Welcome back to The AI Law Professor. Last month, I examined what happens when AI communicates ex parte with the judge and why hidden instructions in ordinary legal documents create a new candor and security problem. This month, I want to move from the document to the institution and ask a wider question: Which parts of an AI system can a law firm safely buy or rent, and which parts must become part of its own professional infrastructure?

The old binary choice has become a portfolio of decisions

For years, software was simple — a firm could build it or buy it. That still works for a timekeeping system or a document management platform, but AI has introduced many more options. A legal AI system is not one thing; rather it’s a stack of choices about the model, the place where inference runs, the data that informs the answer, the retrieval layer, the workflow integration, the permissions, the evaluation process, the security controls, and the necessary human approvals.

Consider a contract review workflow. A law firm might buy access to a frontier model, host the documents in a managed cloud environment, build its own clause ontology, connect the tool to the client's playbook, and require partner approval before any material risk call leaves the system. Calling that arrangement build or buy misses the point: The model is rented, and the legal memory, risk policy, audit trail, and feedback loop are built internally. The strategic decision lives in the orchestration of those layers.

Buy the capability that is becoming a commodity

Buying (or renting) should remain the default for capability that is rapidly commoditizing. General drafting assistance, first-pass research, deposition summaries, meeting notes, translations, basic document extraction, and administrative productivity all benefit from vendors that can serve models at scale, improve them continuously, and absorb much of the operational burden. Law firms should not train a model from scratch to summarize a lease, and a large firm should not turn every common office task into an internal engineering project.

Forewarned is forearmed when dealing with software vendors, however. A law firm should know whether prompts, logs, embeddings, and evaluation datasets can be exported. It should know when a model or pricing plan changes, and the vendor’s stance on client data, backups, and support. A firm also should know whether a vendor can use firm data for training, whether subcontractors can see it, and how the firm would operate if the service were unavailable tomorrow.

Build the layer that creates equity for the firm

Next, build on top of the foundation model. The scarce asset is not raw intelligence; rather it’s experience and context. A firm knows which facts are critical in its matters, which risks clients will tolerate, which arguments have worked, and which internal approvals are necessary. If that knowledge remains scattered across inboxes, memory, and old deal folders, the firm's AI will sound polished while staying institutionally shallow.

Build, buy, or both? For lawyers, the answer is all of the above — but choosing what mix of them is the best fit for your firm remains your judgment call.

The build layer is where legal value compounds. It includes curated precedent banks, matter records, permissions-aware retrieval, citation checking, privilege safeguards, escalation rules, prompt and response archives, and tests that measure whether the system performs the task safely enough. For example, a due diligence tool becomes more valuable when it knows the client's risk thresholds, marks a change-of-control clause against the client’s actual requirements, and records why a lawyer accepted or rejected terms.

That is professional judgment externalized and made operational. Over time, those acceptances, rejections, corrections, and escalations become the firm's training ground for better future judgment.

Make critical work sovereign ready

Sovereignty is often discussed as a question of national policy, but legal organizations need to consider it as well. Work done this year on sovereign AI by IDC Research offers a broad view as to what matters: control over AI design, deployment, access, operations, maintenance, governance, and the technical foundations beneath them. For a law firm, this requires the ability to keep control when the work is sensitive enough that losing control would harm the client, the firm, or the rule of law.

A sovereign-ready legal workload anticipates important questions. Where are client files, embeddings, logs, and backups stored? Who can legally access them? Can the firm run an approved alternative model if the primary provider changes terms? Who holds the keys, the incident logs, and the obligation to notify the client? Can the firm reconstruct what the system saw, what it did, and who approved the result?

Design a portfolio to capture the best of all worlds

The operating model I would recommend has three zones. In the buy zone, firms buy broadly available tools for low-risk productivity work that can be optimize for ease, adoption, and unit economics. In the hybrid zone, firms use commercial or open models behind their own retrieval, identity, policy, monitoring, and evaluation layers. And in the build zone, firms cover work that affects legal rights, privileged strategies, regulated decisions, or high-value client data. For this last act, firms require stronger jurisdictional control, documentation and logs, and clear operator responsibility.

This portfolio design approach avoids two expensive errors. The first is building commodity tools that vendors will improve faster and cheaper. The second is renting (and possibly inadvertently sharing) the institutional layer in which the firm’s long-term advantage grows.

The practical rule is simple enough to remember: Buy the intelligence that commoditizes and then build the institutional layer that creates equity.

Build, buy, or both? For lawyers, the answer is all of the above — but choosing what mix of them is the best fit for your firm remains your judgment call.

Tom Martin is CEO & Founder of LawDroid, Adjunct Professor at Suffolk University Law School, and author of the forthcoming AI with Purpose: A Strategic Blueprint for Legal Transformation (Globe Law and Business), where he shares exactly how you can build your own strategic habits and assets.‍