Agentic Redaction Tools and the Shared-Cloud Risk for Law Firms

Redaction is the one litigation workflow where a single missed black bar doesn't just embarrass a firm—it can waive privilege, expose a client's trade secrets to opposing counsel, or trigger a malpractice claim. So when Cooley announced on October 8, 2026 that it is co-developing an agentic AI redaction tool built on Google's Gemini Enterprise, the legal tech press treated it as another entry in the Big Law/Big Tech partnership ledger. It deserves more scrutiny than that. Redaction is arguably the worst possible workflow to route through a vendor's multi-tenant public cloud—and the best possible test case for why infrastructure architecture, not model quality, is about to become the defining governance question in legal AI.

What Cooley Actually Announced

Per reporting from Law.com's Legaltech Rundown, Cooley is building the redaction tool directly with Google, using Gemini Enterprise as the underlying platform. It's described as one of several AI initiatives the firm has running concurrently, part of what the piece frames as a broader wave of Big Law/Big Tech partnerships—a category that now includes Allen & Overy/Shearman's early CoCounsel deployment, PwC and A&O Shearman's work with Harvey, Ashurst's rollout of CoCounsel, and a growing list of firms layering Lexis+ Protege or Legora onto their document workflows.

The strategic logic is obvious: redaction is slow, repetitive, high-volume, and exactly the kind of task agentic AI is supposed to compress from days to hours. An agent that can scan a production set, identify privileged communications, flag PII under state and federal privacy statutes, and propose redactions for attorney sign-off is a genuinely valuable tool. No one disputes that.

What's less discussed is where that agent runs, what it touches to do its job, and who controls the resulting logs. Gemini Enterprise is Google Cloud infrastructure. That means the documents flowing through Cooley's redaction agent—privileged emails, trade secret filings, PII-laden discovery sets—are being indexed, processed, and held within a platform the firm does not own, cannot fully audit in real time, and whose subprocessor chain extends beyond the four corners of the engagement letter.

Why Redaction Is the Wrong Workflow to Outsource to Shared Infrastructure

Every litigation support manager knows the categories of material that pass through a redaction pipeline:

• Attorney-client privileged communications — internal counsel emails, outside counsel memos, litigation strategy discussions
• Work product — case theories, deposition prep, expert witness analysis
• Trade secrets and competitively sensitive business data — pricing models, source code, M&A deal terms
• Regulated PII — SSNs, health records under HIPAA, financial data under GLBA, and increasingly, biometric data under state privacy statutes

This is, bar none, the most concentrated exposure of sensitive material a firm handles outside of the deal room itself. The 2024 ABA Formal Opinion 512 on generative AI explicitly tells lawyers they must understand a tool's data retention, training-use policies, and access controls before feeding it client confidences. That's a reasonable instruction in theory. In practice, verifying exactly how a hyperscaler's enterprise AI stack handles a given document—where it's cached, how long logs persist, which internal Google teams can access diagnostic data, what happens on contract termination—is a materially harder diligence exercise than reviewing a firm-controlled system's access logs.

The stakes aren't hypothetical. IBM's 2024 Cost of a Data Breach Report pegs the global average breach cost at $4.88 million, with professional services among the highest-cost sectors due to the density of regulated and privileged data involved. For a law firm, the downside of a redaction failure isn't just breach cost—it's potential privilege waiver, sanctions exposure, and malpractice liability that follows the matter, not the vendor.

The Architectural Distinction That Actually Matters

The honest framing here isn't "Google sends your data somewhere scary and we never do." Any serious legal AI platform, including a private or on-premise deployment, will at some point call an LLM provider for inference—Gemini, Claude, GPT-class models, or an open-weight model run entirely in-house. The question that actually separates architectures is what has to leave the firm's control to make that call, and what stays behind.

In a shared-cloud agentic stack like Gemini Enterprise, the full document—or a large contextual slice of it—along with the connectors, retrieval index, and conversation history typically lives inside the vendor's environment. The agent's "memory" of a matter, its permission model, and its audit trail are all vendor-hosted artifacts.

In a firm-controlled architecture, the arrangement inverts:

That last row of the "firm-controlled" column is the crux: the agentic scaffolding, connectors, retrieval layer, vector stores, permissions, and logs stay on infrastructure the firm controls—only the minimal retrieved chunks needed to answer a specific question are sent to the selected LLM provider, under API terms the firm negotiates and can swap out. A redaction agent built this way still gets Gemini-quality or Claude-quality reasoning on the chunks it sends out; it just never has to surrender the full matter file, the index, or the logs to get it.

This is the model behind private AI deployment architectures: firms keep the document repository, the agent orchestration layer, and the audit trail in-house, while still being able to call best-in-class models for the actual language reasoning. It's not an anti-cloud position—it's an insistence that the corpus and the control plane belong to the firm, regardless of which model answers a given query.

The Big Law/Big Tech Wave, and What It's Actually Optimizing For

Cooley's Gemini Enterprise deal doesn't exist in isolation. It sits alongside a fast-accumulating list of similar arrangements:

• A&O Shearman and PwC building workflows on Harvey's platform, itself layered on OpenAI and Anthropic models
• Ashurst rolling out Thomson Reuters CoCounsel across its litigation and transactional teams
• Multiple AmLaw firms piloting Lexis+ Protege for research and drafting
• Goodwin, Cleary, and others experimenting with Legora's workspace-native agents
• A growing cohort testing Anthropic's Claude Cowork for cross-document agentic tasks

Every one of these deals optimizes for the same variable: speed to capability. Partnering with a hyperscaler or a well-funded legal AI vendor gets a firm a working agentic product in months rather than the year-plus it might take to stand up equivalent infrastructure internally. That's a legitimate business calculation for low-sensitivity workflows—contract summarization, legal research, first-pass drafting.

Redaction is not a low-sensitivity workflow. It's arguably the single matter-stage with the highest ratio of privileged-material density to tool autonomy: an agentic system making judgment calls, at scale, across the most sensitive documents in the file. Our internal analysis of adoption patterns across AmLaw 200 firms (see the 98% adoption gap data) shows that firms are far more willing to green-light shared-cloud tools for research and drafting than they are to admit, publicly, how those same tools are being used on privileged discovery material. The Cooley deal is notable precisely because it's one of the first to say the quiet part out loud: agentic redaction, built on a public cloud stack, announced as a flagship initiative.

The Governance Questions GCs Should Be Asking Right Now

If your firm is evaluating—or already running—an agentic redaction tool on a hyperscaler's enterprise AI platform, the diligence checklist looks different from a standard SaaS procurement review:

1. Does the vendor's DPA explicitly prohibit model training on client documents, and is that commitment contractually enforceable, not just a policy statement?
2. Where does the full document reside during processing—cached in region, replicated across availability zones, or retained post-session?
3. Who controls the audit log—can the firm export complete, tamper-evident logs of every agent action for privilege-log purposes, or does the vendor retain custody?
4. What is the subprocessor chain—does the hyperscaler's enterprise AI product depend on third-party components the firm hasn't separately vetted?
5. What happens to indexed data on contract termination, and can the firm verify deletion rather than take it on faith?
6. Does the ethical wall logic in the agent match the firm's existing conflict-screening infrastructure, or is it a separate, parallel permission system the vendor maintains?

These aren't theoretical concerns. The litigation history around privilege waiver through inadvertent disclosure—the kind of fact pattern courts have wrestled with for decades, well before generative AI entered the picture—shows how unforgiving courts can be when a firm can't fully explain its own document-handling chain. Layering an opaque, vendor-hosted agentic system onto that chain doesn't reduce the risk; it adds a new point of failure the firm didn't build and can't fully inspect.

Where This Leaves Firms Evaluating Agentic Redaction

The capability itself isn't in question. Agentic redaction that can process a 50,000-document production set, flag privilege candidates, and surface PII for attorney review is a genuine productivity unlock, and firms that ignore it will fall behind on cost-per-document economics. The question is architectural, not whether to adopt.

Firms have three real paths: build on a hyperscaler's enterprise AI product and accept the shared-infrastructure trade-offs Cooley just made public; adopt a per-seat SaaS redaction tool and accept similar multi-tenant exposure at smaller scale; or deploy the agentic layer—retrieval, indexing, permissions, logging—on infrastructure the firm controls, calling out to an LLM provider only for the minimal reasoning step. That third path is where platforms purpose-built for firm-controlled deployment, including the kind of architecture underlying case search and redaction workflows at RAGbase Legal, are positioned: full corpus and control plane on the firm's side of the line, model calls minimized and contractually scoped.

If your firm is weighing an agentic redaction build against your existing DMS and conflict-screening infrastructure, start by mapping exactly which layer—corpus, index, agent, or model—would move to a vendor's cloud under each option on the table, and what that means the next time a privilege challenge lands on your docket. The AI for law firms guide walks through that evaluation framework in more detail, including how to structure a pilot that tests capability without pre-committing your most sensitive document workflows to infrastructure you don't control.