Thomson Reuters CEO Steve Hasker is correct that law firms are running toward private, custom AI systems—and the reason matters. Recent cyber incidents affecting the sector, combined with regulatory pressure around client confidentiality and the SRA's Code of Conduct requirements, have made the risk of using shared, cloud-based AI platforms feel unacceptable to risk committees. Skadden's deal with Thomson Reuters signals what's coming: law firms will demand AI that runs behind their firewall, processes nothing externally, and leaves no trace on third-party servers. This is not paranoia. This is proportionate risk management. For UK regulated firms in legal, insurance, financial services and accountancy, the question is no longer whether to adopt AI. The question is whether you can justify adopting it in any form that touches client data, IP, or personal information, without keeping that AI inside your own perimeter.

But here's what this story reveals: the market has confused deployment model with safety. Building AI behind your firewall is necessary. It is not sufficient. The real cyber and compliance risk is not where the model sits—it's what you feed it. A private AI that ingests 50,000 unredacted case files, confidential fee notes, and client names will leak that information just as readily as a public model, because the problem is not the location of the server. The problem is that most firms are deploying AI with almost no thought to data governance, classification, or access control. Harvey, Legora, and Luminance have all built tools that can run on-premise. Microsoft Copilot can run behind your own infrastructure. The vendors are moving where the market demands. But none of these platforms stop a firm from pouring unfiltered data into them. That's an organisational problem, not a technology problem. Thomson Reuters is right to build custom systems. The question is whether law firms, insurers, and accountancy firms have the controls in place to use them safely.

Trovix's view is blunt: if you are deploying AI without a prior data protection audit, you are moving risk, not managing it. Moving AI behind your firewall makes you responsible for everything it sees. That is a step forward in control, but it is also a step backward in deniability. The ICO's UK GDPR framework and the FCA Consumer Duty PS22/9 both place accountability on you, not on the vendor. A private AI system is only safer if you have already mapped what data you hold, classified it, and built rules about what each AI use case is permitted to access. This is where most regulated firms fail. They deploy Trovix Aria or ask Thomson Reuters for a custom model, then feed it everything because the vendor said the model is private. That's backwards. You need to know what your data estate looks like before you build the AI layer on top of it. Trovix Sift exists precisely because most firms cannot answer the basic question: what sensitive data do we actually have, and where is it? Until you can answer that, moving to custom AI is just moving the liability.

What should a mid-market law firm, insurer, or accountancy practice do right now? First: do not assume that a vendor relationship with custom AI capability means you have solved the cyber and compliance problem. Second: commission a data governance audit before you deploy any AI, including private systems. Third: use that audit to build a data access policy for AI that treats regulated content (client information, financial records, personal data) as requiring explicit approval before ingestion. Fourth: only then evaluate whether generic cloud AI (like Copilot or Harvey) or private deployments (like Thomson Reuters custom systems) fit your risk profile. The Skadden deal is not a template to copy. It is a sign that regulation and cyber risk are finally forcing the industry to think seriously about where AI sees client secrets. Most firms are not there yet. Most firms are still treating AI as a tool to drop into their current data practices without changing anything. That ends now.

Source: The Logic