Law Firm AI’s Real Risk: Oversharing Confidential Information Instead of Making Things Up

Intapp (NASDAQ: INTA) didn’t start with a traditional business plan. Its origins trace back to the early 2000s, when a Silicon Valley data integration startup sought to patent its technology. The attorney reviewing the filing remarked that his own law firm struggled significantly in this domain and asked, “Can I license this thing?” That moment marked the beginning of Intapp.

The company accepted the proposal. The law firm’s chief information officer was impressed enough to leave his role, join Intapp as its first salesperson, and leverage his network to introduce the platform across the legal industry. Word-of-mouth referrals soon followed.

Unusual for a Silicon Valley software firm, Intapp avoided venture capital funding for years. Its first external investment came with its 2021 IPO. This path has proven advantageous: two decades focused solely on professional services firms has given Intapp deep domain expertise and robust compliance infrastructure—elements it now considers central to its competitive edge.

A Lucrative Yet Challenging Market

Intapp develops software tailored for law firms, accounting firms, investment banks, private equity organizations, and consulting agencies. CEO John Hall refers to these clients as “large partnership firms,” estimating the U.S. segment of this market at approximately $4 trillion in annual revenue.

While the opportunity is substantial, it comes with complexity. Unlike broad-market solutions, professional service firms demand precise access controls and regulatory adherence. Generic AI platforms lack the nuanced data models required to replicate Intapp’s specialized functionality.

Defining “Governed AI”

In February, Intapp introduced its agentic AI platform, Celeste, which became generally available on July 15. During a recent discussion with The Motley Fool, Hall distinguished Celeste from AI-driven tools such as Harvey (an Intapp partner) and Legora, as well as horizontal assistants like ChatGPT Enterprise.

At the core of the differentiation lies governance—specifically, identity-aware permissions. Traditional AI assistants respond to queries based purely on available information, without considering whether the requester should have access to that data.

“One of the issues with horizontal AI systems is that they tell the truth,” Hall noted. “But you might not be cleared to receive that information.”

Within law firms, the greater risk isn’t inaccurate responses—it’s excessive transparency. For example, a partner who is ethically conflicted from a transaction may still receive detailed summaries about it through an unsecured AI tool. Even subtle prompts or indirect questioning can expose sensitive details.

Celeste addresses this by enforcing firm-specific policies directly within the AI workflow. Access restrictions tied to ethical walls, material non-public information (MNPI), and independence mandates are applied in real time. If a user lacks authorization, the system returns a refusal rather than incomplete or misleading output. Additionally, all interactions generate audit trails for compliance purposes.

Developing a capable language model is complex. Creating one that understands internal roles, enforces confidentiality rules, and maintains defensible records under scrutiny represents an even higher bar—one that Intapp is betting heavily on.

Source link