Law firms have traditionally treated technology as infrastructure: something that should be reliable, secure, and largely invisible to lawyers. That assumption is changing. Today, technology increasingly influences how legal work is researched, delivered, priced, protected, and even won. Managed IT for law firms has therefore evolved from keeping servers and laptops operational into a strategic discipline spanning cybersecurity, cloud infrastructure, AI governance, data protection, and business continuity. The shift is being accelerated by two forces at once: increasingly capable artificial intelligence and an expanding cyber-threat landscape.
The change is already visible across the legal sector. AI adoption is moving from isolated experiments toward operational use, while legal leaders are reassessing how technology affects client service and the economics of legal work. Deloitte’s 2026 research found that 61% of surveyed legal departments had reached an AI deployment stage, while 61% were experimenting with or piloting agentic AI. At the same time, firms are confronting the uncomfortable reality that the systems making them more productive can also create new attack surfaces and governance problems.
AI Is Changing the Economics of Legal Work
The first technology rethink concerns productivity. Lawyers spend enormous amounts of time on activities that require expertise but are also highly repetitive: reviewing contracts, searching large document collections, summarizing case materials, extracting clauses, comparing versions, and preparing first drafts.
Generative AI can compress parts of these workflows dramatically. But the strategic question is no longer whether an AI model can perform a task. The harder question is where AI should sit inside a firm’s operating model.
A useful implementation needs clear boundaries around confidential information, model access, human review, source verification, and accountability. A lawyer cannot simply accept an AI-generated answer because it sounds authoritative. Legal work demands traceability: where did the conclusion come from, what evidence supports it, and who is responsible for the final judgment?
This is why successful AI adoption increasingly looks less like purchasing software and more like redesigning workflows.
Thomson Reuters’ 2026 research highlights the gap between having an AI strategy and translating that strategy into practical commercial outcomes. For law firms, the real competitive advantage will not necessarily come from having the newest model. It will come from integrating AI into processes where it produces measurable improvements in turnaround time, consistency, risk identification, and client value.
Cybersecurity Is Becoming a Business Issue
Legal organizations are particularly attractive targets because they hold concentrated amounts of sensitive information: litigation strategies, intellectual property, merger documents, financial records, privileged communications, and personal data.
A successful breach can therefore damage far more than a firm’s IT environment. It can compromise client confidentiality, trigger regulatory obligations, interrupt casework, and undermine years of reputation-building.
The traditional perimeter-based security model is increasingly inadequate. Lawyers work from offices, homes, courts, airports, and client sites. Documents move through cloud platforms and collaboration tools. External counsel, vendors, clients, and contractors may all require controlled access.
A modern security strategy consequently needs multiple layers: identity and access management, multifactor authentication, endpoint protection, vulnerability management, encryption, continuous monitoring, backup, and incident response.
The key change is philosophical. Security should not be treated as a project that ends when a firewall is installed. It is an operating capability that must evolve as applications, employees, threats, and regulations change.
AI and Cybersecurity Are Converging
Perhaps the most interesting development is that AI and cybersecurity can no longer be considered separate technology programs.
AI creates new security risks. Sensitive documents may be exposed through poorly governed AI tools. Employees may unknowingly upload confidential material to consumer platforms. AI agents with access to internal systems introduce questions around permissions, authentication, and oversight.
At the same time, AI can strengthen defense. Machine-learning systems can identify unusual login behavior, detect suspicious endpoint activity, classify security alerts, and help security teams investigate incidents faster.
This creates a new requirement for IT architecture: AI needs to be integrated into a firm’s security model rather than bolted onto it afterward.
For law firms, that means establishing clear rules about which models can access which information, where data is processed, how prompts and outputs are handled, and when human approval is mandatory.
Legacy Technology Is Now a Strategic Constraint
Another reason firms are rethinking their technology strategy is the growing cost of legacy infrastructure.
Many legal practices still depend on systems accumulated over years through mergers, acquisitions, departmental purchases, or incremental upgrades. These environments can contain valuable business logic but may be difficult to integrate with modern cloud and AI platforms.
Replacing everything at once is rarely realistic. A more sophisticated approach is to map dependencies, identify critical systems, modernize selectively, and create secure integration layers between old and new environments.
Cloud migration can help, but moving workloads to the cloud without architectural planning simply relocates complexity. The objective should be a technology environment that is observable, scalable, recoverable, and capable of supporting future applications.
The IT Team’s Role Is Changing
Technology strategy also changes the role of IT itself.
The traditional help desk model—fixing laptops, resetting passwords, and responding to outages—remains necessary, but it is no longer sufficient. Modern legal IT needs to participate in decisions about business continuity, cybersecurity, cloud architecture, AI adoption, compliance, and technology investment.
This is particularly important for smaller and mid-sized firms that may not have the resources to maintain specialists across every technology discipline.
Managed IT can provide access to broader expertise while establishing standardized monitoring, security controls, support processes, and escalation procedures. For example, Andersen’s legal managed IT offering combines infrastructure management, end-user support, cybersecurity, cloud management, application support, and strategic IT consulting.
The value is not simply having someone available when something breaks. It is having an operating model designed to prevent problems from becoming business disruptions.
Technology Must Become Measurable
A modern technology strategy should also change how firms measure IT.
Counting help-desk tickets or server uptime provides useful operational information, but business leaders need broader metrics. How quickly can a new lawyer be onboarded? How much downtime affects billable work? How long does it take to detect and contain a security incident? How much time does AI actually save on a workflow? What percentage of critical systems can be recovered after an incident?
These measurements connect technology investment to business outcomes.
They also help firms avoid the opposite problem: buying technology because it is fashionable. AI spending, in particular, requires discipline. Thomson Reuters notes that firms investing strategically are better positioned to generate tangible returns than organizations adopting AI superficially.
The New Technology Strategy Is About Resilience
The most forward-looking law firms are therefore moving toward a broader concept of technology resilience.
Resilience means more than preventing cyberattacks. It means being able to continue serving clients when a cloud provider fails, an employee’s credentials are compromised, a critical application becomes unavailable, or an AI system produces an unreliable result.
That requires architecture, policies, trained employees, tested recovery procedures, and continuous monitoring working together.
In this environment, Andersen managed IT for law firms represents a model in which technology operations, cybersecurity, cloud infrastructure, application support, and strategic IT management are treated as one interconnected capability rather than isolated services.
The larger lesson is straightforward: law firms are no longer choosing technology simply to keep pace with competitors. They are choosing it to determine how resilient, secure, efficient, and adaptable their businesses will be. AI may be changing what lawyers can do, while cybersecurity is changing what firms must protect. The firms that connect those two realities—and build technology strategy around them—will be better positioned for the next decade of legal services.
