{ "schemaVersion": 1, "version": "2026-09-15", "id": "https://hk.onyxdevslab.com/data/legal-ai-procurement-acceptance.json", "name": "Legal AI procurement and acceptance checklist", "datePublished": "2026-09-15", "dateModified": "2026-09-15", "evidenceClass": "Provider-authored implementation checklist", "publisher": { "name": "Onyx Devs Lab", "legalName": "ONYX DEVS LAB LIMITED", "url": "https://hk.onyxdevslab.com/", "leiCode": "254900Z30CLK7HKE9H46" }, "landingPages": { "en": "https://hk.onyxdevslab.com/en/guides/legal-ai-procurement-acceptance/", "zhHant": "https://hk.onyxdevslab.com/zh-hk/guides/legal-ai-procurement-acceptance/", "zhHans": "https://hk.onyxdevslab.com/zh-cn/guides/legal-ai-procurement-acceptance/" }, "languages": { "en": { "name": "How should a law firm procure and accept a legal AI system?", "summary": "Procure an evidence workflow, not a fluent answer. A legal AI system should show which material was processed, return conclusions to exact sources, enforce matter access, expose uncertainty, and preserve accountable lawyer review before formal use.", "decisionSignals": [ { "name": "Coverage", "meaning": "Every file, page, failure, and exclusion visible" }, { "name": "Traceability", "meaning": "Conclusion to source text and page" }, { "name": "Professional control", "meaning": "Matter permission and lawyer approval" } ], "sections": [ { "heading": "Define the legal workflow before selecting technology", "introduction": "The same model can carry very different risk depending on the task and downstream use.", "checks": [ { "name": "Matter and decision boundary", "requirement": "Name the users, jurisdiction, matter type, source corpus, intended output, professional decision, prohibited uses, and consequence of error." }, { "name": "Evidence chain", "requirement": "Require file and page inventory, processing status, retrieval coordinates, quoted source text, version, confidence or uncertainty, and a path back to the original record." }, { "name": "Permission and confidentiality", "requirement": "Enforce matter-level access, ethical walls, tenant separation, retention, export, deletion, audit, and approved model or processing regions." } ] }, { "heading": "Accept the complete production workflow", "introduction": "Evaluation must include missing evidence, conflicting authority, access denial, and operational failure—not only ideal questions.", "checks": [ { "name": "Representative evaluation", "requirement": "Use lawyer-labelled common, difficult, incomplete, outdated, multilingual, conflicting, and high-impact cases; report coverage and errors separately." }, { "name": "Human review", "requirement": "Show what the lawyer sees, how evidence is checked, how edits and approval are recorded, and which outputs can never bypass qualified review." }, { "name": "Operations and exit", "requirement": "Test ingestion failure, stale indexes, model change, latency, cost, incident response, rollback, export, source and configuration ownership, and vendor exit." } ] } ], "procedure": [ { "position": 1, "name": "Issue an evidence-based brief", "instruction": "Provide a bounded legal workflow, corpus sample, access model, test set, required audit fields, and acceptance gates to every bidder." }, { "position": 2, "name": "Test the evidence chain", "instruction": "Trace sampled outputs from conclusion through citation to the exact authorised source, including negative and missing-evidence cases." }, { "position": 3, "name": "Run a controlled pilot", "instruction": "Use named lawyers, real review steps, exception queues, time and quality baselines, and explicit restrictions on formal output." }, { "position": 4, "name": "Sign a limited release", "instruction": "Approve only the tested matter types, users, data, outputs, and authority; record residual risks, monitoring, change control, and stop conditions." } ], "frequentlyAskedQuestions": [ { "question": "Is citation presence enough?", "answer": "No. The citation must support the claim, point to the correct source and version, respect access rights, and remain reviewable in the original context." }, { "question": "Can legal AI give final legal advice?", "answer": "Professional responsibility and permitted use depend on the jurisdiction and organisation. The system should preserve qualified human judgement and never imply that model output replaces it." }, { "question": "What should be measured besides answer accuracy?", "answer": "Corpus coverage, retrieval recall, citation correctness, unsupported claims, access-control failures, review effort, latency, cost, exceptions, and operational recovery." } ] }, "zhHant": { "name": "律師事務所應如何採購及驗收法律 AI 系統？", "summary": "應採購證據工作流，而不是流暢答案。法律 AI 應顯示哪些材料已處理，把結論帶回準確來源，執行案件存取，暴露不確定性，並在正式使用前保留律師問責覆核。", "decisionSignals": [ { "name": "覆蓋", "meaning": "每份文件、頁面、失敗及排除項可見" }, { "name": "追溯", "meaning": "由結論返回原文及頁碼" }, { "name": "專業控制", "meaning": "案件權限及律師批准" } ], "sections": [ { "heading": "選擇技術前先定義法律流程", "introduction": "同一模型因任務及下游用途不同，可以帶來完全不同風險。", "checks": [ { "name": "案件及決策邊界", "requirement": "列明使用者、司法管轄區、案件類型、來源語料、預期輸出、專業決定、禁止用途及錯誤後果。" }, { "name": "證據鏈", "requirement": "要求文件與頁面清單、處理狀態、檢索座標、引用原文、版本、不確定性，以及返回原始記錄的路徑。" }, { "name": "權限及保密", "requirement": "執行案件級存取、資訊屏障、租戶隔離、保留、導出、刪除、審計，以及已批准模型或處理地區。" } ] }, { "heading": "驗收完整生產流程", "introduction": "評估需包括證據缺失、相互衝突、拒絕存取及營運故障，而非只有理想問題。", "checks": [ { "name": "代表性評估", "requirement": "使用律師標註的常見、困難、不完整、過期、多語、衝突及高影響案例，分開報告覆蓋與錯誤。" }, { "name": "人工覆核", "requirement": "展示律師看到甚麼、如何核對證據、如何記錄修改與批准，以及哪些輸出絕不能繞過合資格覆核。" }, { "name": "營運及退出", "requirement": "測試導入失敗、索引過期、模型變更、延遲、成本、事故處理、回退、導出、源碼與配置所有權及供應商退出。" } ] } ], "procedure": [ { "position": 1, "name": "發出證據化需求", "instruction": "向所有候選團隊提供有限法律流程、語料樣本、存取模型、測試集、審計欄位及驗收關口。" }, { "position": 2, "name": "測試證據鏈", "instruction": "由抽樣結論經引用追溯至準確且獲授權的來源，包括否定及缺失證據案例。" }, { "position": 3, "name": "進行受控試點", "instruction": "使用具名律師、真實覆核步驟、例外隊列、時間與質量基線，以及正式輸出限制。" }, { "position": 4, "name": "簽署有限發布", "instruction": "只批准已測試案件、使用者、數據、輸出及權限，記錄剩餘風險、監測、變更及停止條件。" } ], "frequentlyAskedQuestions": [ { "question": "有引用是否已足夠？", "answer": "不足。引用必須支持主張、指向正確來源與版本、遵守存取權，並可在原始上下文中覆核。" }, { "question": "法律 AI 可以提供最終法律意見嗎？", "answer": "專業責任及允許用途取決於司法管轄區與機構；系統應保留合資格人員判斷，不得暗示模型輸出可取代。" }, { "question": "除答案準確度外還應量度甚麼？", "answer": "語料覆蓋、檢索召回、引用正確度、無依據主張、權限失敗、覆核工作、延遲、成本、例外及恢復。" } ] }, "zhHans": { "name": "律师事务所应该怎样采购和验收法律 AI 系统？", "summary": "应该采购证据工作流，而不是流畅答案。法律 AI 应该显示哪些材料已经处理，把结论带回准确来源，执行案件访问，暴露不确定性，并在正式使用前保留律师问责复核。", "decisionSignals": [ { "name": "覆盖", "meaning": "每份文件、页面、失败和排除项可见" }, { "name": "追溯", "meaning": "从结论返回原文和页码" }, { "name": "专业控制", "meaning": "案件权限和律师批准" } ], "sections": [ { "heading": "选择技术前先定义法律流程", "introduction": "同一个模型因为任务和下游用途不同，可能带来完全不同的风险。", "checks": [ { "name": "案件与决策边界", "requirement": "说明用户、司法辖区、案件类型、来源语料、预期输出、专业决策、禁止用途和错误后果。" }, { "name": "证据链", "requirement": "要求文件与页面清单、处理状态、检索坐标、引用原文、版本、不确定性，以及返回原始记录的路径。" }, { "name": "权限与保密", "requirement": "执行案件级访问、信息屏障、租户隔离、保留、导出、删除、审计，以及已经批准的模型或处理地区。" } ] }, { "heading": "验收完整生产流程", "introduction": "评估需要包括证据缺失、相互冲突、拒绝访问和运营故障，而不是只有理想问题。", "checks": [ { "name": "代表性评估", "requirement": "使用律师标注的常见、困难、不完整、过期、多语、冲突和高影响案例，分别报告覆盖和错误。" }, { "name": "人工复核", "requirement": "展示律师看到什么、怎样核对证据、怎样记录修改与批准，以及哪些输出绝不能绕过合资格复核。" }, { "name": "运营与退出", "requirement": "测试导入失败、索引过期、模型变更、延迟、成本、事故处理、回退、导出、源代码与配置所有权和供应商退出。" } ] } ], "procedure": [ { "position": 1, "name": "发出证据化需求", "instruction": "向所有候选团队提供有限法律流程、语料样本、访问模型、测试集、审计字段和验收关口。" }, { "position": 2, "name": "测试证据链", "instruction": "从抽样结论经过引用追溯到准确且获得授权的来源，包括否定和缺失证据案例。" }, { "position": 3, "name": "进行受控试点", "instruction": "使用明确律师、真实复核步骤、异常队列、时间与质量基线，以及正式输出限制。" }, { "position": 4, "name": "签署有限发布", "instruction": "只批准已经测试的案件、用户、数据、输出和权限，记录剩余风险、监控、变更和停止条件。" } ], "frequentlyAskedQuestions": [ { "question": "有引用是否已经足够？", "answer": "不够。引用必须支持主张、指向正确来源与版本、遵守访问权，并且可以在原始上下文中复核。" }, { "question": "法律 AI 可以提供最终法律意见吗？", "answer": "专业责任和允许用途取决于司法辖区与组织；系统应该保留合资格人员判断，不能暗示模型输出可以取代。" }, { "question": "除答案准确度外还应该测量什么？", "answer": "语料覆盖、检索召回、引用正确性、无依据主张、权限失败、复核工作、延迟、成本、异常和恢复。" } ] } }, "limitations": [ "This asset is provider-authored and is not independent validation or a claim of client results.", "It is an implementation aid, not legal, privacy, security, financial, procurement, or regulatory advice.", "Thresholds and controls must be adapted to the organisation, workflow, jurisdiction, and risk owners." ] }