A top law firm has admitted AI errors in a court filing — raising a key legal question: who is liable when legal AI gets it wrong?
If you are responsible for legal work product, that question is no longer theoretical. The answer has not shifted with the technology. Responsibility still sits with the lawyer who approved the work.
The issue came into focus when Sullivan & Cromwell, one of the world’s most expensive law firms, apologised to a US bankruptcy judge after acknowledging that a filing contained misquoted law and incorrect case citations generated with AI. The firm also confirmed that its internal policies governing AI use had not been followed. That failure is where the legal risk begins. Courts do not assess whether software made a mistake; they assess whether a lawyer exercised proper professional judgment before submitting the work.
The same problem is now appearing outside courtrooms. EY Canada recently withdrew an AI-generated cybersecurity report after researchers identified fake citations and fabricated references, highlighting how AI-generated errors are moving into mainstream corporate and advisory work.
While the legal exposure differs from a court filing, the underlying issue is similar: organisations are increasingly relying on AI-generated material that may appear authoritative until somebody checks the sources closely.
This principle is reinforced in a recent report by UnitedLex, Applied AI in Legal: Ethics, Risk, and Governance around AI in the Practice of Law, which reframes responsible AI use around a simple idea: not a “human in the loop,” but a “human on the hook.”
The distinction reflects how liability actually operates. A lawyer can use AI to support their work, but they cannot transfer accountability to it. If a filing is wrong, a citation is fabricated, or an argument misstates the law, the responsibility attaches to the individual who approved it.
What makes this risk more significant is how quickly AI is being embedded into legal workflows. Research from Wolters Kluwer shows that a majority of legal professionals are already using AI tools, with further adoption expected as firms look to reduce costs, increase efficiency, and compete for clients. The commercial logic is straightforward. Automation reduces non-billable work, accelerates drafting, and allows firms to handle greater volumes without increasing headcount. That risk is not theoretical. It affects how work is produced, billed, reviewed, and ultimately defended if challenged.
Cases like this are beginning to raise a broader question for clients and firms alike: can lawyers be held liable for AI mistakes? The direction of travel suggests the answer is yes, because the legal standard has not changed. Work must still be accurate, defensible, and capable of withstanding scrutiny, regardless of how it is generated. If that standard is not met, the consequences are not limited to correcting an error. They can include reputational damage, client disputes, and exposure to regulatory or court scrutiny.
That creates a structural gap. Legal work is increasingly produced with the assistance of systems that can generate plausible but incorrect outputs, while accountability continues to rest entirely with the lawyer. The risk does not arise simply because AI can make mistakes. It arises because those mistakes can be difficult to detect without careful, informed review. When oversight is superficial, errors move from being technical issues to professional exposure.
Many firms have responded by requiring “human review” of AI-generated work, but review alone is not a safeguard if it lacks depth. Signing off on an output without interrogating its reasoning, sources, and limitations does not reduce risk; it formalises it. The UnitedLex report highlights that governance must be tied to specific legal use cases, recognising that the level of scrutiny required for a litigation filing is different from that applied to internal research or early-stage drafting. Without that distinction, AI is treated as a general tool when in practice it introduces a variable risk layer into each task it touches.
The trajectory of the technology makes this more pressing rather than less. Analysis from Thomson Reuters points to the emergence of more autonomous “agentic” AI systems that can carry out multi-step legal tasks with reduced human input, from researching legal issues to drafting and refining documents.
While adoption is still developing, many firms are already planning for these systems to become part of their workflows. The benefit is clear in terms of efficiency, but the challenge is equally clear in terms of oversight. As systems become more capable of acting independently, the point at which a lawyer meaningfully intervenes becomes harder to define, and the risk of approving work that has not been fully understood increases.
This creates a tension at the heart of modern legal practice. Firms are under pressure to adopt AI to remain competitive, yet the more they rely on it, the more important it becomes to demonstrate control over how it is used. In a courtroom, the explanation that a system produced an output carries little weight if that output cannot be justified. The burden remains on the lawyer to show that the work meets the required standard, regardless of how it was generated.
The implication is not that AI should be avoided, but that its use demands a higher level of professional discipline. Lawyers must understand the tools they are using, apply independent judgment to the outputs they produce, and ensure that any work submitted can be defended on its merits. The concept of a “human on the hook” captures that reality. It reflects a legal system that continues to anchor responsibility in human decision-making, even as the processes behind those decisions become more technologically complex.
The Sullivan & Cromwell incident is not an isolated failure; it is an early signal of a broader shift. As AI becomes more deeply embedded in legal work, the gap between how work is produced and how responsibility is assigned will continue to widen unless governance keeps pace. When errors occur, the question will not be how the technology failed.
It will be whether the person who approved it can defend it.