared document is fine. A system nobody has access to is not a register.
Frequently asked questions
Does ABA Formal Opinion 512 require a named owner for AI agents?
The opinion does not use the phrase "named owner," but its supervision duty requires that a specific attorney be accountable for AI-assisted work. "Attorney oversight" as a generic phrase does not satisfy that duty; a named person does.
What is an agent register?
A single document listing every AI agent in production with nine fields: agent name, vendor, named owner, scope of permitted actions, hard stops, data touched, off-switch procedure, last review date, and approval record. It is the practical evidence that a firm is supervising its agents.
How often should agents be reviewed?
Monthly for any agent making external actions — client communications, filings, insurer correspondence. Quarterly is generally sufficient for internal-only agents. The review should check what the agent actually did, not just that it is still running.
Does "leaving the building" mean literally external communications only?
No — it means any action the firm cannot fully reverse. External communications and filings obviously qualify. So does setting a legal deadline, because a wrong date propagates even if the action itself looks internal.
What if the vendor's off-switch requires a support ticket?
Then the named owner does not actually own the agent — the vendor does. This is a legitimate evaluation criterion when choosing platforms, and worth raising in any vendor discussion before signing.
Can a paralegal be the named owner?
Not of the supervision duty, which belongs to an attorney. A paralegal can be the operational owner — the person who runs the agent day to day and escalates issues — but the supervising attorney is the one named in the register as accountable.
Does the register need to be produced in litigation?
It may be discoverable if the agent's behaviour is at issue, which is another reason to keep it accurate. A clean register supports the work-product argument; an inaccurate one undermines it.
What about agents inside the case management platform?
They count. A deadline extractor or demand-drafting feature inside Clio, Filevine or Litify can act without a click in many configurations, which makes it an agent for the purposes of the register. The register entry should reference the platform's own audit log rather than duplicate it.
Related reading on Dedon Tech: how agentic AI is changing plaintiff law firm workflows · HIPAA and SOC 2 compliance for legal AI tools · Clio vs Filevine vs Litify · Legal AI Vendor Compliance Checklist · full site map
0 Comments: