GRAIL · Function papers
What does an AI-augmented legal and compliance department look like?
By Johan Grönstedt · Last reviewed
The system watches the portfolio. People decide what the company will accept. A nine-page position paper, free.
Legal coverage becomes continuous, while approved judgment becomes an operating asset the whole company can use. The system watches the portfolio and prepares the work before a request arrives. The decision stays with the person.
The operating rhythm
A day in The legal function's 2028 month
Intake
Contract requests arrive from CRM, procurement or an employee portal.
Events
Renewal, notice and performance obligations update from the contract repository.
Decisions
The legal head spends substantive time on negotiation strategy.
Weekly
The function reviews a short exception briefing.
Monthly
People reconcile the proposed obligation map with the control register.
The division of work
What runs, and what stays with the person
The agent layer prepares the work that depends on reading, comparison, evidence gathering and draft preparation. It identifies agreement types, compares language with the playbook, explains deviations and proposes tracked changes. For contract lifecycle work, it extracts parties, dates, notice rules, prices and obligations, maintains the register, prepares owner briefings and recommends renewal or termination steps. For privacy work, it pre-populates assessments, finds missing facts, maps risks to prior controls and locates candidate records for a request. For regulatory monitoring, it monitors approved official sources, summarizes cited changes, proposes obligation mappings and drafts affected policy sections.
The same preparation pattern extends across controls, incidents, disputes, external counsel and corporate governance. The agent layer gathers evidence, flags missing or inconsistent support, preserves an original report, prepares summaries and chronologies, checks deadlines and tracks remediation. It deduplicates documents, proposes relevance categories, compares claims with policy language, prepares matter instructions, compares invoices with billing rules and drafts director briefs and minutes.
The authority remains named and human. People accept risk, approve departures, notices, commitments and commercial action, decide whether a regulatory change applies, challenge the business owner and judge whether evidence is sufficient. Control owners explain exceptions, while compliance and internal audit close findings. Named investigators decide credibility, scope, interviews, findings and employment consequences. Lawyers validate samples and privilege calls. Counsel selection, acceptance of advice, board judgment, final minutes, privacy conclusions, coverage, settlement and litigation strategy remain human decisions.
| Process | What the agent layer does | What stays with the person |
|---|---|---|
| Contract drafting, review and negotiation | Identifies the agreement type, compares language with the playbook, explains deviations, proposes tracked changes and drafts the negotiation brief. | Acceptable risk, commercial context, material negotiation and approval of departures. |
| Contract lifecycle and obligations | Extracts parties, dates, notice rules, prices and obligations; maintains the register; prepares owner briefings and recommends renewal or termination steps. | Approval of notices, commitments and commercial action. |
| Privacy and data protection | Pre-populates assessments, finds missing facts, maps risks to prior controls and locates candidate records for a request. | The DPO challenges the business owner; people verify identity, scope, exemptions, redactions and the conclusion. |
| Regulatory monitoring and policy management | Monitors approved official sources, summarizes cited changes, proposes obligation mappings and drafts affected policy sections. | Counsel decides applicability; policy owners approve changes and assigned actions. |
| Internal controls and audit support | Prepares test plans, gathers evidence and flags missing or inconsistent support across connected records. | Control owners explain exceptions; compliance and internal audit judge sufficiency and close findings. |
The position
Six things GRAIL believes
The queue is the symptom. Late visibility is the problem.
A faster first draft helps after a matter has reached Legal.
The playbook is not a document. It is the function's memory.
Approved positions, exceptions and reasoning have to return to a maintained context layer.
Abundant first-pass work raises the value of scarce judgment.
Reading, comparison, evidence gathering and draft preparation can cover far more of the portfolio.
An obligation only matters when it reaches an owner and a control.
Regulatory summaries are easy to produce and easy to ignore.
Augment the judgment. Never automate the authority.
Contract acceptance, external legal communications, investigation findings, privacy disclosures, legal advice, coverage and settlement decisions stay with named people.
Legal leadership becomes the designer of decision systems.
The in-house lawyer remains senior risk counselor, but also owns how approved judgment travels through work.
Get the paper
Read the full position paper on continuous coverage, maintained legal memory and the decisions that stay with people across the legal and compliance portfolio. See how a company can preserve its reasoning and bring human judgment to the point where it matters.