By Sophie Lindqvist

Only 26% of legal leaders feel confident that their firms' information is ready for AI analysis. That's the headline from a Morae survey of 850 senior legal professionals, published in October 2026.

The same survey found just 37% can say where all their legal information lives. Only 30% trust that the material is properly classified as confidential or sensitive.

Kurt Thies, global head of Information Governance Strategy at Morae, framed the gap this way: "We've always known that organizations don't have confidence in their information. But the consequence of that now has hit a whole new level."

What Is "ROT," and Why Does It Trip Up AI?

Information-governance professionals use the acronym ROT for redundant, obsolete, and trivial data — duplicate files, expired agreements, and stray notes that accumulate inside any large organization.

Before generative AI (software that produces written answers, summaries, and drafts on demand), lawyers filtered the mess by hand. They opened the document management system, pulled up five versions of a contract, and judged which was final.

Now, AI pulls every version at once. It blends them into one polished answer. Most systems do not show their work or flag the disorder underneath.

"AI doesn't inherently know which information is authoritative, current, or appropriate," Thies said. "But it is utilizing it in its outcome."

Where Does Bad Data Create Real Risk?

Bad hygiene produces bad answers — and bad exposure.

Only 30% of legal leaders feel their data is properly tagged for sensitivity. AI tools cannot close that gap on their own. They surface personally identifiable information (data that can identify a specific person, such as a Social Security or passport number) or privileged records to anyone with system access.

"Not all data is equal," Thies said. "You have certain information that is high risk, high obligation."

He sketched a typical scenario: HR files sit on a shared drive. One employee uses the folder. The arrangement felt safe. The moment an AI tool gains access, the guardrail disappears, and a generic query may pull Social Security numbers or health records into view.

What Does the Survey Say About Trust in AI Output?

Trust has not kept pace with spending. Only 33% of senior legal professionals say they trust the results of AI-assisted legal work. Meanwhile, 67% worry that human-verification costs are swallowing the productivity gains.

The numbers point to a tough trade-off. Firms pour money into AI tools, then pay lawyers to double-check every output. The savings shrink fast, and the review queue grows.

How Should Firms Treat Information Governance Now?

Thies pushed back on the idea that governance slows innovation. He framed it as a precondition for safe scaling, not a brake.

"AI lacks the organizational context unless it is given parameters through the governance of that information," he said. "Here's where we keep our official records. This is what you can rely upon. This is where we'll point our LLMs."

He pointed to four practical moves firms can make before they scale AI further:

• Map the repositories — the document management system, inboxes, SharePoint sites, and business apps that hold legal material.
• Audit the ROT layer — decide what is duplicate, expired, or trivial, and dispose of it under the retention policy (a written rule for how long records must be kept).
• Classify by sensitivity — tag confidential, regulated, and privileged records with access rules an AI can read.
• Point the model at curated stores — restrict any LLM (large language model) to authoritative repositories, not the entire file estate.

What Does This Mean for Practitioners?

The practical consequence is sharp. Firms that skip governance will keep paying lawyers to verify every AI output. The hidden cost is data exposure — AI can surface records the firm never intended to share, which can mean a privacy incident or a breach of professional duty.

Thies said the industry can reach reliable AI adoption, but only by fixing information first. "The industry can get there, but only by confronting the condition of its information first," he said. "Right now, we know we're not there yet."