The ProSearch Pulse Volume 25

I've spent the better part of two years showing enterprise legal teams what AI can do in discovery. Our demos keep getting better. What I can put in front of a room today would have looked like science fiction eighteen months ago. What's changed is the reaction. It's closer to polite exhaustion now. Somebody watches an agent do something remarkable, nods, tells me it's impressive, and then goes back to their desk to reformat a privilege log export because opposing counsel wants the date fields a different way.

These are not slow organizations afraid of technology. Some of the sharpest thinking about AI in legal is happening in those rooms. Those same people answer to model risk, validation, security, data processing agreements, retention rules, old outside counsel guidelines, and procurement cycles measured in trimesters. Behind it sits a regulator who may eventually ask what you did and why.

And the docket keeps growing anyway. More matters, more data, more sources that did not exist five years ago, and flat budgets in the good years. Legal teams need to move faster inside organizations built to make new technology move slowly. That does not mean they have to wait eleven months to solve problems today.

The instinct is to go after the biggest pain point. Resist it. If the last article was about turning playbooks into skills, this is about choosing the first piece of the playbook worth automating. The biggest pain point is usually the hardest judgment call in the matter, which makes it the worst place to start. Use four questions instead: Do I do this in every matter of this type? Could I write down how to do it correctly in about two pages? Does doing it right actually require my license? Do I need access to production systems to do this?

As ProSearch deploys Legal Intelligence workflows for clients operating in the EU, one question comes up again and again: do any of these tools reach the EU AI Act and, if so, which ones? Corporate legal teams tend to assume the Act is aimed at generative applications like ChatGPT or Claude. But the Act defines an AI System far more broadly, and workflows that have been emerging in eDiscovery like automated image detection, automated redaction, and generative AI first-pass review can fall within its scope.

This article began with what seemed like a simple question during a conversation with outside counsel: what definition of AI should legal be using? Like many in the legal community, we turned to the EU AI Act, which is increasingly becoming the reference point for defining an AI system. But as I worked through the Act in detail as Chair of the AI Governance Committee, I found that the definition itself was not the most interesting part. What caught my attention were the layers underneath it, the rationale for classification, the distinction between provider and deployer roles, and the way obligations attach based not just on the technology, but on how organizations use and modify it.

That deeper analysis is rarely the focus of AI governance discussions, yet it is where many of the practical compliance questions for legal departments originate. Once a tool meets the definition of an AI system, the real work begins. Why does it fit within a particular risk tier? Who bears responsibility for compliance? What happens when a deployer customizes or builds upon an existing tool? These are the questions that motivated this series.

We begin with the foundation: the EU AI Act's risk-based framework and the four tiers that drive the regulation's approach to AI governance.

Adoption is settled. What separates firms that see a return from firms that write off the spend is the operational work after the purchase: the data the tool runs on, the workflows it has to fit inside, the governance that says who may use it for what, and the day-to-day management that turns a license into a capability.

Key insights

• In a Deloitte Legal June 2026 survey of 121 senior in-house leaders, 58% of general counsel said outside providers rarely or never raise AI benefits with them, and only 4% reported having directly experienced a benefit from a provider's AI use
• MIT's Project NANDA reviewed more than 300 AI initiatives and found roughly 95% of enterprise generative AI pilots delivered no measurable impact on the P&L, citing a learning gap when tools never integrate into workflow
• The operating principle is diagnosis before prescription: know the real state of data, security, and governance before layering AI onto an unstable foundation
• In McKinsey legal workflow examples cited in the piece, technology organized claims and recommended approaches, but people reviewed, adjusted, and signed, underwriting the decision with their own license

Why this matters for litigators and eDiscovery teams

Buying another platform does not create capability. Deployment shows up inside the workflow, measured at each step, with humans still accountable for the call. Firms that skip readiness assessment stay stuck in demos that stall the moment a real matter demands context.

How this aligns with what we are seeing at ProSearch

At ProSearch, we work with partners to turn legal data into strategic insight by designing workflows that can be validated before they hit production systems. Early planning, clear ownership, and a documented process matter more than another impressive pilot.

That diagnosis-before-prescription line lands next to Joe Pirrotta's four questions in this issue. Pirrotta tells teams to start with work that repeats, fits on about two pages, does not require a license, and can be proven outside production. The same industry analysis explains what happens when firms skip that screen: high adoption, low transformation, and a tool that never becomes a capability.

The EU is recalibrating how organizations phase into compliance with the AI Act. A new “Digital Omnibus on AI” (EU Regulation 1744/2026), applicable 27 July 2026, extends the timelines for watermarking and high-risk systems while keeping several transparency duties effective from 2 August 2026 for newly marketed AI.

Key insights

• The Omnibus moves watermarking obligations for AI-generated content to 2 December 2026, sets high-risk use case obligations for 2 December 2027, and pushes certain product safety-component AI duties to 2 August 2028.
• Transparency obligations under Article 50(1), informing users they are interacting with AI, and Article 50(4), deepfake disclosure, still apply from 2 August 2026 for AI systems placed on the market after that date.
• Draft Commission guidance on high-risk classification (Article 6) signals that broad marketing language and documentation can shape an AI system’s intended purpose, expanding what falls into high-risk scope.
• GPAI guidance introduces a compute-based test using training compute measured in FLOPS, with an indicative threshold of 10^23 FLOPs. Commission enforcement powers begin 2 August 2026, and legacy model compliance is due 2 August 2027.

For teams building or buying AI in the EU, the near-term workstream centers on the front-loaded transparency and positioning decisions. How capabilities are described, how intended uses are framed, and how agent disclosures are handled can influence classification and enforcement exposure well before the longer high-risk deadlines.

That timeline reset sharpens the argument Odette Nazarian Claridge makes elsewhere in this issue. The Omnibus pushes high-risk use-case obligations to 2 December 2027, but Article 50 transparency duties still apply from 2 August 2026 for newly marketed systems, so corporate legal cannot pause the classification work Claridge describes. Mayer Brown's note that broad marketing language can shape 'intended purpose' under Article 6 is the same practical risk Claridge flags when she tells teams to document where each eDiscovery workflow sits before obligations attach.