AI Risk Report
Your AI Risk Report
Hartwell & Associates · Austin, TX · Completed April 2026
AI Governance Risk Assessment
About this sample: Hartwell & Associates is a fictional 9-person Austin law firm. Their scores reflect a realistic result for a professional services firm that has some Microsoft 365 security work done but has not formally addressed AI governance. Your results will reflect your actual answers.
C
AI Policy
Minor Gaps
Basic awareness exists but formalized policy is needed before a problem forces the issue. No designated owner for AI governance means policies are not enforced or updated as tools evolve.
Data Exposure
Needs Attention
Client data is likely entering public AI tools without adequate protection. Staff use of tools like ChatGPT with case documents has not been formally addressed. Enterprise agreements with data privacy terms are not in place.
Microsoft 365
Minor Gaps
Some M365 security work has been done but gaps likely remain before Copilot is safe to use. External sharing in SharePoint has not been reviewed and audit logging status is unconfirmed.
Client Disclosure
High Risk
No disclosure framework exists. Engagement letters do not address AI use and state bar guidance has not been reviewed. This is a professional liability and ethics risk. Texas and 30+ other states have issued formal AI ethics guidance that applies to your practice.
Incident Readiness
Minor Gaps
Some response capability exists but a real AI incident would expose significant gaps. Cyber insurance has not been reviewed for AI coverage, and there is no documented response plan specific to AI data exposure.
Next Steps
What you should do about this
Your firm has awareness but not action. Most of what needs to be done is not technically complex. It is policy, documentation, and configuration work that can be addressed in 30 to 60 days with the right guidance. Client Disclosure is the most urgent gap and the easiest to fix. Start there.
Biggest Gap
You need a written AI governance policy
You have awareness but no formal policy. That is the gap malpractice carriers and bar associations are asking about. We build it for your firm specifically, not a generic template.
See AI Governance ServicesNo Obligation
Talk through your results
30 minutes with Jeremy Lowery. Walk through the gaps, get a clear priority list, no pitch.
Schedule a Call