A Study into the Evolving Challenges in Regulating Artificial Intelligence and Machine Learning in the Future Legal Profession: Analysing Regulatory Gaps, Ethical Dilemmas and Adaptive Strategies

Introduction

Artificial intelligence and machine learning have moved from the periphery of legal practice to its operational core. Legal research platforms now employ natural language processing to surface precedent; law firms deploy predictive analytics to forecast litigation outcomes and settlement value; e-discovery software uses machine learning classifiers to review millions of documents in a fraction of the time required by human associates; and generative AI tools draft contracts, memoranda, and even pleadings with increasing sophistication. Courts in several jurisdictions have begun experimenting with algorithmic risk-assessment tools in bail and sentencing decisions, while online dispute resolution platforms increasingly mediate low-value consumer and small-claims disputes with minimal human intervention. This transformation is frequently described, following Susskind and Susskind (2022), as a shift from professional service delivered through the judgment of an individual expert toward service delivered through systems, a shift that carries profound implications for how the legal profession is regulated.

The regulatory architecture governing the legal profession, however, was designed for a world of individual human practitioners bound by licensing regimes, codes of professional conduct, malpractice liability, and disciplinary oversight. That architecture assumes an identifiable, accountable actor whose competence can be tested, whose conduct can be audited, and whose reasoning can, at least in principle, be reconstructed and reviewed. AI and ML systems disrupt each of these assumptions. Machine learning models, particularly deep neural networks, are frequently opaque even to their own developers, a phenomenon widely described as the ‘black box’ problem (Pasquale, 2015; see also Zittrain, 2019). Their outputs are probabilistic rather than deterministic, their performance drifts as they are retrained on new data, and responsibility for their errors is diffused across developers, vendors, law firms, and end users in ways that existing tort, agency, and professional-responsibility doctrines struggle to allocate.

Against this backdrop, regulators worldwide are attempting, unevenly and often belatedly, to construct governance frameworks that can accommodate the benefits of AI while containing its risks. The European Union’s Artificial Intelligence Act, adopted as Regulation (EU) 2024/1689 and in force since 1 August 2024 with its principal obligations phased in over the years that follow, represents the most comprehensive attempt to date to regulate AI through a risk-tiered framework (European Union, 2024). Bar associations in the United States, the United Kingdom, and elsewhere have issued ethics opinions and practice guidance addressing lawyers’ duties of competence and confidentiality when using AI tools (American Bar Association, 2019, 2024). Yet these efforts remain fragmented, reactive, and frequently outpaced by the speed of technological change. This study interrogates that fragmentation. It asks what the principal regulatory gaps are in governing AI and ML within the legal profession; what ethical dilemmas those gaps generate for practitioners, clients, and the administration of justice; and what adaptive strategies are emerging, or ought to emerge, to close the distance between technological capability and regulatory capacity.

The study is organized as follows. Section 2 reviews the existing literature on AI governance, legal technology, and professional ethics. Section 3 identifies the research gap and articulates the objectives and research questions of the study. Section 4 sets out the qualitative research methodology. Section 5 presents a thematic qualitative analysis organized around regulatory gaps, ethical dilemmas, and adaptive strategies. Section 6 discusses the findings and their implications, and Section 7 concludes with recommendations for regulators, bar associations, and the legal profession.

Review of literature

The literature relevant to this study spans legal technology, AI governance, professional ethics, and administrative law. The review that follows synthesizes twenty-two key contributions.

Susskind and Susskind (2022) argue in The Future of the Professions that AI and automation are progressively displacing the traditional ‘grand bargain’ between the professions and society, under which professionals were granted monopolies over practice in exchange for competence and trustworthiness. The authors contend that this bargain becomes unsustainable once machines can perform many expert tasks more reliably than humans, and that new forms of accountability, not tied to individual professional judgment, are therefore required.

Susskind (2023), in the third edition of Tomorrow’s Lawyers, documents the proliferation of AI-based legal service providers and online courts, arguing that regulators and law schools have been slow to adapt their frameworks to a legal marketplace increasingly mediated by software rather than solely by licensed practitioners.

Pasquale (2015) introduces the concept of the ‘black box society’, demonstrating how proprietary algorithms that shape consequential decisions, including legal and financial outcomes, resist scrutiny by regulators, courts, and affected individuals, and thereby undermine traditional due-process protections.

Calo (2017) provides an early comprehensive policy roadmap for AI regulation, cautioning against both premature over-regulation that could stifle beneficial innovation and under-regulation that leaves emergent risks unaddressed, and calling for interdisciplinary institutional expertise within government, including a dedicated expert body, capable of keeping pace with AI developments.

Scherer (2016) analyzes the distinctive regulatory challenges posed by AI, including its diffuse development process, its discontinuous and unpredictable capability growth, and the difficulty of testing it ex ante, and proposes a certification-based model of indirect regulation under which the availability of limited liability protection is conditioned on demonstrated safety compliance.

Bathaee (2018) examines how the ‘black box’ character of AI undermines the intent and causation requirements central to much of American law, arguing that legal doctrines built around human intentionality require substantial reconceptualization if they are meaningfully to govern autonomous decision-making systems.

Citron (2008) develops the concept of ‘technological due process’, arguing that automated decision-making systems used in government and regulatory contexts must be subject to procedural safeguards of transparency, contestability, and auditability equivalent to those historically owed to individuals in administrative adjudication.

Citron and Pasquale (2014) extend that analysis to algorithmic credit-scoring and predictive-risk systems, contending that the ‘scored society’ requires new due-process mechanisms to prevent opaque, biased, and unaccountable automated judgments from becoming de facto legal determinations.

Cath (2018), introducing a themed collection on AI governance, surveys its ethical, legal, and technical challenges and identifies persistent tensions between innovation-friendly ‘soft law’ approaches such as ethics codes and guidelines and the enforceability gaps that leave such instruments without meaningful sanction for non-compliance.

Floridi et al. (2018) propose the AI4People framework, synthesizing AI ethics principles into five core values of beneficence, non-maleficence, autonomy, justice, and explicability, and arguing that explicability functions as an enabling condition without which the other four cannot be operationalized or verified.

Wachter, Mittelstadt, and Floridi (2017) offer a critical legal analysis of the European General Data Protection Regulation, concluding that its provisions do not establish a binding ‘right to explanation’ for automated decisions and that a significant gap therefore separates popular expectations of algorithmic accountability from actual legal entitlements.

Yeung (2018) interrogates the concept of ‘algorithmic regulation’, offering a taxonomy of its forms according to the way each configures the standard-setting, monitoring, and behaviour-modification stages of a cybernetic control system, and questioning the legitimacy of governance that operates through automated, data-driven feedback rather than through deliberative legal reasoning.

Hildebrandt (2015) argues in Smart Technologies and the End(s) of Law that pervasive computing and machine learning are reconfiguring the normative structure of law itself, shifting regulatory logic from textual rules interpreted by humans toward code-embedded constraints that pre-empt rather than adjudicate conduct.

Bostrom and Yudkowsky (2014) examine foundational ethical questions in AI design, including transparency, predictability, and the allocation of moral and legal responsibility for the decisions of autonomous systems, providing a conceptual basis for later legal-professional applications of AI ethics.

Remus and Levy (2017) empirically assess claims that AI will replace lawyers, concluding that while automation substantially affects document review, research, and routine drafting, the core relational and judgment-intensive functions of legal practice remain resistant to full automation, even as the regulatory boundaries of the profession around the unauthorized practice of law are increasingly tested.

Surden (2019) provides a doctrinal overview of the application of AI within law, cautioning against overstating the reasoning capacities of current machine learning systems and emphasizing that most legal AI tools perform pattern recognition rather than genuine legal reasoning, a distinction with direct implications for professional-competence standards.

Casey and Niblett (2016) advance the concept of ‘self-driving laws’, under which legal rules are dynamically updated through data-driven micro-directives, raising concerns about legitimacy, predictability, and the diminished role of legislative and judicial deliberation in rule formation.

Katz (2013) examines the rise of quantitative legal prediction, arguing that data-driven forecasting tools are transforming legal service delivery and client expectations of certainty, while noting the absence of professional standards governing the reliability and disclosure of such predictions.

Re and Solow-Niederman (2019) analyze the prospect of ‘artificially intelligent justice’, distinguishing between AI as an aid to judicial decision-making and AI as a substitute for it, and arguing that wholesale judicial automation would compromise the qualitative, reason-giving character that legitimizes adjudication.

Reidenberg (1998), in an early foundational contribution, introduces the concept of lex informatica, arguing that technological architecture itself functions as a rule-making force parallel to formal law, a proposition later scholars have applied directly to algorithmic governance in legal and regulatory contexts.

Barfield and Pagallo (2018), editing the Research Handbook on the Law of Artificial Intelligence, compile comparative analyses of liability, intellectual property, and regulatory approaches to AI across jurisdictions, highlighting the absence of harmonized international standards as a persistent structural gap.

Braun and Clarke (2006) establish thematic analysis as a rigorous method for identifying, analyzing, and reporting patterns within qualitative data, providing the methodological foundation for the thematic coding approach adopted in AI-governance and socio-legal research, including the present study.

Taken together, this body of literature establishes three convergent insights that inform the present study. The opacity and probabilistic character of AI strain doctrines of intent, causation, and due process that presuppose human accountability. Existing ethical frameworks, whether embedded in professional conduct rules or in soft-law AI ethics principles, remain largely aspirational and are not consistently backed by enforceable standards. And the regulatory responses proposed so far range from certification and risk-tiering to algorithmic auditing and technologically embedded rules, without any consensus yet on which combination of strategies is best suited to the legal profession specifically, as distinct from AI governance in general.

Research gap and objectives

While a substantial literature addresses AI governance generally, and a smaller body addresses the disruptive effect of AI on legal practice, few studies integrate the two by systematically mapping regulatory gaps, ethical dilemmas, and adaptive strategies as they specifically manifest within the distinctive regulatory architecture of the legal profession, namely licensing, professional conduct rules, malpractice liability, and court oversight. This study addresses that gap by offering an integrated, qualitative analysis specific to the regulatory context of the legal profession.

The objectives of this study are, first, to identify and analyze the principal regulatory gaps affecting the governance of AI and ML tools used in legal practice; second, to examine the ethical dilemmas that those gaps generate for lawyers, clients, courts, and the administration of justice; and third, to evaluate emerging and proposed adaptive strategies through which regulators and the profession may reconcile innovation with core professional duties.

Accordingly, the study is guided by three research questions. RQ1 asks what gaps exist in current regulatory frameworks governing AI and ML in the legal profession. RQ2 asks what ethical dilemmas arise from the deployment of AI and ML in legal practice and adjudication. RQ3 asks what adaptive regulatory and professional strategies are being developed, or should be developed, to address those gaps and dilemmas.

Methodology

A. Research design

This study adopts a qualitative, doctrinal-cum-analytical research design, consistent with established approaches to socio-legal and policy-oriented qualitative inquiry (Creswell & Poth, 2018). A qualitative design is appropriate because the research questions concern the interpretation, meaning, and adequacy of regulatory texts and professional norms rather than the measurement of quantifiable variables. The study does not seek statistical generalization; it seeks analytical and theoretical insight into how existing regulatory and ethical frameworks address, or fail to address, the governance of AI and ML in legal practice.

B. Data sources

Data for this study were drawn exclusively from secondary sources, purposively selected for their relevance to AI regulation and legal-professional ethics. These sources comprise four categories: primary legal and regulatory instruments, including the Artificial Intelligence Act of the European Union, the AI principles of the Organisation for Economic Co-operation and Development [OECD] and the United Nations Educational, Scientific and Cultural Organization [UNESCO], and national AI strategy documents; professional conduct materials, including bar association ethics opinions and rules of professional conduct addressing the use of technology by lawyers; judicial and quasi-judicial pronouncements concerning algorithmic decision-making; and peer-reviewed scholarly literature on AI governance, legal technology, and professional ethics, as synthesized in Section 2.

C. Sampling

A purposive sampling strategy was employed to select sources. The inclusion criteria required that a source directly address the regulation, governance, or ethical implications of AI or ML within a legal, professional, or adjudicative context, and that it be publicly accessible and traceable to an identifiable regulatory, judicial, or scholarly authority. This non-probabilistic sampling approach is consistent with qualitative doctrinal research, where the objective is conceptual saturation and analytical depth rather than representativeness across a sampling frame.

D. Data analysis: thematic qualitative analysis

Data were analyzed using thematic analysis, following the six-phase approach articulated by Braun and Clarke (2006): familiarization with the source material; generation of initial descriptive codes such as ‘opacity’, ‘liability diffusion’, ‘unauthorized practice’, ‘algorithmic bias’, and ‘certification’; collation of codes into candidate themes; review and refinement of themes against the full data corpus; definition and naming of final themes; and production of the analytical narrative presented in Section 5. Three overarching themes were identified through this iterative coding process, corresponding to the three research questions of the study: regulatory gaps, ethical dilemmas, and adaptive strategies. Each overarching theme was further disaggregated into sub-themes, presented in Section 5.

E. Trustworthiness and limitations

Analytical rigour was supported through source triangulation across regulatory, judicial, and scholarly materials, and through an audit trail of coding decisions. Limitations inherent to the design should nonetheless be acknowledged. Reliance on secondary and publicly available sources means that the study cannot capture undocumented or informal regulatory practice. The pace of AI regulatory development means that some primary instruments discussed may be superseded by subsequent amendment. And, as with all qualitative thematic analysis, coding and theme construction involve a degree of interpretive judgment on the part of the researcher, which was mitigated through iterative theme review but cannot be eliminated entirely.

Qualitative analysis

A. Theme one: regulatory gaps

The first theme concerns the structural mismatch between existing regulatory architecture and the characteristics of AI and ML systems. Three sub-themes emerged.

Static rules governing dynamic systems. Professional conduct codes and licensing regimes were designed around a stable conception of practice, that of an identifiable lawyer performing a defined task. Machine learning models, by contrast, are continuously retrained, and their behaviour can drift over time even without a formal ‘update’, a phenomenon that rule-based licensing and periodic audit regimes are poorly equipped to monitor (Scherer, 2016). The result is a temporal gap: regulatory approval or ethical clearance obtained at deployment may no longer accurately describe the behaviour of the system months later.

Diffused accountability. Responsibility for the output of an AI tool in legal practice is distributed across the software developer, the vendor, the supervising lawyer, and sometimes the client, none of whom individually possesses full visibility into the design or training data of the system. Existing malpractice and agency doctrines, built around a single accountable professional, struggle to allocate liability coherently across this chain (Bathaee, 2018; Citron & Pasquale, 2014).

Jurisdictional fragmentation. Regulatory responses vary considerably across jurisdictions, from the comprehensive risk-tiered statutory approach of the European Union to the more fragmented, guidance-based approach adopted by many common-law bar associations. This fragmentation creates compliance uncertainty for cross-border legal practice and for legal technology vendors, and it leaves gaps where no single regulator possesses jurisdiction over the full lifecycle of a legal-AI product (Barfield & Pagallo, 2018).

B. Theme two: ethical dilemmas

The second theme concerns the ethical tensions that regulatory gaps generate for legal practitioners and for the justice system.

Competence and supervision. Rules of professional conduct in most jurisdictions require lawyers to maintain competence, which is increasingly interpreted to include a baseline understanding of the AI tools they deploy (American Bar Association, 2024). Yet the opacity of many ML systems means that even a diligent, technologically literate lawyer may be unable fully to verify or explain the output of a tool, creating tension between the duty of competent supervision and the practical impossibility of complete algorithmic transparency (Pasquale, 2015; Surden, 2019).

Confidentiality and data governance. AI tools, particularly cloud-based generative systems, often process client data on third-party infrastructure, raising concerns about privilege waiver, data retention, and unauthorized secondary use. Existing confidentiality rules, drafted before such tools existed, address those concerns only by extension and analogy.

Bias, fairness, and access to justice. Predictive and risk-assessment tools trained on historical data risk encoding and perpetuating existing social and demographic biases, with disproportionate consequences in contexts such as bail, sentencing, and eligibility determinations (Citron, 2008; Citron & Pasquale, 2014). At the same time, AI-enabled low-cost legal services hold the potential to expand access to justice for underserved populations, creating an ethical tension between caution regarding algorithmic fairness and the professional obligation to widen access to legal services (Susskind, 2023).

Erosion of reasoned judgment. Where AI tools inform or substitute for adjudicative reasoning, concerns arise about the loss of the deliberative, reason-giving character that legitimizes judicial and quasi-judicial decisions, a concern squarely raised in the literature on ‘artificially intelligent justice’ (Re & Solow-Niederman, 2019).

Unauthorized practice of law. As AI-based platforms increasingly perform functions historically reserved to licensed practitioners, including document drafting, the generation of legal advice, and dispute resolution, the boundary between permissible legal-technology assistance and the unauthorized practice of law becomes increasingly difficult to police, exposing both technology providers and supervising lawyers to uncertain liability (Remus & Levy, 2017).

C. Theme three: adaptive strategies

The third theme captures strategies, both emergent and proposed, through which regulators and the profession are seeking to close the gaps identified above.

Risk-tiered regulation. Following the model of the Artificial Intelligence Act of the European Union, several jurisdictions are moving toward calibrating regulatory intensity to the risk level of a given AI application, subjecting high-risk applications, such as those affecting eligibility, sentencing, or fundamental rights, to more stringent transparency, documentation, and human-oversight requirements than lower-risk applications such as basic legal research tools (European Union, 2024).

Algorithmic auditing and certification. Building on the certification proposal advanced by Scherer (2016), professional bodies and technology-standards organizations have proposed independent auditing regimes under which AI tools used in legal practice would be periodically tested for accuracy, bias, and robustness as a condition of continued deployment, shifting compliance from a one-time approval event to an ongoing obligation.

Embedding technological competence within professional conduct rules. Bar associations in a growing number of jurisdictions have amended or interpreted their duty-of-competence rules to encompass expressly a working understanding of relevant technology, coupled with continuing legal education on AI tools, thereby integrating technological literacy directly into the existing disciplinary framework rather than creating a wholly new regulatory regime (American Bar Association, 2019, 2024).

Human-in-the-loop requirements. A recurring adaptive strategy across both judicial and professional contexts is the mandated retention of meaningful human review over AI-assisted outputs, particularly in adjudicative or advisory contexts, so that the reason-giving and accountable character of legal judgment is preserved even as AI performs supporting analytical functions (Yeung, 2018).

Cross-border regulatory cooperation. Given the jurisdictional fragmentation identified in the first theme, scholars and international bodies advocate greater harmonization of AI governance standards through instruments such as the OECD AI Principles and the UNESCO Recommendation on the Ethics of Artificial Intelligence, with the aim of reducing compliance uncertainty for legal-technology providers operating across borders (Council of Europe, 2020; Organisation for Economic Co-operation and Development, 2019; United Nations Educational, Scientific and Cultural Organization, 2021).

Discussion of findings

The thematic analysis suggests that the challenges of regulating AI and ML in the legal profession are not merely technical but structural: they arise from a fundamental mismatch between the assumptions embedded in existing professional-regulatory architecture and the operational characteristics of learning systems. Three implications follow. Incremental adaptation of existing professional conduct rules, by embedding technological competence requirements for instance, addresses some ethical dilemmas but does not resolve the deeper structural gap of accountability diffused across the AI supply chain. Risk-tiered and certification-based regulatory models, while promising, require an institutional capacity for ongoing algorithmic auditing that many bar associations and judicial bodies currently lack. And, perhaps most significantly, the tension between the potential of AI to expand access to justice and the risk of algorithmic bias cannot be resolved through prohibition or unconditional embrace; it requires a differentiated, risk-sensitive approach that treats access-oriented and adjudicative applications of AI differently.

The findings also suggest that adaptive strategies are most likely to succeed where they are professionally embedded, that is, integrated into existing disciplinary and licensing structures, rather than imposed as freestanding technical regulation disconnected from professional accountability. This is consistent with the observation in the literature that soft-law AI ethics principles, however well intentioned, have limited practical effect absent enforceable professional or statutory backing (Cath, 2018; Floridi et al., 2018).

Conclusion and recommendations

This study has examined the evolving challenges of regulating artificial intelligence and machine learning within the legal profession through a qualitative, thematic analysis of regulatory gaps, ethical dilemmas, and adaptive strategies. The analysis demonstrates that existing regulatory frameworks remain largely reactive and fragmented, that ethical dilemmas cluster around competence, confidentiality, bias, and the erosion of reasoned judgment, and that the most promising adaptive strategies are those that embed technological oversight within existing professional-accountability structures rather than treating AI governance as a wholly separate regulatory domain.

On the basis of these findings, the study offers the following recommendations.

Bar associations and regulatory bodies should adopt risk-tiered oversight requirements calibrated to the consequential impact of a given AI application on client and public interests, rather than applying uniform rules across all legal-AI tools.

Periodically updated continuing legal education on AI competence should be integrated into licensing renewal requirements, so that the duty of technological competence is not merely aspirational but institutionally enforced.

Independent algorithmic auditing mechanisms should be developed in cooperation with technical standards bodies, with particular priority given to high-risk applications such as predictive sentencing and eligibility-determination tools.

Human-in-the-loop safeguards should be codified as a professional-conduct requirement for any AI-assisted output that materially affects the legal position of a client or the rights of a litigant.

International regulatory cooperation should be pursued to reduce jurisdictional fragmentation, particularly for legal-technology vendors and law firms operating across borders.

Future research should undertake empirical, practitioner-facing qualitative inquiry, through interviews or surveys of practising lawyers, regulators, and legal-technology developers, to test and refine the doctrinal findings of the present study against lived professional experience, and should track the evolving implementation of risk-tiered frameworks such as the Artificial Intelligence Act of the European Union as they mature over the coming years.

*****