The Defensibility Posture Statement — A Template
The closing deliverable
Every chapter of this Blueprint leads here.
The eight pillars specify what your legal function must build. The six operating layers describe how it must be operated. The Maturity Stack tells you where you stand and where you are heading. The 90-day roadmap in Chapter 13 gives you the action sequence.
All of it produces one board-ready output: the Defensibility Posture Statement.
The DPS is not a report. It is not a policy document. It is not a self-assessment. It is the evidence document that records, at a specific point in time, what your legal function’s AI governance posture actually is.
When your Board asks: “How are we governing AI in the legal function?” — the DPS is your answer. Not a presentation of intended actions. Not a summary of commitments. A documented record of what is actually in place.
This chapter explains what the DPS is, who owns it, when it is produced, and how to present it. Then it gives you the template to complete.
---
What the DPS records
The Defensibility Posture Statement records three things:
1. Which AI systems are in use
Every AI system, model, and automated decision tool deployed within or on behalf of your legal function. This is drawn directly from your AI Bill of Materials — the structured record maintained as part of Pillar 2 and Pillar 4 governance. If a system is not in the AI BoM, it is not in the DPS. If it is in use and not in the AI BoM, that is the first finding your DPS must record.
2. Under what controls
For each AI system: the governance controls in place. Who approved the system. What data governance applies. How outputs are validated before use. What the human oversight mechanism is. What the escalation path is when the system fails. What the disclosure position is with clients and regulators.
3. With what evidence of defensibility
Not what you intend to have in place. What you can document is in place today. Approved vendor contracts with AI governance clauses. Staff literacy completion records. Validation protocols referenced in matter management systems. Incident logs. The audit trail that would allow an external reviewer — a regulator, an auditor, a Board member — to verify your governance posture independently.
These three elements are the DPS. Every other section of the template exists to substantiate them.
---
Who owns the DPS
The DPS is owned by the General Counsel or Chief Legal Officer.
This is not a delegation matter. The DPS is a board-level governance document. Its authority derives from the GC or CLO signing it. Its credibility depends on the GC or CLO being able to answer questions about its content in a board setting.
The AI Programme Lead prepares the DPS. The Governance & Defensibility Officer (at Advanced and Defensible bands) coordinates the evidence gathering. HR provides literacy completion records. IT or procurement provides AI system data.
The GC or CLO reviews, approves, and signs it.
This ownership structure is not bureaucratic formality. It is the mechanism that makes the DPS defensible. A board-level document that the GC cannot speak to in a board meeting is not a governance document. It is a paper exercise.
---
When the DPS is produced
The DPS is produced annually, aligned to the Annual AI Governance Audit cycle. The standard production cadence:
| Month | Activity |
|—|—|
| Q3 | AI Governance Audit begins: AI Inventory updated, AI BoM verified, literacy records compiled |
| Q4 Month 1 | DPS draft prepared by AI Programme Lead; evidence gathered and reviewed |
| Q4 Month 2 | GC/CLO review and approval; open items documented with remediation plan |
| Q4 Month 3 | DPS presented to Board or Risk Committee; filed as governance record |
| Q1 following year | DPS used as baseline for the next operating year’s Pillar 4 governance |
Four events trigger an off-cycle DPS update, regardless of where you are in the annual cycle:
- Significant new AI system deployment — any AI system that materially expands the function’s AI capability or data exposure requires a DPS update before it goes into production.
- Material change to an existing system — a version update that changes how the system processes data or makes decisions; a change in vendor governance terms; a shift from internal to client-facing deployment.
- Regulatory inquiry — any inquiry from a regulator, court, or client that asks about the function’s AI governance. The DPS should be current before you respond.
- AI-related incident — any error, data incident, or governance failure involving an AI system requires a DPS update to record the incident and the remediation.
An off-cycle DPS update does not require a full governance audit. It updates the relevant sections and records the trigger and response.
---
A DPS with gaps is still defensible
Before presenting the template, one principle requires emphasis.
A DPS that documents known governance gaps is more defensible than no DPS.
Documented awareness of a gap is evidence of governance attention. It is the difference between a legal function that has identified a risk and is managing it, and a legal function that has not looked for risks at all.
The DPS template includes an Open Items section specifically for this purpose. When your governance audit identifies a gap — a tool in use that has not been through the approval process, a literacy cohort that has not yet been trained, a vendor contract that does not include AI governance clauses — that gap goes into the DPS with a remediation plan and a target date.
The Board and regulator who review your DPS understand that no legal function has a perfect AI governance posture. What they are assessing is whether your function knows what it has, governs what it knows about, and has a credible plan to address what it does not yet fully govern.
Document the gaps. Plan the remediation. Present both.
---
How to present the DPS to the Board
The DPS is a governance document, not a presentation deck. It is filed as a formal governance record. It should be presented to the Board or Risk Committee with a covering summary that answers four questions:
- What AI systems does the legal function operate? (AI Systems in Scope summary — headline count and category)
- What governance controls are in place? (Controls summary — headline standards)
- What open items exist and what is the remediation plan? (Open Items summary — count, severity, target dates)
- What has changed since the last DPS? (Change summary — new systems, retired systems, material governance changes)
The covering summary should be no longer than two pages. The DPS itself is the supporting evidence document.
Presentation format: The GC or CLO presents the covering summary to the Board. The full DPS is available for review. Board members with governance responsibility (Risk Committee) should receive the full DPS; the full Board typically receives the covering summary.
The Board response to the DPS is a governance record. Any Board questions, concerns, or directions arising from the DPS should be minuted and addressed in the following year’s DPS cycle.
---
The DPS template
The following template is the canonical Defensibility Posture Statement for a legal function operating within the Legal AI OS. It is designed to be completed at any Maturity Band. Sections marked (Advanced/Defensible band) are optional for Foundational and Developing bands but required at Operational and above.
Copy this template. Complete every section. Where evidence is not yet available, record the gap and the remediation plan.