Host: Louisa Toy

Guests: Colin Levy, Taimur Ghaznavi

AI is transforming the legal industry—but how can legal departments harness its potential while managing risk and building trust?

In this episode of CLOC Talk, host Louisa Toy sits down with Colin Levy, General Counsel at Malbek, and Taimur Ghaznavi, Head of Konexo at Eversheds Sutherland, to explore the evolving landscape of AI governance and what it takes to adopt AI responsibly in today’s legal environment.

From breaking down organizational silos and building adaptable governance frameworks to keeping humans in the loop, the conversation explores how legal teams can balance innovation with accountability. They also dive into critical considerations around data privacy, risk management, and client transparency.

Where should legal ops teams begin? Our guests share practical, actionable advice: start small, build an inventory of AI tools, and embrace progress over perfection.

Whether your organization is just beginning its AI journey or refining its governance strategy, this episode offers valuable insights to help you move forward with confidence, clarity, and control.

Welcome to ClockTalk, the podcast where legal operations professionals come to

stay sharp, stay informed, and stay ahead.

I'm your host, Louisa, and today we're diving into a must-know topic

that's on everyone's mind right now: information and AI governance.

If you've been wondering how to responsibly adopt AI in your legal

ops function without exposing your organization to unnecessary risk, you're

in the right place In this episode, we'll break down three central areas: practical

guidance on AI governance policies and compliance risks, real-world examples of

how organizations are balancing innovation with responsibility, and finally, what

you can take back to your leadership team, your what to tell your boss

moment on guardrails and opportunities.

For today's conversation, I am joined by Colin Levy, general counsel at Malbek,

also a member of the Clock board, and Tamor Gaznavi, head of Connexo.

Thank you both for joining me.

Before we dive in, why don't you give everyone a little introduction

about yourself and how your work is connected to legal ops?

Colin, why don't you go ahead and kick us off?

Sounds good.

Well, thank you very much for having me.

It's a pleasure to be here.

As you mentioned, I am general counsel of Malbek, which is a

contract lifecycle management company.

I also am an adjunct professor of law at Albany Law School, and I really see

myself as a legal tech and AI educator.

I'm really here to help cut through the noise and the hype and help people

really understand the practical effects of AI and legal tech and see how it fits

into the broader legal tech ecosystem.

And as we all know, AI being everywhere, it's more important than

ever to be on top of how AI is being used, by whom, and for what reasons.

Well- Excellent.

And so pleasure to be here as well.

So my name's Tamor Gaznavi.

I lead Connexo.

It's a ALSP within the global law firm Eversheds Sutherland.

So my background is I'm an attorney, but I've spent most of my career in

the consulting space serving legal departments, everything from discovery

to investigations, cyber, privacy.

And then over the last ten years, really focused around

transforming legal departments.

Legal ops is really that core function that often owns that strategy and

the operating models and the tech and how that's really gonna go forward.

So my clients are all day, every day legal ops clients, but I also wear this

hat of being an ALSP within a law firm.

I am constantly looking for ways to improve our own

processes and technology stack.

So I have a lot of the same questions and same challenges

that many of my clients have.

So it feels like we're kind of figuring it out together at times-

Mm-hmm … which is a really fun and interesting, and sometimes

interesting or challenging place to be.

Yeah.

Yeah.

It's great that, to have both of you as leaders that can actually move

the needle within your companies having this conversation with us.

Yeah.

So thank you for that.

As you know, AI adoption is accelerating across legal departments from contract

review tools to generative AI assistance.

But here's the catch: just because we can deploy AI, it doesn't mean

that we should, at least not without the right governance in place.

I would love to hear your perspective because legal teams are adopting

AI so fast, and everyone's really excited about it, and it's constantly

in every topic we talk about.

But who's actually making sure it doesn't go sideways?

I'll start with this concept of the responsibility, I think, still lies with

individuals as a starting point, right?

Mm-hmm.

I think we was talking about this a little bit.

Policies are great- Yeah … but at the end of the day, you have humans that

are there to try and follow that policy.

Mm-hmm.

And I like to think about AI as just another lens on how we

were already managing our own data or processes or tools.

So this concept of data governance has already existed, right?

You have data owners, you have data stewards, you have people that are

responsible for different data points.

Mm-hmm.

Maybe it's in a contract, maybe it's who owns the liability clause

versus who owns the cyber privacy components of it, or who owns the

commercial and scope components of it.

Mm-hmm.

I think that model still makes sense in AI governance.

You have individuals that are the closest to those data points or those

processes own them, but they must be working in tandem cross-collaboration

with those other groups- Yeah … to make sure that any changes to their outputs

are still part of a broader outcome.

Mm-hmm.

Maybe that's a contract that drives the sale or purchase of an agreement or

a product, but I look at it that way.

Individuals own, they have to coordinate across, and then they all have to

come together to say, "Well, what does this lead to as a potential outcome?"

Hmm.

And I would just add to that, that I think- Based on that sort of

collaborative mindset and framework, it's really important to understand AI

governance is not just words on a page.

That's a policy that sits somewhere and likely is followed maybe half the time.

What you really need to have, I would argue, is have an ongoing governance

effort that's cross-functional, that involves all the different departments

that are interacting and using whatever AI tools you're using so that everyone

knows what each other is up to, how these tools are being used for what reasons.

And so we've clearly, clear lines of sight to different leaders, so therefore,

when you are using something and you need to make a change, you understand

how it's not just gonna impact your area, but others as well, and everyone

understands what each other is doing.

I think it's interesting how lawyers have kind of flocked to AI in

some ways, like moth to a flame.

They're all excited by it.

It's all bright and shiny.

They start using it, and a lot of them get burned by it, and I think that

speaks to the need to really understand these tools and have a really clear-eyed

view of what it is your intentions are with the tool before you start using

it, which then feeds into how you go about governing the use of those tools.

I think, I think that's a great point.

And the concept of being burned by AI is gonna happen to everybody at some point.

Yeah.

For better or worse, it happened a long time ago, so I've been

very cautiously optimistic every time- … something new is rolled out.

But it does feel different this time, right?

Yeah.

It feels like we're going further faster than ever, which just means

those guardrails need to be a little bit more broad to be able to

anticipate that next change or that next model or that next use case.

Mm-hmm.

But at the still time, be able to dive in and say, "Here's how I can

apply it to this new challenge that we haven't really seen exactly before."

Yeah.

I would just add one thing to that, which is just the fact that that speaks to the

need to be adaptive and dynamic- Mm-hmm … and not just operate in a static

environment thinking that that's just the way things are always going to be.

Yeah.

Yeah.

We clearly understand that not to be the case these days.

Yeah.

And that, again, speaks to why you need however you go about governance,

it needs to be an ongoing effort that changes and adapts as things evolve.

Yeah.

Excellent points, and actually there's like two follow-up questions I wanna ask.

But I'm gonna circle back to, Timur, you were talking about basically

cross-functional teams, like everyone needs to be on the same page and so forth.

This also begs the question, like, who owns it, right?

Who's gonna be responsible for this AI governance piece?

And personally, I feel like a lot of people rely on legal.

They're in charge of all the policy- Yeah … and they kind

of default to legal to own that.

First of all, do you agree with that?

And second of all- Who do you think- Yeah

in the company should be owning that AI governance piece?

I think legal is in a naturally great position to own the policy.

You're right, we do write it, we do get to see a lot of different use cases,

and different types of tech that come in, and have some component of it.

But to own the compliance of it, I think, is a different story, right?

And that's where I think you've got the kinda three legs.

You've got the policymakers, you've got the people that are trying to

actually follow it, and then you've got maybe a compliance org that can

actually go in and say, "Are you doing what you said you were going to do?"

Do.

Right?

Yep.

So that's why I think the three have to work together.

I also just personally like the idea of legal owning it,

because it gets you at the table.

Yeah.

And you get to be much more in a strategic role, as opposed to a reactive role.

Yeah.

So if my clients can do that, then they can go finally buy that one tech- Yeah

… or have that one initiative they wanted.

So it's good for legal overall.

I agree.

I think, you know, one thing I've learned in my legal career is that you

always wanna be proactive rather than reactive, and the only way that's gonna

happen is if you're at the table where the decisions are being made, rather

than finding about it after the fact.

As I said before, I agree that legal should be the owner, but it

also should be cross-functional.

So legal is the owner, but then these other functions are playing

a role in making decisions with regard to usage and everything.

But you as the lawyer are able to kind of understand what the desires are, what

the goals are, where people wanna be going, and you can help them get there-

Mm-hmm … as opposed to clean up a mess that they created without half the time

knowing that they've created a mess.

Just to add onto that, I think it's gonna be extremely important

for our legal industry overall to get outside of our normal boxes.

Because if we're- Mm-hmm … creating an AI governance policy for the whole

enterprise, what's really important to the business, maybe it's moving at

speed, is very different than what's gonna be important to us in legal

of maybe protecting risk, right?

So we're gonna have to give and be much more commercially minded as

we're creating these policies to say, "Look, we're not just gonna be the

brakes on this car, we're actually gonna help you go faster by putting

the right guardrails on these roads."

Mm-hmm.

"So instead of only going 30 miles an hour, now you're gonna actually

be able to go 60 miles an hour- Yeah

'cause we've created this road and these guardrails where you can

actually move really, really fast."

Yeah, and the challenge that I think arises from that is

it's a new era for lawyers.

Mm-hmm.

It's a new era for really anyone in the legal industry, and that

requires, I think, a mindset shift, a shift in the skills you have

that you can bring to the table.

Yeah.

Which is very easy to kinda point out, but gonna be really challenging going forward

to actually make a reality, because things are, are indeed moving quickly.

Yeah.

And the world is not waiting for legal or anyone- Yes … to catch up to it.

This episode is sponsored by Discernus.

When your team lands five hundred thousand documents in six languages,

keyword search won't cut it.

Discernus is AI native document intelligence that reads the full record,

maps every key entity, builds linked chronologies, and answers questions with

citations back to the exact passage.

Built for e-discovery scale, deployable on-prem when privilege demands it.

To learn more, visit discernus.ai.

AI is moving so quickly, and to have any type of policy almost seems

impossible because you constantly have to change it or update it.

Do you have any tips that maybe people can take away from?

Like, how would we come up with some sort of governance, either

playbook, policy that we can at least start and then build off of?

I would say start small.

Don't try to cover everything all at once.

Just start with one area, maybe one tool for one department or what have

you- Mm-hmm … depending on the size and complexity of your organization.

Mm-hmm.

And just see how that goes.

Yeah.

It can be a learning experience.

You start off by kind of developing maybe a small little committee or what

have you, starting off with a policy, getting people in the room- Mm-hmm

talking about it so it becomes a thing, people understand what it is.

And then from there, building off of that.

Because you don't build the house without having a foundation first.

You have to start really at the ground level and meet people where they are.

So if you don't have anything, having something is better than nothing, and

that something becomes even more valuable when it's something that people buy

into and is relatively small in scale, so you can use that as a jumping off

point to build further from there.

I'd add some guiding principles in there.

Mm.

Right?

So will this go directly to a client or will this go directly to a customer?

If so, never AI without human in the loop.

Like, just- Yeah … certain things, 'cause you're not gonna be able to get

every single use case and every single scenario perfectly written out, but these

conceptual things I think can be there, and then it's the constant training to

your workforce to say, "This is what this looks like for you in HR" Mm.

"Or this is what that looks like for you in sales," and so on.

The only other thing I'd say, we're talking about AI and how we have to

keep up with it- Yes … but our human capacity and brains are maybe not fast

enough to keep up with how fast things are changing and the documents that are

coming into us and the various ways.

We do also have AI to help us figure out how to get through all this data

really quickly and almost use AI to govern AI and components, right?

That is so interesting.

So I wonder if that's another avenue for us to start exploring,

looking at all the different clauses that are coming in from all these

different vendor contracts, right?

Looking at all the regulatory horizon and figuring out where we're actually gonna

come up with some proactive scenario planning as opposed to, it happened,

now let's figure out how to react.

Yeah.

Yeah, absolutely.

I can speak directly to that because we were talking before we began that a

lot of contracts I'm seeing now include AI clauses, and I use those actually

as, help me inform what I need to be doing with respect to governance and

just guardrails around use of AI.

'Cause those clauses tell me what these companies, some of which are

really large and sophisticated, are thinking about in terms of AI, in

terms of its usage, in terms of- Yeah … liability, ownership, all of

the things that we've been talking about.

Mm-hmm.

So I do encourage people to kind of look at the feedback, look at the

information coming into you, the clauses.

Let that inform you as to what you wanna be doing.

And as for one of the broader principles that you mentioned earlier, Taimour,

is human in the loop, I do think it's really important going forward to make

sure that humans are verifying outputs.

Mm-hmm.

Yes.

Because the bottom line with these tools is- They're imperfect.

I think we need to not thinking that just because it's called artificial

intelligence means it's intelligent in the same way that we as humans

think of us being intelligent.

Yes.

And just because it's a machine doesn't mean it's not gonna make mistakes.

It will.

Challenge is, those mistakes are gonna be a little more difficult to suss out

because the outputs look so believable.

Yeah.

Yeah.

But I do think there's the skepticism that's a part of kind of any lawyer

these days, I think actually can be quite helpful in that regard.

Yeah.

That is a good point.

We are naturally skeptics on this.

The better it gets, the better it looks.

Right.

Right?

Yeah.

And that's where that slight tweak in that language, that

actually means a lot to us- Mm-hmm

six months down the road.

When there is any type of dispute, you have to worry about, did somebody…

Do you believe them on their good faith, scout's honor- … that, "Hey,

I looked at it, and I read it- Yeah.

Yeah … and I put my human in the loop."

Yeah.

But actually now, the capacity that I have is actually maybe potentially

reduced, 'cause instead of taking one day to review one contract, AI reviewed

10 contracts for me, and I'm having to context switch and say, "Oh, now I have

to validate 10 contracts that came out."

And eventually, automation sometimes breeds laziness when I'm like,

"Well, this looks good enough.

Let it go."

So we're gonna have to continue to combat that, I think, as well.

Right.

Yeah.

Yeah, absolutely.

I mean, that could have another podcast episode on the whole idea-

… cognitive offloading and the- Yeah

dangers of over-reliance on AI- Yeah … which is a little outside

the scope of this conversation, but there is that danger, for sure.

Yeah.

Absolutely, and I love that you brought in the point about the human touch because

no matter what input you put into AI, there's always that human element that

just cannot be translated into a computer and have that provide you with an output.

So I love that you brought that up.

And pivoting a little bit, since you clearly do use it for, like, clauses

or however you use to draft whatever it is for your work, let's talk a

little bit on risk and how AI can be a risk in the work that you do.

And obviously, there's different types of risks that you can adopt using

AI, whether it's internally or using it for client-facing work products.

What are your thoughts on that, and how do you recommend people to use it so

that you don't end up putting yourself out there with high-risk documents?

So I see this on a daily basis 'cause I'm client-serving.

Mm-hmm.

So when I have to s- even think about, "Can I use AI for this use case?"

Mm-hmm.

I'm looking at our policy, internal policy.

That's great, but I'm also beholden to all of our outside council

guidelines from each individual client.

And then it's, "Well, is this even a good thing?

Should we use it for this?"

Yeah.

"'Cause what's it gonna do for our, our own team and capacity overall?"

So- I look at it from what would my client want to know

I'm doing at the end of the day?

Mm.

Right?

And if I'm telling them I'm be- delivering a service or some sort of

intelligence, would they care if that was coming 90% from AI versus from me?

Yeah.

And maybe they would.

Yeah.

Maybe would they value it differently, right?

So I look at it- Mm-hmm … from a client transparency perspective

first, and then I look at it like, okay, well, if they're okay with it,

now what are my other considerations?

Mm-hmm.

Is there a potential privacy consideration of where I'm actually

inputting this data, right?

Mm-hmm.

Is there a regulatory impact?

Like, I work with a lot of financial services clients.

There's sale size, and asset manager, and vendor contracts that are not

supposed to always be commingled, right?

So what am I doing from those perspectives as well?

Mm-hmm.

So I try to go down that ladder of thinking to say,

"Is my client okay with this?

Now, what are the all the other things I need to think about before I actually

move forward with an AI solution versus just a human-led solution?"

That's so interesting because I do think a lot of companies also ask

vendors, too, like, "Are you using AI?"

Yeah.

And that is part of their evaluation, so I'm actually glad you brought that up.

Colin, sorry, you were gonna say something?

Yeah.

I think that the way I look at risk in AI is I think about it in the context

of what are the people in my company Wanting to do, and how would they be

using essentially AI tools to get there?

And thankfully, we have company leadership has been very much on

top of this in terms of, "Here are the tools we want you to be using."

Mm-hmm.

"Here's what you can be doing, not be doing."

I've done a little bit of a training myself to the company as well.

It's not a huge company, so that helps.

So I kind of know what everyone is up to, for the most part.

Mm-hmm.

And I think what's also important is understanding that as much as you

may tell people what you should or shouldn't be doing, you know that

some people are gonna go a little bit off and do their own thing.

But thankfully, you can put guardrails in place around the tools, meaning that you

know what tools people are allowed to use.

You don't give them access- Mm … to other tools, and therefore, even if

they go a little bit off the rails, there's some degree of comfort in that.

But it's an ongoing kind of matter of, I think, monitoring and just checking

in with folks and that sort of thing.

Because it's not something you can kind of just sit back and assume people are just

gonna follow all the rules you lay out.

Yeah.

It's more a matter of just continuing to check in with people and see how

they're doing, and sussing out kind of how they're using some of these tools.

Which is- Mm … again, for a small organization, not that hard to do.

In a larger organization, that's when you really need to get on top of it

with having the governance be kind of a whole committee driven thing.

Yeah.

I would just add on to that.

I think back to where have we solved a similar problem before, and that's

is data leaving my organization in a way that I didn't want it to?

Mm.

And that's DLP tools, right, of is there exfiltration of data

going to an external party?

Mm.

And I know there are some tools that are coming out now that are similar

in saying like, "Hey, are you copying and pasting anything into a public

version of ChatGPT," for example.

Right.

Are we starting to have a new set of tools that are DLP, but shifted

towards public facing- Yeah … LMS or apps or anything like that?

I think we could take that policy, operationalize it with people,

but then also have that little bit of the trust but verify.

Like, I believe you- … but just in case, this is gonna flag it

if you try to go and paste- Yeah

it somewhere else.

Right.

Right.

Yeah.

So I think we're gonna have to look at all angles of it.

Yeah.

And the good news about that is there are actually now tools that

are specifically aimed at doing exactly what you just described- Yeah.

Mm-hmm … in terms of I trust you, but I'm gonna check in and see what

you're up to, that actually can check in on what people are doing.

Mm-hmm.

Not reading all the inputs necessarily, but just seeing,

okay, what tools are they using?

Mm-hmm.

Are these approved?

What information, types of information are being inputted?

That sort of thing.

Yeah.

Which is, I think, gonna become increasingly important, so I'm a big

believer in these tools because- They're gonna be increasingly helpful and useful.

Mm-hmm.

Because for better or for worse, there's gonna be a fair amount of

monitoring that's gonna be required going forward with respect to

AI usage in companies- Oh, yeah.

Absolutely … precisely to control the data leakage issue.

Yeah.

I'd bring this back just really quickly to the where legal's role,

if you provide the guardrails for your business to go fast- Mm-hmm

so they've got all the tools that they need, that risk of them saying, "I'm

not even getting what I need from work.

I'm gonna go outside and use my personal app or my personal account

for this"- Yeah … I think starts to decrease as you're enabling them to do

what they really want to do already.

Yeah.

Yeah.

Absolutely.

Yeah.

That is so interesting.

I guess I also have a follow-up question to that is how would you

suggest companies have some sort of alignment with data governance as well?

Because it's very possibly where legal feels a certain way on how

it should be governed, and then you have IT, because you were describing

the three pillars as well, right?

Yeah.

Of, like, who has the power.

If there's misalignment amongst the three, how would you suggest

to bring that alignment together?

It's a big challenge, to be honest.

I think the way you kind of help ensure alignment is by getting ahead of it.

Mm.

Meaning, that you bring everyone together and you have everyone, IT, legal- Yeah

procurement, whoever else you need to have, in a room- Mm-hmm … talking,

having initial discussion about, "Okay, how do you wanna go about this?

How do you wanna go about this?

How do you wanna go about this?"

Mm-hmm.

So you get everyone's sense of where they want to go, so therefore you

can pick up on, okay, where is there gonna be a little bit of a break here?

Yeah.

And how do we get people to come together?

I would also argue that a lot of this has nothing to do with

governance or goals or anything.

It's more a matter of understanding people, their personalities, and building

the relationships you ha- you can- Yeah … with the key stakeholders to ensure that

they're all buying into the same thing, and they all want to work with you.

They all want to do what you are wanting them to do- Mm-hmm … in a way, because

they see it as beneficial for them, and not just as beneficial for you telling

them that they should be doing that.

Yeah.

I'd agree.

The only other thing I'd add to that is, because we've seen this, and

when we're trying to bring multiple different groups together across

regions and across stakeholders, you do need a bit of tone at the top, right?

Mm.

Yeah.

What is C-suite telling you that is the most important

strategy for the enterprise?

And if you can't agree on what you, as an individual, or what you as a

group wanna do, you've gotta have a, an executive that's ready to say, "Okay,

here's what we're all driving towards.

Let's get on board."

And, yeah, that's gonna be a little bit of pain for you legal in this one- Mm

but then that's gonna be more pain for the IT org in this scenario, right?

So- Mm-hmm … top down, bottom up, I think, is the way to go there.

Yeah.

Yeah.

Absolutely.

I mean, a large part of this just comes down to culture, really.

Yeah.

And having a culture that's supportive- Yeah … precisely the

things that we've been talking about.

Yeah.

Yeah.

I love it.

Always goes back to having the right people in the room, having the right

stakeholders, aligning everything.

Absolutely.

Well, I do wanna bring this home and ask you guys a question to

provide a takeaway for our listeners.

So if you had to give a takeaway to all our listeners, what should we actually

be doing as part of legal ops right now to drive AI governance within our

own companies that we are part of?

I'd say progress, not perfection.

I think that's where I'm going, right?

Love it, yes.

So start somewhere, start tomorrow.

Mm-hmm.

If that's just understanding your lay of the land, build that inventory

of the tools from the bottom up, go talk to your IT team to figure

out what tools they're using.

Get that just understanding of where you are.

And if you're already past that, then it's saying, "Well, how

far do I wanna open my aperture?

What will I allow," right?

And then coming up with those use cases.

And the most advanced clients I've been speaking to are still around that area.

They've got their inventory, they've got some pilots, they've got things into

production, but they still have another 80 use cases potentially waiting behind.

So how far do they wanna go, and how fast do they wanna go?

So I'd start there.

Start somewhere.

And it has to start now, it sounds like.

Yeah.

Yeah, I would largely agree.

I would just add that I think you need to just take that first step.

So I think that if it's top of mind and you're just worried about, "Where do I go?

What do I start with?"

Just start with something, anything, and just start experimenting, actually.

Just try doing something and see where it goes, 'cause that will help inform

you going forward, because we all live off, off of information and data.

Mm-hmm.

And the best way to build an effective AI governance strategy and process and

ongoing procedure, what have you, is data.

Data driven by you understanding your org, your people- Mm-hmm … and

what they are trying to do.

Wow, that's perfect.

Thank you both.

Well, as you know, AI is transforming the way that legal departments

operate, but with that transformation comes responsibility, and both

of you have highlighted so well what that responsibility is, how

we can get started with it, and I really appreciate your time.

So that's it for today's episode of Clock Talk.

If you found this helpful, be sure to share it with your colleagues,

and stay tuned for more insights on the future of legal operations.

I'm Louisa.

Thank you for listening.