AI for sole in house counsel (with no budget)

Legal AI is moving fast enough to make even the most switched-on lawyers feel behind - especially if you have been away from practice, or you are the only in-house counsel expected to "figure it out."

We sit down with Claire Thorndyke, sole in-house counsel at Quiet Council, to talk through what it really looks like to get up to speed in a practical, defensible way - without pretending every legal team is already running autonomous agents. Claire shares her three-pillar roadmap for adopting generative AI in legal practice -and we dig into real privacy programme use cases, from data processing agreement review and data mapping to subject rights requests, redaction, extraction, and policy development, with a clear focus on risk, supervision, and accountability.

Claire also shares how she ran a live tool trial, how she categorised the legal AI market between research copilots and contract review tools, and what criteria mattered most: accuracy, usability, data safety, time saved, and ROI. We close with practical advice on vendor diligence, avoiding lock-in as models keep evolving, and building relationships with your internal technology partners.

Press play to find out where to start, what to avoid, and how to build an AI strategy that actually works for your practice.

Transcript

Introduction And Why Legal AI Matters

SPEAKER_00 0:18

Hi, this is Richard Nicholas, and um today I'm joined by Claire Thorison, who is sole in-house counsel with Quiet Council. And what's fascinating about her story, um, that looking forward to hearing about today, is she has approached AI um from the perspective of a toll council and looked at how uh and what she has picked up on on that journey. And I know that there's there's many in-house lawyers and toll councils that uh listen. So uh for those people in particular, I think this will be particularly useful. So uh Claire, good to meet you.

SPEAKER_02 0:56

Hi, thanks for having me on, Richard.

SPEAKER_00 0:58

Thanks very well, thank you for being here. It's great to hear just a bit about uh you and I suppose your your backstory, so how you how you got into legal AI in the in the first place. What what brought you to um start to use AI in the practice?

SPEAKER_02 1:15

Sure. I mean I I guess the context to all of this is that I had a 15-month maternity leave uh which ended in October 2025. And um wow, things have moved fast um in the time that I've been changing nappies. Uh so I don't think I was uh unique in feeling kind of overwhelmed and left behind uh by the pace of change in terms of AI and legal services, but I had a pretty decent solid reason for not being on top of it all. Uh and then also um as a sort of solved practitioner, I knew that no one was going to uh give me a license to uh a legal AI uh solution and tell me away you go, and it's part of your uh key performance metric to be using this uh to do your to do your your your client work. I was going to need to understand and source this technology to use it for myself and in my own practice. So, yeah, double double kind of challenge there. Um so I I don't think I'm the only one who felt left behind, but that's the very sort of specific context to me going on this three-ish month journey of discovery with legal AI. Um and uh that's I I presented it at a uh conference recently, and I guess that's why I'm here talking to you today. It's not as a kind of legal technology expert, it's more as someone who's really had to face into this in the context of recent uh changes and leaps and the capacity of AI to help us do it now jobs and work out what on earth to do with all that.

SPEAKER_00 2:59

That's completely. And so you've you realised the world had had moved on, picked up the picked up the the baton effectively in terms of um uh legal AI and working out what you needed to do. So what what happened in that you're talking about a three-month period. So what happened in that period? What did what did you learn in that time?

SPEAKER_02 3:22

Well, I think I think firstly I was looking quite a lot at LinkedIn, which and sort of uh legal AI LinkedIn gives you the impression that everyone's running agents on their MacBook uh and sort of automating their entire legal practice, and then also talking to other people in real life. Uh I I realised that that was absolutely not the case. Sort of separating the hype from what's happening in other people's practices and in other people's businesses.

Returning From Leave To AI Rush

SPEAKER_02 3:49

And then I sort of I went on this kind of uh literacy journey, first of all. Um and I can sort of call it in retrospect a strategy, although it didn't feel that strategic when I was going through it, it felt a bit more like a you know a creative learning journey mess. Um I've got a strategy, three-pillar strategy now, which I can call it. So literacy, um, so I embarked on this journey of learning about uh what AI can do, how to evaluate its responses and outputs and recognise when human judgments are required. Um I looked at it second pillar as being workflow. Um so there's an old kind of outsourcing ad adage about not outsourcing what you don't understand. And I think that holds true here. Um so uh looking at areas of your practice which would be suitable for automation or AI and considering volume, speed, complexity, and risk. And then only when you've been through the kind of literacy and sort of tooling or work sort of literacy and um workflow journey is it the right time to look at tooling. Um and it's sort of very tempting to jump into loads and loads of pilots uh with the thing that's in the headlines and the legal press and the financial press uh at the moment, but um not all of it will be suitable for your needs. So define your requirements first and do some targeted demos. Um that that would be my kind of approach. Uh, because it is a full-time job keeping a pace with all of this, and at the same time, you have client work to do and you know other professional applications if I fell. Um so literacy, I guess is my yeah, first of all.

SPEAKER_00 5:40

So literacy literacy first of all, then you said three terms. And so how did you how how did you start with that very first one then? The the getting getting literate when you've got a full-time role doing full-time work.

SPEAKER_02 5:54

Yeah, well it was classic lawyer, really, I suppose, because uh I sort of looked for a definition of literate uh and there wasn't one in the UK, uh, but the EU obviously has a couple of relevant uh definitions. It's got that um definition of AI literacy. Um, and also um it's also got an obligation on providers and deployers to understand um you know uh the the risks associated with deploying AI. Um and then so looking at statute is obviously classic lawyer. And the second bit that I did, also um very common in our profession, is to study study it. Um so um I realised that I didn't

Literacy First Definitions Rules Benchmarks

SPEAKER_02 6:44

I had gaps in my knowledge about what AI could do. Um and uh a sort of neat way of me closing those gaps and also adding to my professional skill set because AI governance is obviously privacy adjacent and a growth area which privacy professionals in outstanding private practice are leaning into. Um so I did the uh artificial intelligence governance professional course from the International Association of Privacy Professionals, um, which is a reasonably intensive study course and also a so it's a tie nan at a cost commitment. Um I did also find some good free online content, which I can provide you a link, and maybe that can go show notes for your listeners, um from Harvard University. Um so just so so that I understood what was AI, like the basics, what what is a genetic AI versus what is generative AI? And I couldn't say that I knew the answer to that in November, but now I do, and that's thanks to these courses that are uh uh I've been looking at. Um I also looked just briefly, so not everyone who uh is involved in a privacy program is doing regulated legal work. But if you are doing regulated legal work, there's also the SRA and Law Suthority sounds to look at. Um and um there was a bit that I wanted to read out from the SRA on conduct rules, um, competence, supervision, and accountability. So those are existing professional duties and they apply equally in the AI age. So, you know, AI-assisted legal work carries the same duties over to the court as any other legal work. Um and then one other thing that I thought might be helpful to mention around literacy is kind of uh learning from the work of others. So uh Linked Latest did a uh English law benchmark, uh, which is now over a year old, but gives a good sense of uh what Frontier AI was capable of uh in 2025, and they did a version in 2025 and a version in 2023, I think. So you can really see like progress in terms of frontier model uh reliability. Um, and that was a sort of committee of lit native lawyers setting exams for Frontier AI, um, relatively hard research questions, competent mid-level associate level, and then marking them. And um they gave them marks out of 10 for substance and accuracy, including most recently that uh Open AI top scoring at uh 6.4 out of 10 uh was not always right, lacked nuance and needed human supervision. But you could see that there was such a massive improvement from 2023 where there was loads and loads of hallucinations in there. Um so I'm sort of keenly looking at the version three because I'm pretty sure there's gonna be a massive and incremental improvement um from the 2025 results there. Um so all all of that kind of helped me understand uh what legal AI was capable of.

SPEAKER_00 10:06

Okay, so yes, the I'm I remember the AI AI uh GP course, so quite uh an academic course, quite a lot of um work and uh looking at uh uh practice and that sort of thing. So that's the those um those sounds a a thoroughly loyally journey in terms of getting up to getting up to speed on the law, and yes, I think it's uh it's one that got a quite a lot to sort of relate to in terms of working out what it is and how it how it works but I suppose that doesn't get you that doesn't get you using it. That gets you that gets you to understand it, but not to not to actually use it um in real life, I suppose. Yes.

SPEAKER_02 10:54

Was that the was that the workflows part of the Yeah, so I mean you're totally right there. So like I I've sort of passed the exam and obviously there's a relief associated with passing any exam um and um that doesn't go away no matter what exam account, how feeling you get any profession. Um and then sort of like but the realisation dawned quite slowly that yes, I got the qualification, but I still didn't know how to use AI in my own practice. Um but I was a lot better equipped to go ahead and and try and work that out. So um I did want to mention as well that there's a law society guidance on generative A from September 25, and that kind of gives a really good primer for salt practitioners and small law firms on the kind of things to um watch out for when you're rolling it out in practice. So that's kind of where I went next. After you know, my what is literacy, how do I become literate, let's do a course, then look at the stuff, you know, then I started to look at regulatory guidance about how to roll roll it out in the legal services context. Um yeah, um I think that sort of leads us to uh to workflow, um, which uh is now a verb in its own right, um I think workflow. Often used as well. Yeah, no, I mean I'm I'm quite uh I'm quite fond of it. Um so I think before you start delving into tooling, and there's lots of sort of salespeople willing to give you demos and pilots, and you need to work out what it is that you're going to use AI for in your particular circumstances. So for me, as a kind of small practitioner, I didn't have an enormous uh breadth of processes and data that I could usefully apply AI to. Um, but I did have this one work stream, uh, which is reviewing uh third-party processor terms. Um and I had a kind of really well understood um position on that because I had playbook. Um so that's the use case that I chose for my circumstances right now uh to do my tooling trials around. Uh but if I were still in-house in a big privacy program, I would definitely uh be looking much more broadly. Um so data mapping, um, ropa updates, how does data map and ropa work with privacy impact assessment process? You know, there's kind of there has been a lot of sort of manual data entry in the past. Um even if you're using a kind of big uh privacy program platform like Trust Arc or OneTrust or Big ID. Um data subject rights request. Um there is the potential to reduce the manual workload and improve the speed of response there if you're looking at redaction, provisional redaction, and also extraction of data. And then there's policy development. Um so

Workflow Mapping Use Cases And Playbooks

SPEAKER_02 14:13

quite decent policies can now be generated uh using legal AI, and you may be able to scale your compliance documentation without losing uh control. Um if you are a part of a privacy uh program which has clients and they are doing due dividends on you, quite often that has been done in the past by spreadsheet and FAQs. Um you know, I can see that there might be some sort of a genetic use case there um which you know would be worthwhile considering if you had a a scaled program.

SPEAKER_00 14:52

Um and you picked up one you picked sorry, you picked up one point there, which was the playbook. And just for anyone who's not familiar with that term, so effectively uh a a um description of all the things that you would accept and wouldn't accept, and things to look out for, clauses and those sorts of things. Is that what is that what you mean by terms of the DPS?

SPEAKER_02 15:18

And it's personalised to one particular client display that I work for. You actually have quite a pragmatic pragmatic approach. So your uh risk-based approach is baked in. Um, you know, uh an example being audit rights and you know, what is the compromise that you're willing to accept uh from a big SaaS provider on Audit Rights if you're Article 28 processor, you know, you're not you're going to be accepting their documentation to review as opposed to having uh rights to walk on site and look in their filing cabinets, right? Yes. Um so um it it's got a risk uh based approach baked in, which is why um it's it's kind of a useful thing both for other people in your team to ensure consistency um uh or any kind of outsource service provider that you use can also use it to ensure consistency, but it could also uh be used by uh an AI.

SPEAKER_00 16:17

Yes. Okay. And you were you've obviously chosen areas specific areas for AI. You've chosen the DPA DPIA, the the um uh data processing agreement, uh data mapping, that sort of thing. How did you how did you choose those areas?

SPEAKER_02 16:38

So uh for for my tri for my tooling, for my tooling trial, I only looked at the contract review um use case, so the DPA, the data processing agreement use case. Um the the other areas that I mentioned are kind of areas of a large-scale privacy program, which I think may um which I'm not running right now because external as opposed to internal. Uh so I didn't mention at the beginning that quite a lot of my history is running big privacy programs with financial services and for a division of UI. So if you've got kind of a scaled program where you've got a volume of a particular type of work and you re you understand it really well, you can write down what you you should be doing with it. You know, is is that potentially an area where you could uh automate it? Yes. And if it's not r reserved legal services activity, then the sorts it becomes a bit easier, right? Uh because um uh it's it's lower risk um from an automation perspective.

SPEAKER_00 17:39

And the reserved legal services, they're things reserved by um law society, things like um litigation and property and those sorts of areas that that only solicitors only solicitors can um can provide. Okay. Um excellent. And the and I think you mentioned that these um these playbooks, these workflows that you put together, um you were using you were using c just regular tools to do this. Um is that right? So things like um Microsoft Copilot, so the sorts of AI tools that um sole practitioners might have access to, so not necessarily the Harvey or the Gora or any of those sort of um large and and potentially quite expensive um AI tools, but actually the the um was it would it be the would it be the free versions? Did you um what did you look around for? How did that work?

SPEAKER_02 18:40

So I wasn't I wasn't using anything um uh when I started looking at the the project um because I'd been my my practice had been shuttered for a year and at the um midpoint of 2024 uh the when I went on maternity leave the use of legal AI was not common, right? We were almost we were slightly past the stage of saying, you know, oh we need a policy so the business don't put confidential information or personal data into chat to GPT, right? But only just.

SPEAKER_01 19:15

Yes.

SPEAKER_02 19:15

Um, or at least uh in my personal journey, that's where I thought we were. Some people may have been further ahead. So um I was using Word and a spreadsheet, which had my playbook in, right? And three screens, uh one with third-party processor terms, one with the spreadsheet, and then one with an email where I was doing a list of uh comments about the third party terms which were out of line of the spreadsheet with what were the positions in the spreadsheet were in my playbook. Um so I wanted to test um these solutions for that use case. Um, and I sort of thought I went actually went to Chat GPT because I didn't have a current view of the legal AI ecosystem. Um and it it bucketized these two different kinds of legal AI for me. Um and it might be obvious to others, but it wasn't to me. So there's kind of a legal AI co-pilot or workspace, and the familiar names in that category would be Westlaw, so and I've got the co-council AI element, Lexis with the protege AI element, uh, Nagora, Harvey, and then Microsoft co-pilot legal AI. And then there's this other category which uh do a narrower breadth of things, um, contract review and CLN. And in that um category of service providers, you've got uh tools like Luminance, Ebisort, Cura

Tool Categories Research Versus Contract Review

SPEAKER_02 20:43

Systems, and Draft Pilot. So I actually wanted to see if I could get um both the kind of legal research capability and the precedence and the know-how that we've all used for many years uh with Lexis or West Law and a contract review tool that works natively in Word. Um and I couldn't, right? So that's why I tried DraftPilot as well. So it wasn't an apples and apples comparison, I didn't compare two of the same things. I looked at one contract review tool, which was draft pilot, and then Lexus Protege as part of my trial. Um, because although it wasn't a use case that I was testing, I was really interested to see what Protege could do from a legal research perspective. Um yeah. Um so shall I go on to talk a bit about my my my tool trial?

SPEAKER_01 21:39

Please do. Yes. Yeah how did that go?

SPEAKER_02 21:41

So my tool trial is already in history. Um, and we're talking in March 26, and I did the the the trial at the beginning of February. Um because there's kind of a um an evolution in the service that Lexus um uh provide, in that they're implementing an element of crawl technology to it, so some agentic capacity and also some. Content will be returned in Lexus. My understanding is they will be returning content not just from their legal database but also from whatever the Frontier models are trained on. And but the two will be tagged differently. So I I tried trial the old version of uh Lexus uh the pre-clawed version of Lexus. Um and I tried trial draft pilot and um I looked at the uh following evaluation areas. Um so functionality, so rapids of service, um accuracy or nuance. Um I sort of picked a subject matter to test that I was quite confident I knew the answers on. Um so I could uh, if not be as accurate as a committee of lawyers at Link Laters, certainly have a good idea of where I thought the tools results were out of line with market practice or my playbook. Um I looked at simplicity or user interface, um, compliance, data safety, data confidence, um time saved. Uh did it actually uh prove to be a time saver? And then cost um in terms of return on investment. And you know, as I said, I I wasn't comparing Apples with Apples. Um, but in terms of the legal code parallelet solution that I looked at, it was best for research and breadth of legal tasks. But the contract review tool was actually the thing that I chose to move forward with for my particular practice area because it was best for contract execution, workflow execution. Um you could do everything natively in Word with a plug-in. The playbook it worked with very uh effectively and uh could also provide you with a playbook if you didn't have one already. Um and um from my perspective I saw kind of reliable issue spotting and redlining against my defined criteria, which was the play, the playbook. Um so it was actually a time saver for me, and uh the cost was okay as a small practitioner. Whereas the legal aid I co-pilot like Thomson uh Reuters and the Lexic Solutions, you know, we all know them, and if we trained in private practices, they're very familiar with them. Um but that they're not cheap for cyber practitioners, and you're lock you locked in. Yeah. Um so it wasn't something that I chose to move forward as a result of my trial.

SPEAKER_00 24:45

That lock-in point's quite an important one as well, isn't it? Because the AI is developing continuously. Um and the leaders right now probably will will change over time. We've already seen that with um well just recently, with uh Claude overtaking OpenAI, um, which had itself overtaken Gemini just recently, so it's a it's a bit of a power play between those providers.

SPEAKER_02 25:14

It is, exactly. And also the kind of um I think the legal services model is evolving as well because it was a sort of big marketing benefit for the Lexus Nexus solution that they were only drawing off their own content.

SPEAKER_01 25:31

Yes.

SPEAKER_02 25:31

Um but that do because you could rely on it, right? In the same way you can rely on their precedence.

SPEAKER_01 25:37

Yeah.

SPEAKER_02 25:38

Um it's not content from the internet, uh, it is content which has been looked at by someone professionally uh qualified before. Um but it's all getting a bit blurry. Um if content from um frontier models is going to be included in those kind of platforms but marked as different, um it will mean that you don't have the frustration of having a kind of use case unsupported response, which is what you get if you go outside the parameters of what's in these legal information services with your search priorities. Um but then why why would you pay for that, right? Because or or pay that level for it, because you can

Trial Results Time Saved And Cost

SPEAKER_02 26:19

get similar with an enterprise version of a frontier model. An enterprise contract to a frontier model.

SPEAKER_01 26:25

Yes.

SPEAKER_02 26:27

Yeah, so it I mean I think it's blurring and convergence, it's likely. Um and so, yeah, as you say, getting locked into something, it's um a bit anxiety provoking at the moment because you don't know quite how things are gonna move, right?

SPEAKER_00 26:44

Yes. It's not it's there's there's no standard as such we're seeing uh um yeah, so we're just seeing you know, Claude's recent entry and uh into this area. There's lots lots still lots still happening, but it sounds like you've got you've put together um I like the fact that you've gone through stuff literacy, um, then looked at the workflows, looked at looked at what what the um areas are to to focus on and the the particular um particular things that would make most sense for AI to help with, and then looked at the tool in in that order as opposed to uh what I often come across is people who've looked at the tool first and then try and make it fit something.

SPEAKER_02 27:27

And and and that's really tempting, right? And also, like, you know, returning to practice, I've had a little bit of a runway, if you like, and time to focus on this as a project. And it's it's very time consuming, right? It's it's because it's a new skill set that we're adding. It's it's it's it's not I mean, I think sort of those people who are technology-ish type lawyers probably have a an advantage in the way to think about procuring this kind of technology um because we've been advising on um you know outsourcing projects and uh how to benchmark uh IT other than legal AI for a while. But like it's it's a new skill set for many lawyers, how to evaluate a technology tool and how to use it in your practice. Um and you know it the the the goalposts keep moving as the technology keeps improving. Um so yeah, it's a challenge.

SPEAKER_00 28:26

Um it's really, really it's you think you you were saying it's save it's saving you time right now, so you're getting a return on investment. Is there anything anything you'd recommend to someone who's sort of starting out on that journey of exploring AI and uh working out how it can help them in their practice?

SPEAKER_02 28:48

I mean, I I I think being kind of uh having a clear-eyed look at how well you really understand these terms uh and being sort of honest with yourself about your level of understanding before you start speaking to any vendors will be really helpful in the long run.

SPEAKER_01 29:04

Yes.

SPEAKER_02 29:04

Um because uh, you know, being properly equipped to have conversations around data safety and around functionality of these tools is important um when you're thinking about you know this uh kind of uh outsourcing effectively. Um so doing that groundwork and then not being kind of seduced by the latest hype and doing demos for tools which are not appropriate for your practice. So, like, you know, I can see a lot of Lagora content on LinkedIn, for example, but Ligora uh wouldn't be appropriate for me because there's a 10 user uh uh minimum requirement. So it I'm just I'm just not I'm not their client right now.

SPEAKER_00 29:56

Um that makes sense.

SPEAKER_02 29:58

Um and also considering what's in your native uh uh technology infrastructure already. Uh so if you're a Google First organization, um look at Gemini. Um you you know you may not need a specific legal AI solution if you have a boatload of due diligence inquiries that you want to automate first and then maybe use AI in the fullness of time. Um and also consider what resources are available to you and your organization to support you in the technology journey. So, like in previous um organizations I've worked in, there would have been a business partner for technology who would be advising illegal or privacy functions on how they could adopt um different practices and quite often trying to route you towards their existing supply chain, right?

SPEAKER_01 30:55

Yes.

SPEAKER_02 30:56

Um so you've got to work within the structure that you're in and um get the help that you can from within your organization um because it it it's it's pretty time consuming trying to drive this all by yourself.

Practical Advice Vendor Diligence And Next Steps

SPEAKER_02 31:09

Um so use the help IT business partner that kind of role if there is in your organization.

SPEAKER_00 31:15

Excellent. No, that's that's uh that's brilliant, thank you. And I suppose getting the getting skilled up, doing the diligence on the on the suppliers, um, is a is a is a big task, and it's clearly something that you've been you've been through um yourself. Um and if people if people were interested, I don't know if this is something you'd offer if if if people were interested in getting in touch with you in terms of you know your journey or um or indeed seeing um the result of um AI guided uh privacy law advice, for instance, where would they where would they find you?

SPEAKER_02 31:56

Oh yes, they can find me on LinkedIn. Um I'll provide a link for your show notes. Um and um yeah, um very happy to talk uh about um you know how AI could be used strategically in an in-house privacy program uh or talk about uh the way in which I can help externally uh with uh AI assisted uh legal and compliance support.

SPEAKER_00 32:22

Excellent. Superb. No, that's really, really useful. Thank you very much, Claire. And um so thank you again for joining this uh program. We'll have the show notes uh available to uh listeners. Uh uh everything from the from the tools we've talked about, from the uh law society guidance, and we'll put that on the on the show notes. Uh all that remains for me to say though is thank you very much again. Thank you. Look forward to look forward to speaking soon. Thank you.

SPEAKER_01 32:50

Thank you, Richard.