Over the past decade, most law firms have moved email, documents and collaboration into Microsoft 365. It was the right call: more secure, more flexible and easier to run than what came before.
Now Microsoft is offering the next step. Copilot sits inside Word, Outlook, Excel and Teams. It summarises bundles, drafts first versions of letters and, increasingly, runs agents that carry out multi-step tasks in the background. For a managing partner or COO drowning in operational friction, it is a compelling pitch.
For most firms, the question is no longer whether to use Copilot. It is how to adopt it without handing over control of three things that matter: your costs, your firm’s knowledge, and your ability to change direction later.
Convenience is valuable. But in AI, convenience you have not governed has a habit of becoming dependency you cannot unwind.
Why this decision is happening now
AI is no longer a pilot project in the legal sector. Law Society figures show the share of UK lawyers using generative AI rose from 46% to 61% in around eight months. Whether or not a firm has a formal AI strategy, its people are already using these tools.
The regulator has noticed. In August 2026 the SRA issued a warning notice on the use of AI, reminding solicitors that their professional duties apply in full, and reported 42 cases of AI misuse in the previous year. Confidentiality, competence and supervision obligations do not pause because a tool is built into Word.
At the same time, Microsoft has changed how AI is paid for. A Copilot licence is a fixed per-user cost, but agents and the newer Copilot Cowork capabilities are billed by usage, through Copilot Credits. That shifts part of AI spend from a predictable line item to a variable one.
Three traps, and the control for each
1. The metered-cost trap
The risk. Agents do not keep office hours. A background agent working through a multi-step task consumes credits every time it acts: Microsoft’s published rates include 1 credit for a classic answer, 2 for a generative answer and 5 for an agent action. For firms working on fixed fees, uncontrolled AI consumption is a cost that lands on the matter, not the client.
The control. Microsoft provides the guardrails, but they are not on by default. Administrators can set spending limits, view consumption in the Microsoft 365 admin centre and cap monthly credits on individual agents. Decide deliberately between pay-as-you-go and prepaid credits, set a hard monthly limit, and review usage alongside matter profitability.
2. The agent lock-in trap
The risk. A firm’s real competitive asset is its know-how: precedents, clause banks, checklists and the way it runs matters. Most of that lives in the document management system, not in Copilot. The lock-in risk comes from what firms build on top: custom agents, prompts and automated workflows that encode the firm’s methods inside one platform’s tooling. Build enough of those without documentation and moving away, or even changing approach, becomes a project in itself.
The control. Keep the source of truth in your document management and practice management systems, in formats you can export. Document every agent and workflow you build: what it does, what data it uses, who owns it. And before committing to any advanced AI tooling, ask one question at the risk committee: what would it cost us to leave?
3. The off-the-shelf-as-strategy trap
The risk. Switching on Copilot feels like digital transformation. In practice, the same tools are available to every competitor on the same terms. Licensing them is an upgrade to your office suite, not a strategy.
The control. Use Copilot for what it does well across the firm: summaries, first drafts, meeting notes, admin. Then invest your effort in a small number of workflows specific to your practice areas, where your precedents and judgement make the difference. That is where advantage comes from, and it is where your firm should own the logic.
A practical checklist before you scale Copilot
- Fix permissions first. Copilot can see whatever a user can see. Over-shared SharePoint sites and Teams channels become visible in seconds. Review access, apply sensitivity labels and set retention policies before rollout, not after.
- Write an AI policy that matches the SRA’s expectations. Set out permitted uses, prohibited uses, client confidentiality rules, human review and who is accountable. Make sure supervisors know how to check AI-assisted work.
- License by role, not by enthusiasm. Give Copilot to the people who will use it, measure adoption through usage reports, and reassign idle licences at renewal.
- Turn on cost controls. Set spending limits and per-agent caps for metered features, and make one person responsible for reviewing consumption each month.
- Keep a register of agents and workflows. Record purpose, owner, data used and how it would be rebuilt or replaced.
- Agree your exit test. For any significant AI investment, document how the firm would extract its data and logic if the vendor’s pricing, terms or direction changed.
Adopt with your eyes open
Copilot is a capable tool, and for most Microsoft 365 firms it will become part of everyday work. The firms that benefit most will not be the ones that switched everything on first, or the ones that held out longest. They will be the ones that adopted deliberately: with permissions in order, costs capped, knowledge kept in systems they control, and a clear view of how they would change course if they needed to.
Use the tools to save time. Keep your hands on the wheel.
Book a Copilot readiness and governance review
Quiss helps UK law firms adopt Microsoft AI safely and cost-effectively. Our readiness review checks your permissions and data exposure, your licensing and consumption settings, and your AI policy against SRA expectations, and gives you a clear plan before you scale. Talk to our team.
Sources:
Like what you read?
