The autonomy gradient is the governance gradient.

Examples in legal functions

Document review AI flags issues; the lawyer reviews and decides. Contract drafting AI proposes language; the lawyer integrates. Research AI surfaces sources; the lawyer reads and synthesises. E-discovery AI clusters documents; the lawyer reviews clusters.

Governance implications

Standard supervision frameworks apply (lawyer in the loop on every output). Audit trail is per-output: each AI suggestion logged with the lawyer's decision. Lifecycle Build is relatively simple; Operate is the dominant stage.

State of deployment in 2026

Most current legal AI deployment sits here. Vendors compete on output quality. Functions compete on supervision discipline.

Examples in legal functions

A contract review pipeline where the AI runs the initial pass (clause extraction, risk flagging, comparison to playbook) and the lawyer reviews only flagged items. Due-diligence workflows where the AI scans documents and the lawyer reviews the summary. E-discovery first-pass relevance with lawyer review of privileged and ambiguous tiers.

Governance implications

Audit trail moves from per-output to per-workflow. Workflow opacity becomes a concern — the lawyer doesn't see every sub-step, so workflow-level audit becomes essential. Exception threshold calibration is a material governance decision. Lifecycle Build is more complex: defining the workflow, escalation rules, and exception thresholds requires committee approval.

State of deployment in 2026

The emerging tier in 2026. Vendors are increasingly shipping co-pilot workflows. Functions adopting them need workflow-level audit infrastructure that Tier 1 frameworks do not require.

Examples in legal functions

NDA processing where the AI receives the NDA, reviews against standard positions, generates a redline plus risk summary, and packages everything for lawyer review and signature. Conflict checks where the AI runs the full search across multiple systems and routes for lawyer approval. Vendor onboarding due diligence packaged end-to-end. Contract repository maintenance that drafts renewal notices for lawyer review before sending.

Governance implications

Audit trail at workflow level plus per-action sub-log: every cross-system touch is logged, every intermediate state recorded. New risk classes exposed: action irreversibility (sub-steps that cannot be undone) and confabulated execution (the AI proceeds with hallucinated intermediate states). Defensibility requires explicit workflow specifications, bounded-action lists, per-execution audit logs, and sample reviews.

State of deployment in 2026

The frontier in 2026. A small number of capabilities are reaching production at this tier. The governance infrastructure required is meaningfully larger than Tier 2.

Examples in legal functions

Procurement contract monitoring where an agent watches the contract calendar, initiates the renewal-or-replace workflow, executes routine renewals within delegated authority, and escalates anomalies. Regulatory horizon scanning where an agent monitors feeds, drafts impact assessments, and escalates material developments. Matter risk monitoring where an agent watches the portfolio and recommends action. These examples are mostly aspirational in 2026.

Governance implications

Audit trail must be comprehensive: every initiated action logged, every decision-point reasoned and recorded, every escalation choice justified. Dominant new risk classes: reduced human supervisory capacity, cascade failure across agent decisions, audit-trail completeness gaps. Defensibility requires continuous-monitoring framework, materiality-calibration documentation, supervisor review samples, incident-response playbooks, and a delegation-authority register naming exactly what the agent may and may not do.

State of deployment in 2026

Mostly aspirational in 2026. Tier 4 with weak Defensibility is uninsurable — both literally (insurers refuse the risk) and operationally (the function cannot demonstrate required supervision).