Morae: ROT Data Threatens Legal AI Adoption Success

• Only 26% of legal leaders are confident their organization's information is ready for effective AI analysis, according to Morae research.
• "ROT" data, meaning redundant, obsolete, or trivial information, can significantly distort AI outputs by being treated as equally useful evidence.
• Just 30% of legal leaders are confident their information is properly classified as confidential or sensitive, a critical gap for AI processing.
• AI systems, lacking human judgment, can expose personally identifiable information or privileged material if underlying data is not properly governed.
• Many law firms' retention policies exist only on paper, allowing irrelevant records to remain accessible to AI alongside current, authoritative documents.

Failure to properly classify or index information beforehand creates a potential privacy incident with Social Security numbers or health information, as AI could expose those materials to someone who never should have seen them.

The landscape of information retrieval within law firms is undergoing a profound transformation, shifting from traditional search, retrieve, and evaluate methods to advanced AI-driven analysis. Historically, lawyers would manually sift through various document versions to identify the definitive one before proceeding with legal work. However, this manual discernment was necessitated by the widespread practice of scattering information across numerous platforms, including document management systems, email inboxes, shared drives, SharePoint sites, and diverse business applications.

Today, artificial intelligence systems are designed to ingest vast quantities of material from across an organization and generate refined answers, often without revealing the source of their conclusions or acknowledging the inherent disarray within the foundational data. Kurt Thies, global head of Information Governance Strategy at Morae, highlights a long-standing issue: organizations have always lacked confidence in their information, but the advent of AI has elevated the consequences of this uncertainty to an unprecedented level. This challenge underscores the critical need for robust information governance law firm AI strategies.

Research conducted by Morae underscores this concern, revealing that a mere 26% of legal leaders possess confidence that their organizations' information is adequately prepared for effective AI analysis. Furthermore, only 37% of these leaders even know the complete storage locations of all their legal information. This significant disparity emphasizes the paramount importance of prioritizing comprehensive information governance and legal AI data hygiene initiatives before integrating more tools that can process potentially flawed data at extraordinary speeds.

A key challenge in legal AI adoption stems from what information governance professionals term "ROT data," an acronym for redundant, obsolete, and trivial data points. When AI systems are introduced into environments laden with such clutter, the quality and accuracy of their outputs can be severely compromised. Consider, for instance, a contract that exists in fifteen different versions, each containing unique edits, comments, and abandoned negotiation stances. While a human lawyer can readily determine the executed copy, an AI system granted access to all fifteen might treat each version as equally valid evidence.

This indiscriminate processing also extends to other forms of ROT data. An agreement that is two decades old and no longer governs any active relationship, or trivial notes such as text messages about a client lunch, can be absorbed and utilized by an AI system as if they hold current relevance. As Thies points out, AI does not inherently possess the capacity to discern which information is authoritative, current, or appropriate for a given context. Nevertheless, it will incorporate all available data into its final outcome, making proactive legal AI data hygiene essential to prevent misleading or incorrect results.

Beyond mere inaccuracy, inadequate information hygiene poses significant exposure to risk, particularly concerning sensitive and confidential data. A concerning statistic reveals that only 30% of legal leaders are confident their information is correctly classified as confidential or sensitive, a task that AI-enabled software frequently struggles to perform accurately. Thies emphasizes that "not all data is equal," noting that certain information carries inherently high risk and substantial obligations, demanding stringent protection measures.

Organizations are bound by regulatory mandates to retain specific records and are obligated to safeguard personally identifiable information (PII) against cybersecurity breaches. Yet, high-risk materials often reside within the same sprawling information environment as ordinary business files. Thies illustrates this vulnerability with a scenario involving HR files stored on a shared drive; while this arrangement might seem secure if only one employee accesses the folder, the protective guardrail vanishes when an AI system gains access.

Failure to properly classify or index information beforehand creates a potential privacy incident with Social Security numbers or health information, as AI could expose those materials to someone who never should have seen them. This highlights a significant AI data classification risk. The fragmented nature of a typical firm's information landscape gives new meaning to the principle of "garbage in, garbage out." While retention policies are designed to impose order, many firms' policies exist primarily on paper, failing to ensure the proper disposal of records when they become eligible. Consequently, irrelevant records remain accessible to large language models alongside current, authoritative material, further complicating compliance and increasing the potential for sensitive data exposure.

Lawyers and compliance officers must prioritize robust information governance and data hygiene, specifically addressing 'ROT' data, before implementing AI tools. Failure to do so risks inaccurate AI outputs, potential privacy breaches, and significant compliance exposure due to the AI processing unclassified or sensitive information.

Source: Analysis based on industry reporting.