The Case
Fernandez & Partners had always prided itself on being ahead of the curve. When Dr. Alejandra Fernandez, the firm's managing partner, announced an aggressive AI adoption initiative six months ago, it was met with applause at the annual partners' retreat. "The firms that don't adopt AI will be left behind," she declared. "We will not be among them."
The initiative moved fast. New tools were licensed, training sessions were organized (though attendance was optional), and a culture of experimentation was encouraged. What was not established with equal urgency was a formal AI usage policy. Lucia Morales, the firm's Head of IT and Legal Technology, drafted one and submitted it to the partners. It sat in a shared drive, unreviewed, for four months.
Then came the night that changed everything.
Diego Salazar, a second-year associate, was working alone at 11 p.m. on a Friday. The due diligence report for the TechVerde-ConGlobal merger — a $240 million acquisition — was due Monday morning. Diego had been given the assignment only 48 hours earlier when the senior associate originally handling it went on emergency medical leave. Under crushing pressure and with no one to consult, Diego turned to the tool he used every day for personal research: a free, public AI chat assistant.
He uploaded 47 documents. The draft merger agreement. Financial projections and cap table analyses. Board minutes from both companies. Internal legal opinions on regulatory risks. Attorney-client privileged communications. Everything the AI needed to "help him summarize and identify risks" — and everything a competitor would need to derail the deal.
Timeline of Events
6 months ago
Dr. Fernandez launches the firm-wide AI adoption initiative. Optional training sessions are offered. No formal AI use policy is implemented despite a draft being submitted by IT.
3 weeks ago — Friday, 11:00 PM
Under extreme deadline pressure, Diego Salazar uploads 47 confidential documents — including the draft merger agreement, financial projections, and privileged legal opinions — to a free public AI assistant. The AI's terms of service permit use of uploaded data for model training.
2 weeks ago
Fragments of the confidential merger terms surface in a competitor's intelligence brief. The specific financial thresholds and regulatory risk assessments match the uploaded documents almost verbatim.
1 week ago
TechVerde's CEO discovers the leak. She calls Dr. Fernandez directly, demanding an immediate explanation. TechVerde's General Counsel, Isabel Vega, begins assembling a litigation team. ConGlobal's M&A lead questions the integrity of the entire transaction.
Today — Monday, 9:00 AM
Dr. Fernandez has called an emergency meeting. The Data Protection Authority has opened a preliminary investigation. The firm's malpractice insurer has been notified. The deal hangs by a thread.
Why This Case Matters
This scenario sits at the intersection of the most pressing issues facing the legal profession today: the duty of technological competence, the protection of attorney-client privilege in the age of AI, the boundaries of organizational responsibility versus individual error, and the tension between innovation and risk management. Every law firm adopting AI tools faces some version of this risk. The question is not if something like this could happen — it is what your firm would do when it does.
Context Analysis
Understanding the full landscape of legal, technological, ethical, and business dimensions at play.
Data Privacy Framework
- GDPR-equivalent data protection regulations and potential fines
- Attorney-client privilege and its waiver through third-party disclosure
- Contractual confidentiality obligations to both merger parties
- Mandatory data breach notification requirements and timelines
Technology Context
- Critical distinction between public/free AI tools and enterprise-grade platforms
- Terms of service permitting data use for model training
- Absence of a formal AI usage policy despite a draft existing
- Shadow IT risks when employees use unapproved tools under pressure
Professional Ethics
- Duty of technological competence (ABA Model Rule 1.1, Comment 8)
- Supervisory obligations over junior lawyers and their technology use
- Professional malpractice standards and breach of fiduciary duty
- Bar association disciplinary proceedings and potential sanctions
Business Impact
- $240 million deal at risk of collapse with cascading financial consequences
- Client relationship damage and potential loss of the firm's largest account
- Malpractice insurance coverage questions and premium implications
- Reputational damage affecting recruitment, client acquisition, and market position
Stakeholders & Roles
Seven perspectives, seven sets of interests, one crisis to resolve. Each participant assumes one role and advocates for their position throughout the simulation.
Dr. Alejandra Fernandez
Managing Partner
Profile: Visionary leader who championed the AI initiative. 20 years at the firm. Her personal reputation and leadership are now on the line.
Objectives:
- Save the client relationship and the deal if possible
- Protect the firm from regulatory and legal consequences
- Maintain her credibility as leader while accepting appropriate responsibility
Exclusive Information: She knows the firm's malpractice insurance has a specific exclusion for data breaches caused by unapproved technology. She has not shared this with anyone yet.
Diego Salazar
Junior Associate (2nd year)
Profile: Talented but overworked associate. Received no formal training on AI tool policies. Assigned the due diligence 48 hours before deadline when the original attorney went on medical leave.
Objectives:
- Defend his actions as a systemic failure, not just individual negligence
- Preserve his career and avoid being made the sole scapegoat
- Demonstrate willingness to cooperate with remediation efforts
Exclusive Information: Diego has emails showing he asked his supervising partner for guidance on AI tools two months ago and never received a response. He also knows that at least three other associates have used the same public AI tool for client work.
Lucia Morales
Head of IT / Legal Technology
Profile: 8 years at the firm. Warned the partners about the risks of uncontrolled AI adoption four months ago. Her policy draft was acknowledged but never implemented.
Objectives:
- Establish that she identified and communicated the risks before the breach
- Gain authority to implement proper AI governance going forward
- Avoid being blamed for a technology failure that was ultimately a governance failure
Exclusive Information: Lucia has server logs showing the exact documents uploaded, timestamps, and the IP address used. She also has her original policy proposal email with read receipts from three senior partners — including Dr. Fernandez.
Carlos Mendoza
Senior Partner, Litigation
Profile: The firm's top litigator with 25 years of experience. Skeptical of the AI initiative from the start. Now tasked with defending the firm's legal interests on multiple fronts.
Objectives:
- Minimize the firm's legal exposure across all fronts (malpractice, regulatory, contractual)
- Develop a defense strategy that accounts for the insurance gap
- Manage the tension between transparency and legal self-preservation
Exclusive Information: Carlos has learned that the competitor who obtained the intelligence brief may have also used AI tools to generate it — raising questions about the exact chain of how the data leaked. The situation may be more complex than a simple upload-to-leak pipeline.
Isabel Vega
TechVerde's General Counsel
Profile: Fierce advocate for her company. TechVerde's board is furious. The CEO is considering pulling out of the deal entirely and suing the firm for breach of confidentiality and negligence.
Objectives:
- Obtain full accountability and compensation for the breach
- Determine whether the deal can proceed safely or must be abandoned
- Protect TechVerde from further exposure and competitive disadvantage
Exclusive Information: Isabel knows that TechVerde's board has authorized her to settle rather than litigate, but only if the firm accepts full responsibility, pays significant damages, and the deal terms are renegotiated. She has not revealed this flexibility to the firm.
Martin Quiroga
ConGlobal's M&A Lead
Profile: Represents the acquiring company. ConGlobal has invested 18 months in this deal. The leaked information could affect valuation, regulatory approvals, and competitive positioning.
Objectives:
- Preserve the deal if possible — ConGlobal needs this acquisition strategically
- Ensure leaked information has not compromised ConGlobal's negotiating position
- Negotiate better terms if the deal continues, leveraging the crisis
Exclusive Information: Martin has intelligence suggesting the competitor who received the leaked data is also interested in acquiring TechVerde. If the deal falls apart, ConGlobal may lose the target entirely. This makes saving the deal even more critical than anyone else realizes.
Data Protection Authority Inspector
Regulatory Investigator
Profile: Impartial government investigator. The DPA has been looking for a high-profile case to establish precedent on law firm AI use. This case could become a landmark ruling.
Objectives:
- Determine whether the firm violated data protection regulations and to what degree
- Assess organizational versus individual responsibility for the breach
- Establish a regulatory framework precedent for AI use in legal practice
Exclusive Information: The Inspector knows that the DPA is preparing sector-wide guidelines for AI in professional services. The outcome of this investigation will directly shape those guidelines. A cooperative resolution could result in lighter penalties; obstruction will trigger the maximum enforcement response.
Learning Activities
Structured activities following the Smoother methodology, progressing from comprehension through critical analysis to creation and reflection.
- Map the complete chain of events from the AI adoption initiative to the emergency meeting, identifying every decision point where the outcome could have changed.
- Identify all affected parties — direct and indirect — including individuals, organizations, regulators, and third parties who may not yet know they are affected.
- Trace the data flow: what documents were uploaded, where did the data go, how could it have surfaced in a competitor's report? What technical pathways are plausible?
- Catalog every legal obligation that was potentially breached: contractual, regulatory, ethical, and fiduciary.
- Document the existing AI governance measures (or lack thereof) at the firm and compare them to industry best practices.
- Explain the breach from Diego's perspective: what pressures, assumptions, and gaps in training led to his decision? Was it truly negligent or was it a foreseeable consequence of the firm's culture?
- Now explain it from TechVerde's perspective: what does this breach mean for their competitive position, their trust in outside counsel, and their board's fiduciary obligations?
- Classify the types of failure at play: individual (Diego's action), procedural (no policy in place), organizational (leadership decisions), and systemic (industry-wide gaps).
- Interpret the difference between "optional training" and "mandatory competence" — what does the duty of technological competence actually require?
- Analyze how the firm's culture of "move fast" with AI adoption created the conditions for this specific failure.
- Evaluate the firm's AI governance: was Dr. Fernandez's approach reckless, merely inadequate, or defensible as a reasonable business judgment? Where exactly did the governance chain break down?
- Assess the firm's total liability exposure. Consider malpractice claims, regulatory fines, contractual damages, reputational costs, and insurance gaps. Estimate the potential financial impact.
- Should Diego bear personal responsibility, or is this primarily an organizational failure? Construct arguments for both positions and identify which is more persuasive and why.
- Analyze whether attorney-client privilege was waived by the disclosure to the AI service. Research how different jurisdictions treat inadvertent disclosure to technology platforms.
- If Lucia's policy had been implemented, would it have prevented this specific incident? Critically evaluate the limits of policy-based solutions.
- Question the managing partner's responsibility: is championing adoption without implementing safeguards a form of leadership malpractice?
- Design a comprehensive AI Use Policy for Fernandez & Partners that addresses approved tools, data classification, training requirements, and enforcement mechanisms.
- Create a Data Breach Incident Response Plan: immediate containment steps, notification procedures, investigation protocols, and communication templates.
- Draft the client notification letter to TechVerde: what do you disclose, when, and how do you frame the firm's response?
- Propose a remediation package for TechVerde that balances accountability with the firm's survival. Include financial terms, governance commitments, and monitoring mechanisms.
- Design a mandatory AI training curriculum for all firm employees, from partners to support staff, with specific modules for handling confidential data.
- Evaluate each team's proposed AI Use Policy against ISO 27001 principles, bar association guidelines, and data protection regulations. Which policy would actually prevent the next breach?
- Assess the incident response plans: are they actionable under real crisis conditions? Do they account for the chaos, emotion, and time pressure of a real data breach?
- Peer-review the client notification letters: are they legally sound, empathetic, and strategically wise? Would they satisfy a regulator? Would they retain a client?
- Rate each remediation proposal on a matrix of legal adequacy, financial viability, client satisfaction, and long-term firm health.
- How has working through this case changed your perception of AI tools in legal practice? Has it made you more cautious, more thoughtful, or both?
- If you were the managing partner of a firm today, what would you implement tomorrow morning based on what you have learned?
- Reflect on the tension between innovation and risk management. Is it possible to move fast with AI without creating the conditions for a breach like this?
- Consider your own daily AI use: are there moments where you have handled confidential information with less care than this case demands? What will you change?
- What surprised you most about this case — the technical failure, the governance failure, or the human failure? What does that tell you about where the real risks lie?
Role Simulation
An immersive simulation where participants assume stakeholder roles and navigate the crisis through negotiation, argumentation, and collective decision-making.
Simulation Scenario
It is Monday morning, 9:00 AM. The conference room on the 12th floor of Fernandez & Partners is tense. Dr. Fernandez has called an emergency meeting of all stakeholders. TechVerde's General Counsel has arrived with a litigation team on standby in the lobby. ConGlobal's M&A lead has flown in overnight. The Data Protection Authority Inspector is waiting in a separate room, ready to begin formal interviews. Diego Salazar is sitting alone at the end of the table, pale and silent. Lucia Morales has brought a folder thick with documentation. Carlos Mendoza is reviewing the malpractice insurance policy with a grim expression. The future of the firm, the deal, and several careers will be decided in the next two hours.
Rules
- Duration: 120 minutes total, divided into four phases
- Format: Formal meeting structure — participants must address the chair (Dr. Fernandez) and request the floor to speak
- Bilateral negotiations: During Phase 2, participants may request private bilateral meetings with any other stakeholder
- Exclusive information: Each role has confidential information that may be revealed strategically during negotiations — or withheld entirely
- Decision authority: Final resolutions require majority agreement among the internal stakeholders (Fernandez, Mendoza, Morales) but must account for external stakeholder demands
- Facilitator role: The instructor acts as a neutral observer, intervening only to maintain structure, inject time pressure, or introduce unexpected developments
Phases
Phase 1: Crisis Assessment (30 minutes)
Each stakeholder presents their understanding of the situation and their initial position. Dr. Fernandez opens with a factual summary. Each participant then has 3-4 minutes to state their concerns, demands, or proposed course of action. No interruptions. No negotiations yet — this is about getting all positions on the table.
Phase 2: Bilateral Negotiations (30 minutes)
The plenary session breaks into bilateral negotiations. Participants may request private meetings with any other stakeholder. This is where exclusive information may be traded, alliances formed, and deals explored. The facilitator tracks which meetings occur and can introduce breaking developments (e.g., "A journalist has just called the front desk asking about a data breach").
Phase 3: Resolution Proposals (30 minutes)
All stakeholders return to the conference table. Each party presents their proposed resolution — what they want to happen, what they are willing to concede, and what is non-negotiable. Cross-examination is allowed. Alliances and conflicts from Phase 2 will shape the dynamics.
Phase 4: Decision (30 minutes)
The final negotiation. Stakeholders must reach a resolution that addresses: (a) the firm's immediate response to the breach, (b) accountability for what happened, (c) the future of the deal, (d) the regulatory response, and (e) structural changes going forward. If no consensus is reached, the facilitator announces consequences of inaction.
Scenario Variations
The facilitator may introduce any of these variations during the simulation to increase complexity and test adaptability:
- The Press Gets Involved: A national newspaper publishes a story about the breach. The firm must now manage public communications alongside the private crisis. How does public scrutiny change the negotiation dynamics?
- The Enterprise Tool Scenario: What if Diego had used an enterprise-grade AI tool with proper data handling agreements? Does the analysis change? Is the firm still liable?
- TechVerde Sues: During Phase 2, Isabel Vega announces that TechVerde has filed a malpractice lawsuit seeking $50 million in damages. How does active litigation change the dynamics of the resolution process?
- Another Associate Comes Forward: A second associate reveals they also uploaded client documents to the same AI tool three months ago — for a different client. The problem is systemic, not isolated.
Debriefing
After the simulation, step out of your role and reflect on the experience from your own professional perspective.
On Responsibility
- Who bears the greatest responsibility for this breach — Diego, Dr. Fernandez, or the firm as an institution?
- Is it fair to hold a junior associate accountable for a failure of organizational governance?
- What is the proper balance between individual accountability and systemic reform?
On Technology Governance
- Can a law firm realistically prevent employees from using public AI tools? If not, what is the next best approach?
- Should AI training for lawyers be mandatory and assessed, like CLE requirements?
- How should firms balance the competitive pressure to adopt AI with the duty to protect client data?
On Professional Ethics
- Does the duty of technological competence extend to understanding the terms of service of every AI tool a lawyer uses?
- When attorney-client privilege is breached through technology, who should bear the consequences — the individual, the firm, or the technology provider?
- How should bar associations update their ethical frameworks to address AI-specific risks?
On Your Own Practice
- Does your firm or organization have a clear AI use policy? If not, what would you advocate for after this exercise?
- Have you ever used a public AI tool with data that, in retrospect, should have been handled more carefully?
- What three concrete changes would you implement in your own practice starting this week?
Ready to Experience This Case?
This case study is designed for guided facilitation as part of our Learning Program. Request a customized session for your team, firm, or institution — complete with role assignments, materials, and expert debriefing.
Comments
Loading comments...