“When we first started out, the outside counsel guidelines — that process to intake, review, negotiate, store, and then be able to identify quickly what each client requires — was all manual.”
— Bonnie Kennedy, Director of Information Governance, Fisher Phillips
Manual content workflows are the reality many law firms still face. Outside counsel guidelines arrive through email, requirements get pulled into spreadsheets, and the knowledge created during review often disappears into disconnected systems.
I spent nine years as a lawyer in private practice before joining Box, and I now spend much of my time talking with firms about how legal work actually moves. The pattern is consistent: law firms might have the AI ambition, but they lack the governed content foundation AI needs to work safely and reliably.
Law firms are, by a wide margin, the most content-intensive organizations in professional services. Every matter, every client relationship, every piece of firm administration runs on documents and produces more of them. This is precisely the kind of environment where AI should deliver its most substantial value: large volumes of rich, domain-specific content. By rights, law firms should be getting more out of AI than almost any other sector.
Most aren’t, and the reason has nothing to do with AI technology.
The business of law is content — and that’s precisely the problem
The documents a law firm produces are not incidental to its work. They are its work. Court pleadings, NDAs, pitch decks, client correspondence, witness statements, closing binders, engagement letters, due diligence packages, legal briefs, vendor agreements, practice notes, precedents — the volume is significant and constantly growing.
Law firms are extremely good at producing content. The problem is what happens to content once it exists: where it lives, how it’s organized, who can find it, and whether the systems managing it were ever designed to support anything more than storage and retrieval.
Most weren’t. Firms often still rely on infrastructure built for a different era: shared drives, email threads, FTP sites, a collection of point solutions accumulated over the years. These systems were designed to store files, not create a foundation for AI.
Three ways the pain shows up
The gap between where firms’ content lives and where it needs to be shows up in three specific, recognizable ways.
- Fragmented client collaboration: Clients, co-counsel, opposing counsel, regulators — firms are sharing sensitive matter content through email attachments, FTP portals, and disconnected point solutions. Each creates its own version control problem and its own governance gap. When something goes wrong, like the wrong version is sent or an expired link remains accessible, it’s often too late to do anything about it.
- Manual matter reviews: Attorneys and legal ops teams review documents one at a time because there’s no structured way to extract and compare key information at scale. Every outside counsel guideline (OCG) intake, every vendor contract review, every due diligence exercise resets to zero. The knowledge generated in that process largely disappears into an email thread.
- AI disconnected from governed content: This is the newest failure mode and, in many respects, the sharpest one. Firms are deploying AI tools, but those tools are either operating on unclassified, ungoverned content (which produces unreliable results) or they’re entirely disconnected from the documents that matter most: the confidential, privileged, and PII-laden files where real value lives.
Bonnie Kennedy’s experience at Fisher Phillips illustrates how easy it is to arrive at this realization from an unexpected direction. She came to the problem through a narrow DLP brief — a cloud storage security project. It was only when she looked more broadly that the infrastructure gap came into focus and Box appeared as the solution:
“I had no idea that Box had this whole other alter ego behind just transferring documents.”
That moment — recognizing that document infrastructure could be the foundation for something more significant than file transfer — is one I hear from IT, legal and legal ops leaders regularly. The question is what to do with it.
Why adding AI to a broken foundation makes things worse
The instinct when facing slow, manual document workflows is to reach for an AI tool: buy a contract-review product, subscribe to a summarization service, point it at the documents and expect efficiency gains. Understandable, but in most cases the wrong sequence.
When content is scattered across disconnected systems that are unclassified and ungoverned, the AI tool finds the wrong things, misses the right things, and operates outside the firm’s control.
AI surfaces answers from the content it can reach. When that content is scattered across disconnected systems that are unclassified and ungoverned, the AI tool finds the wrong things, misses the right things, and operates outside the firm’s control. The inefficiency doesn’t go away, it just moves.
Worse, for law firms specifically, ungoverned AI introduces risks the profession takes seriously: privilege waiver, PII handling failures, and audit gaps that would be difficult to defend. This is not hypothetical. As an information governance leader actively evaluating the market, Bonnie describes the situation plainly:
“I'm working with so many AI platforms right now that the governance is still being kind of developed.”
Many AI platforms are adding governance after the fact — bolted onto products built primarily for speed. For law firms, that sequence is backwards.
The question worth asking first is not which AI tool to deploy, but whether the content foundation beneath it is ready.
What a foundation that works actually looks like
The firms making real progress on AI adoption share a common approach. Rather than adding AI tools on top of fragmented infrastructure, they build a content foundation first — one that centralizes, governs, and activates the documents that legal work depends on.
Centralize. Matter content, client collaboration, and operational workflows need to live in one governed environment, rather than across a dozen disconnected systems. Not because consolidation is an end in itself, but because AI cannot work across silos — and neither, effectively, can the people who need to find things under time pressure.
Govern. Classification, access controls, malware detection, auto-expiring links, watermarking, retention and disposition — these need to be built into the content layer, not configured separately for each tool. Governance that lives at the platform level is inherited by every workflow that runs on it.
Activate. Once content is centralized and governed, AI can be applied directly to it — in a permission-aware way that respects existing access controls, without creating ungoverned copies or shadow systems elsewhere.
Stronger OCG management so knowledge doesn’t disappear
OCG management is a useful example of how this plays out in practice. Every law firm has OCGs; almost none have a good system for managing them. The current reality at most firms looks something like this:
- A new client OCG arrives via email
- Someone reads through it manually and extracts billing rules, AI restrictions, and data residency requirements into a spreadsheet
- That spreadsheet gets shared with relevant partners, and within months is out of date
With Intelligent Content Management in place, that process changes substantially. The OCG is submitted through a structured intake form, routed automatically to the correct location, and processed by an extraction agent that pulls key terms directly into structured, searchable metadata.
Instead of a static spreadsheet passed around, the firm has a live dashboard across all client OCGs — filterable by billing requirements, AI restrictions, data residency, or any other criteria that matters. When a new OCG includes AI restrictions, it surfaces automatically in the relevant compliance view. The knowledge no longer disappears.
Watch the keynote to see how Box brings this together into the leading Intelligent Content Management platform — where many of the world’s leading law firms already work.
Fisher Phillips: From a DLP brief to intelligent workflows
Bonnie Kennedy came to Box looking for help with a specific, bounded problem: cloud storage security. What she found was something broader.
“As I learned more about the offerings for Box, I realized there was a huge opportunity to streamline some very manual processes and make them automatic — not just for information governance, security and IT, but for our general counsel.”
The OCG workflow was the first major project. A process that had been entirely manual — intake, review, negotiation, storage, and real-time identification of client requirements — is now automated end to end.
The anticipated impact is faster OCG review, meaningful time savings from eliminating manual review across multiple systems, a consolidated view that streamlines the entire process, and improved client relationships from reduced back-and-forth friction.
What will make the difference, in Bonnie’s account, is not just the automation capability but the governance underneath it:
“One of the nice things about Box — retention, classification, the audit logs — they have an understanding of why we're doing what we're doing within Box.”
And the firm didn’t have to replace its existing systems to get here. Box integrates with SharePoint and JIRA, so attorneys continue working in the tools they already use. The content infrastructure runs on the back end, without disrupting the workflows that partners and associates depend on.
“Box does allow for attorneys and users to continue to use systems and applications that they’re already comfortable with, and then Box comes in on the back end and enhances and streamlines the workflow.”
It is, as Bonnie puts it, scalable — built for the problems the firm faces today and the ones it has not yet encountered. She says, “I’m looking for what challenges it will solve for me and the firm in the future.”
The foundation is the strategy
Law firms getting real value from AI are not necessarily the ones with the most sophisticated AI tools. They are the ones that treated content infrastructure as the prerequisite — centralized, governed, and built to activate the documents that have always sat at the center of legal work.
The content has always been there. What varies, firm to firm, is whether the foundation underneath it is ready to activate that content.
Explore Box for Legal or learn more about Box AI.
