Legora, Harvey, or In-House? A Build-vs-Buy Framework for Legal AI

Before the Reset, legal AI was a demo. After it, the vendors are real products and the in-house option, a sovereign model over your own privileged corpus, is also real. General Counsels no longer choose between AI and no-AI; they choose, matter type by matter type, between a vendor, a frontier model, and sovereign infrastructure. That is a portfolio decision, and most firms are making it by accident.

The deciding variable is not capability, assume capability everywhere, but privilege and confidentiality. The question for every workload is simple and brutal: if this content leaked, or was used to train someone else's model, what would it cost us? The answer sorts the portfolio.

At the sovereign end sit privileged litigation strategy, live M&A due diligence, and sensitive contract review, anything whose exposure would waive privilege, breach an NDA, or hand an adversary your hand. These belong on in-house retrieval over your own corpus, on local compute, where the privileged material never leaves your control. At the other end, public-law research and regulatory horizon-scanning run happily on a frontier model: the inputs are public and the capability premium is real.

The interesting middle, template and clause drafting, internal policy work, is where a vendor or a hybrid pattern earns its place: capable, convenient, and acceptable because the confidentiality stakes are bounded. Vendor due diligence here is not optional; where a tool sends your data, and whether it trains on it, is the whole question.

Ask of each matter: would exposure of this content waive privilege or cause material harm? If yes, it has one safe home, sovereign, in-house, auditable. If no, the convenience and capability of a vendor or frontier model can win. The discipline is to apply the test by matter, not by department: the legal team is not a category, but an unredacted M&A data room is.

This is also where the EU AI Act and professional-conduct duties converge with sovereignty: the obligations to supervise, to maintain confidentiality, and to be able to explain are all easier to honour on infrastructure you govern. For a GC, sovereign legal AI is not the cautious option; it is the defensible one.

Classify your matter types by privilege and confidentiality exposure, not by practice area, and place each on the sovereign-to-frontier spectrum. Run real vendor due diligence on Harvey, Legora, Spellbook and Robin AI: data residency, training use, audit rights, exit.

Stand up one sovereign workload, privileged-document retrieval on local compute is the canonical first build, to prove the in-house option works, then route each matter type to its right home under a standing governance policy.