AI Agents Are Coming for 30% of Legal Work — Data Sovereignty Can't Wait

Deloitte Legal's projection, published in mid-2025, carries a number that should be stapled to the agenda of every firm governance committee meeting this quarter: AI agents could autonomously handle 30% of in-house legal work within three to five years. Deloitte framed this around corporate legal departments, but the operational logic maps directly onto law firm practice groups. M&A due diligence. Contract review. Litigation document prep. Regulatory filings. These are not fringe workflows — they are the billable core of every AmLaw 200 firm.

The instinct of most managing partners and CIOs, upon reading that number, is to ask a product question: Which agent platform should we pilot? That is the wrong first question. The right question is: When an autonomous agent is independently reviewing a target company's data room at 2 a.m., which servers is it thinking on? Because the answer to that question determines your privilege exposure, your regulatory posture, and your malpractice surface — not the agent's accuracy score on a benchmark.

The Governance Blindspot Built Into the 30% Projection

The Deloitte figure is arresting precisely because of the word autonomously. An AI assistant that surfaces a relevant clause for a lawyer to review is a productivity tool. An AI agent that independently executes a multi-step due diligence workflow — pulling documents from a data room, cross-referencing regulatory filings, flagging representations against a precedent database, and drafting a risk memo — is something categorically different. It is making sequential decisions, invoking tools, and processing privileged client information across dozens of intermediate steps, largely without human review of each step.

That reduction in human-in-the-loop oversight is precisely what makes agents valuable. It is also precisely what makes the data infrastructure question urgent in a way that conventional AI assistants never forced.

Consider what a single agentic due diligence workflow actually touches:

• The target company's confidential financial statements
• Privileged deal strategy memos from the client
• Third-party legal opinions
• Draft representations and warranties
• Prior M&A transaction documents from the firm's own precedent library
• Real-time communications between deal team members

Under a conventional cloud SaaS architecture, every one of those document types is being ingested, chunked, embedded, and queried on infrastructure the firm does not control. The vendor's contract says the data is not used for training. It does not say — because it cannot say — that the data never traverses a multi-tenant environment, that subprocessors in multiple jurisdictions are not involved, or that a future acquisition of the vendor won't change the data handling terms retroactively.

What the Ethics Opinions Actually Say

Bar regulators have not waited for agents to become mainstream before staking out positions. The trajectory across major jurisdictions is consistent and increasingly specific.

New York Formal Opinion 2024-1 reaffirmed that lawyers must exercise competent supervision over AI tools and that confidentiality obligations under Rule 1.6 attach to the infrastructure layer, not just the output layer. Specifically, the opinion requires lawyers to understand where data is stored and processed — vendor assurances alone are insufficient.

California Practical Guidance on AI (2024) requires firms to conduct due diligence on AI vendors' data handling practices, including subprocessor chains, and to assess whether use of a particular tool is consistent with the duty of confidentiality. The California guidance is notably explicit that the duty applies to training data exposure risk — not only to data breach scenarios.

Florida Bar Ethics Opinion 24-1 similarly requires informed client consent before transmitting confidential information to AI systems that operate on third-party infrastructure where the firm cannot independently verify data handling.

None of these opinions categorically prohibit cloud-based AI tools. What they do, collectively, is place the burden of due diligence squarely on the firm — and that burden compounds exponentially when the system operating on client data is an autonomous agent rather than a supervised assistant. The more autonomous the system, the less able the supervising attorney is to reconstruct what data was processed, when, and how — which is precisely the audit trail regulators will demand when something goes wrong.

The Privilege Waiver Risk Is Not Theoretical

In In re Grand Jury Subpoena (3d Cir. 2012) and its progeny, courts have consistently held that voluntary disclosure of privileged material to third parties — including inadvertent disclosure through inadequate security measures — can operate as waiver. The question courts ask is whether the holder of the privilege took reasonable precautions. Routing a privileged deal strategy memo through a multi-tenant SaaS platform operating on shared cloud infrastructure is a fact pattern that a capable opposing counsel or regulator could construct into a waiver argument. It has not happened at scale yet because agentic workflows have not operated at scale yet. Both of those facts are about to change simultaneously.

Where Today's Dominant Platforms Stand

The major cloud-based legal AI platforms — Harvey, CoCounsel, Lexis+ Protege, and Legora — have each invested heavily in enterprise security certifications (SOC 2 Type II, ISO 27001) and offer data processing agreements that include meaningful protections. These are not reckless products. For many use cases, particularly research tasks involving non-confidential or publicly available legal materials, they are genuinely excellent.

But the architectural reality of each is the same: the agentic scaffolding, the retrieval indexes, the vector embeddings of client documents, and the workflow orchestration all run on infrastructure outside the firm's control. When a Harvey agent or a CoCounsel workflow processes a client's litigation strategy documents, those documents — in whole or in chunked form — are processed on servers the firm does not own, managed by a company that may have its own subprocessor dependencies.

This is not a vendor criticism. It is an architectural description with real governance implications:

The honest framing here is not that cloud platforms are reckless or that RAGbase Legal never transmits any data externally. The distinction is architectural and meaningful: with a private deployment model, the entire agent layer — connectors, retrieval indexes, vector stores, permissions enforcement, full documents, and workflow logs — stays on firm infrastructure. What may leave the perimeter is only the minimal retrieved chunk needed to answer a specific query, transmitted to a LLM provider under API terms the firm has independently reviewed and accepted. The full corpus never moves. The agent's reasoning process never executes on third-party servers.

For many routine research workflows, cloud SaaS tools are a reasonable choice. For agentic workflows touching privileged deal documents, litigation strategy, or regulatory submissions — the workloads Deloitte is projecting will represent 30% of all legal work — the architectural difference is not a preference. It is a governance requirement.

The TCO Case Is Stronger Than Most Firms Have Modeled

Firms that have dismissed private deployment as prohibitively expensive are working from models that are several hardware generations out of date. The economics have shifted materially in the past 18 months, driven by three forces: the dramatic reduction in GPU inference costs, the emergence of genuinely capable smaller models that run efficiently on firm-owned hardware, and the per-seat SaaS pricing that compounds aggressively at AmLaw 200 headcount.

Consider a representative firm with 600 active legal AI users:

These are illustrative ranges, not guarantees — actual costs vary significantly based on hardware choices, model selection, and internal IT capacity. But the directional finding is consistent with what firms that have completed serious build-vs-buy analyses are reporting: the per-seat SaaS model scales linearly with headcount; private deployment costs are largely fixed and amortize across the user base. The crossover point, for most AmLaw 200 firms, falls somewhere between 150 and 250 active users. At 600 users and a 30% agentic workload, the economics are not close.

The TCO case also does not capture a category of cost that is genuinely difficult to quantify: the cost of a privilege waiver on a major transaction, a bar complaint requiring a regulatory response, or a client that declines to share sensitive deal documents because they are uncomfortable with the firm's AI infrastructure disclosures. These are tail risks, but they are not low-probability tail risks at the scale of agentic deployment Deloitte is projecting.

What Private Agent Architecture Actually Looks Like

For managing partners and CIOs evaluating this question operationally, the architecture of a sovereignty-preserving agentic deployment is worth understanding concretely. A genuinely private AI deployment for an AmLaw 200 firm running agentic workflows involves several distinct layers, all of which need to remain on firm infrastructure to achieve meaningful governance:

The agent orchestration layer — the logic that determines what steps the agent takes, which tools it invokes, and how it sequences a multi-step workflow. If this runs on a vendor's cloud, the vendor has visibility into every step of the agent's reasoning process, including what documents it retrieved and what intermediate conclusions it reached.

The retrieval and indexing layer — the vector database that embeds client documents, the chunking logic, and the retrieval ranking. This layer contains, in effect, a compressed semantic representation of every document the firm has indexed. Keeping this on firm infrastructure means the firm's knowledge base never materializes in a form accessible to a third party.

The permissions and access control layer — the logic that determines which agent, running on behalf of which matter, can access which documents. In a multi-matter firm environment, this is critical: an agent working a litigation matter should not be able to retrieve documents from a concurrent M&A matter involving a counterparty. This logic needs to be under firm control to be auditable.

The full document store — the source documents themselves, in their complete form. Cloud SaaS platforms necessarily hold these documents on vendor infrastructure to perform retrieval. In a private deployment, they remain in the firm's document management system, with the retrieval layer running against them locally.

The audit log — the complete record of every query, every retrieval, every agent action, and every LLM call. For both ethics compliance and malpractice defense, this log is potentially the most important artifact in an AI governance program. It should live on firm infrastructure, exportable on demand, and not subject to a vendor's data retention policies.

For case search and research workflows specifically, the same architecture enables a firm to build and query against its own matter history — a proprietary competitive advantage — without that matter history ever being exposed to a third-party inference environment.

The Governance Questions Every Firm Should Answer Before Expanding Agentic Deployment

The Deloitte 30% projection is not a ceiling — it is a directional forecast that will accelerate as models improve and agent frameworks mature. Firms that wait for the governance questions to be fully resolved before deploying will cede competitive ground. Firms that deploy at scale without resolving the governance questions are accumulating a liability that will eventually manifest.

The productive path is to build a governance framework now that can accommodate expanding agentic deployment without requiring architectural reconstruction later. The questions that framework needs to answer:

1. Which matter types and document classifications will be permitted to flow through agentic workflows? Not all work is equally sensitive. A policy that permits cloud-based agentic workflows for research on public legal materials but requires private deployment for documents containing client confidences is a defensible and practical position.

2. What does your audit trail actually cover? If you cannot produce a complete record of what your AI agent retrieved, processed, and transmitted for a specific matter on a specific date, you are not in a position to respond to a bar inquiry or a client audit request.

3. Have you reviewed your vendors' subprocessor lists? The DPA with your primary AI vendor is not the complete picture. The subprocessors that vendor relies on for inference, storage, and operations are also touching your data. This chain is rarely short.

4. What is your client disclosure obligation? Increasingly, sophisticated clients — particularly financial institutions and public companies — are asking law firms to disclose their AI infrastructure in RFPs and engagement letters. The answer "we use a major enterprise AI platform" is no longer sufficient for many clients.

5. Does your malpractice carrier know what you're doing? Malpractice insurers are beginning to ask questions about AI deployment in renewal applications. Firms that have not briefed their carriers on agentic AI deployment may find coverage exclusions they did not anticipate.

For a deeper foundation on building a sustainable AI program, the AI for law firms guide covers the governance and procurement dimensions in detail.

Deloitte's 30% projection will not look surprising in retrospect. What will look surprising — and potentially negligent — is that many firms expanded agentic AI deployment rapidly while treating data infrastructure as a vendor selection question rather than a governance question. The firms that will be in the strongest position in three to five years are the ones that recognize now that autonomous agents change the risk calculus fundamentally: more autonomy means more data processed without human review, which means the architecture itself becomes the control, not the human in the loop. If your architecture is not under your control, neither is your risk.