AI Oversight Tightens in Law, Privacy Disclosures Demand Decision Mapping

Verified Human Oversight Is Becoming Mandatory in AI-Assisted Legal Filings

ABA Formal Opinion 512 and a growing sanctions record show that AI use in legal practice is now being treated as a lawyer-accountability issue, not a drafting shortcut. Attorneys still own competence, confidentiality, supervision, and candor when they use generative AI, and courts are enforcing that duty when filings contain bad citations or fabricated authority.

In Lexos Media IP, LLC v. Overstock.com, the court required every attorney on an AI-defective brief to verify the authorities and publicly admonished them. Other reported penalties include $5,000 for fictitious ChatGPT citations, $3,000 plus revocation of a drafting lawyer’s admission in Wadsworth v. Walmart, and additional sanctions for fabricated quotations and citation abuse. Regulators are tightening the same standard: the Law Society of England and Wales now requires appropriate human oversight, informed judgment, and risk-based controls; California’s SB 574 adds verification, hallucination correction, confidentiality safeguards, and disclosure requirements for court filings.

For lawyers and legal teams, the practical bar is rising fast: documented human review, citation checking, and supervision controls are no longer optional if AI touches a filing. Expect more scrutiny on who reviewed what, and be ready to prove it.

Australia’s Privacy Act Forces AI Decision Mapping Into Disclosure Work

Australia’s updated Privacy Act takes effect on 10 December 2026 and requires more than an AI yes/no in privacy policies: covered entities must disclose when an AI system or computer program makes, or substantially and directly contributes to, a decision that significantly affects an individual, identify the categories of personal information used, and state whether the decision is fully automated. That pushes legal teams beyond the verified-use controls covered last week and into a front-end discovery exercise. Teams must map which systems influence consequential decisions, trace the data they consume, and determine whether a model is deciding or only taking a substantial step before policy language can be finalized.

The risk rises if the inventory, data map, or decision logic is incomplete, because the disclosure itself can become a liability. The Ninth Circuit’s October 9, 2026 decision in Black v. IEC Group, Inc. makes that sharper by treating unauthorized disclosure of sensitive health information as concrete injury on its own. At the same time, the EU AI Act is already live on prohibitions and AI-literacy duties, with GPAI obligations from 2 August 2025 and stronger transparency and documentation powers from 2 August 2026, backed by penalties up to €35 million or 7% of global turnover. For lawyers, the work now extends from verifying AI use to continuous system intake, disclosure drafting, and privilege-aware incident triage.