The General Counsel AI Report, October 2026

Answer in one sentence: Every material production agent needs a legal record that connects authority, contract terms, identity, data access, actions, human review and incident evidence to the same deployed system.

What this report owns

This report focuses on the records counsel may need for contracting, attribution, disputes, incidents and governance. It does not infer legal noncompliance from a reported access method, and the practical checklists must be adapted to the relevant facts, contracts and jurisdictions.

Key October evidence

• Thirteen percent of common-instrument respondents report no single AI buying owner (base 467, any mention).
• Eighty percent of AI Leaders respondents report at least one production agent (base 75).
• Among applicable AI Leaders responses, 37 percent use shared service accounts and 14 percent use delegated identity or credential-free or brokered access (base 49).
• AI Leaders respondents name governance and approval as a production bottleneck at 21 percent, and agent identity and permissions at 15 percent (base 75, any mention).
• Sixty-eight percent of CISO-instrument respondents name securing AI agents and their access as a top problem (base 151, any mention).

Evidence sources: See the CISO AI Leverage Report for the security instrument, the AI Leaders AI Leverage Report for production access evidence and Executive AI Statistics for complete distributions and provenance.

What October adds, and what it cannot establish

October adds current production-agent access and bottleneck evidence to the legal-governance synthesis. It also gives counsel a clearer reason to connect policy and contract language to a live system record: 80 percent of AI Leaders respondents report at least one production agent (base 75), while reported access methods vary among the 49 applicable responses.

The data cannot establish whether a respondent violated law, policy or contract. A shared service account can be implemented with narrow privileges and workload-level logs; a per-agent credential can still be overprivileged or poorly monitored. Similarly, a respondent naming data leakage or shadow AI as a top problem is reporting a concern, not confirming an incident. This report uses those answers to frame discovery and evidence questions, never to infer liability.

Working definitions for counsel

The company should align these working definitions with its policy, sector, contracts and jurisdictions. Consistent definitions are especially important during an incident, when “agent,” “owner,” “approval” or “log” may otherwise mean different things to engineering, security and legal teams.

Why the agent record matters

When an AI agent is implicated in harm or a dispute, counsel may need to establish who authorized it, who owned the workflow, which deployed system acted, what credential it used, what data it accessed, which tools it invoked, whether a person reviewed the action and how the contract allocates responsibility. A general policy cannot answer those fact-specific questions by itself.

Purchase approval and operating accountability are also different records. Thirteen percent report no single AI buying owner (base 467, any mention). Even when a signer is clear, the business, technical, security and legal owners for a production system may sit elsewhere.

Attribution and access evidence

The chart shows the full 71-response distribution: per-agent credentials 34 percent, shared service accounts 25 percent, delegated identity 6 percent, brokered access 4 percent and not applicable 31 percent. The table below excludes the 22 “not applicable yet” responses and re-bases the four access methods to the 49 applicable respondents.

Base 49 applicable responses. These percentages are intentionally different from the full-base chart because the denominator excludes 22 “not applicable yet” responses.

A shared service account does not establish noncompliance, but it can make attribution harder when several agents or workflows use one identity. Delegated or brokered access can support attribution only if the implementation preserves the relevant actor, authority, scope and action records.

General counsel control matrix

These figures come from separate instruments and do not establish the legal posture of any respondent or company.

Unauthorized use, data leakage and discovery

Data leaking into AI models is named by 29 percent of CISO-instrument respondents and shadow AI by 28 percent (base 151, any mention). These lines are close in share but describe different legal and operational questions. Leakage concerns what data entered or left a system, under what rights and protections. Shadow AI concerns whether the use was visible to, and approved through, the organization's governance path. One can occur without the other.

Policy implications

A usable policy should tell an employee or system owner more than “do not put confidential data into AI.” It should identify approved and prohibited use classes, relevant data categories, procurement or intake routes, human-review expectations, recordkeeping, escalation and the consequences of bypassing required controls. Risk tiers can prevent low-risk uses from overwhelming the same process used for customer-facing or action-taking systems.

Policy should also define who can grant an exception, how long it lasts and what evidence is retained. Otherwise an exception can become a permanent operating state without an owner. For agents, authorization should address both data access and action scope: reading an approved source is different from changing a system of record, sending a customer communication or committing funds.

Discovery implications

Counsel does not need to operate every discovery control, but it should know what evidence can be produced. A practical discovery map covers:

1. approved vendor and model inventory;
2. identity-provider, browser, network, expense and application signals used to find unregistered use;
3. the workflow for validating a signal and distinguishing personal, experimental and production activity;
4. the record of notice, investigation, exception, remediation or approval;
5. preservation and access rules for prompts, outputs, tool calls and related logs; and
6. the route for employee, customer or vendor reports.

Discovery should be proportionate and consistent with employment, privacy and monitoring law. A signal is not proof of misconduct. The review record should preserve what was observed, how it was validated and why a response was selected.

Response implications

When unapproved use is confirmed, separate containment from legal characterization. The immediate task may be to revoke access, prevent further disclosure, preserve relevant records and assess affected data or actions. The later analysis can determine notification, contractual, employment, regulatory or litigation consequences. Using the same severity label for all shadow use can either underreact to a material disclosure or overreact to a low-risk experiment.

Material AI agent legal record

Maintain one record for each material production agent or agentic workflow. The following fields create a common reference across legal, security, technology and the business.

AI contract clause checklist

Review the clause set against the actual agent record, not only the vendor category.

• Permitted use and action scope: define approved workflows, prohibited uses, transaction limits and required human confirmation.
• Data rights and restrictions: address inputs, outputs, retention, deletion, training use, cross-border transfer and data returned at termination.
• Identity and access: specify authentication, least-privilege expectations, shared credentials, delegated authority, logs and revocation support.
• Providers and changes: identify material subprocessors, model providers and notice or approval requirements for material changes.
• Performance and customer evidence: state service commitments, quality review, acceptance criteria and any evidence required for an outcome-based fee.
• Audit and records: cover operating logs, usage and billing records, audit support, preservation and reasonable access to evidence.
• Incident response: define notification triggers, timing, cooperation, containment, forensic support and communications responsibility.
• Output and intellectual property: allocate output rights, infringement process, use restrictions and treatment of customer material.
• Liability and indemnity: align responsibility with the actions, data and dependencies each party controls.
• Continuity and exit: cover suspension, model or service changes, transition assistance, export, deletion and continued access to required records.

This checklist is a starting structure, not a substitute for contract analysis.

From pricing model to contract design

The YC Founder AI Report owns the founder pricing distribution and buying-path analysis. Counsel's distinct task is to translate the commercial model into language that can be administered and evidenced.

Mixed pricing requires a precedence rule. For example, a subscription may include usage and add an outcome fee; the contract should state which data controls each calculation, when a result becomes final, how corrections work and what survives termination. The operational system must be capable of producing that evidence. A clause promising an audit right is weak if the relevant usage, outcome or action record is not retained.

Pricing terms also interact with data and authorization. Usage-based charges created by an autonomous action need transaction limits and a way to identify abnormal activity. Outcome pricing may require customer data that cannot be used outside a defined purpose. Seat terms may fail to describe an agent acting across several users. These are contract-design issues, not conclusions about any specific pricing model's quality.

Incident evidence chain

When an agent-related incident or dispute occurs, preserve a coherent evidence chain for the same system and time period:

1. Record the detection time, reporter, affected workflow and immediate containment decision.
2. Preserve the deployed model or material configuration, agent identity, credential and authorization in effect.
3. Preserve relevant inputs, outputs, prompts, tool calls, transactions, logs and human approvals, subject to applicable legal and privacy requirements.
4. Identify the data accessed, disclosed, changed or acted upon and the parties or systems affected.
5. Map the facts to applicable contracts, policies, notices, retention duties and escalation requirements.
6. Record the timeline of decisions, internal and external notifications, vendor cooperation and evidence custodians.
7. Link corrective actions to owners, completion evidence and the decision to restart, restrict or retire the system.

The purpose is not to predetermine liability. It is to preserve the facts needed to investigate authority, causation, contractual responsibility and remediation.

Governance cadence for legal records

Legal review should be event-driven as well as periodic. At intake, capture intended use, data, actions, parties and proposed terms. Before production, confirm the system record, authorization and evidence design. On a material change, test whether prior approvals and contractual assumptions still apply. Quarterly or on another risk-based cadence, review open exceptions, incidents, contract changes and systems nearing renewal. At retirement, address data return or deletion, credential revocation, record retention and continuing obligations.

The cadence should not turn counsel into the operator of every system. Business and technical owners maintain the operating evidence; security owns relevant control operation; legal defines the records and escalation needed for rights, obligations, disputes and incidents. The review trail should show who decided and on what evidence.

Failure modes counsel should test

• A policy without a system inventory: the organization cannot show which production uses the rule applies to.
• Purchase approval treated as action authorization: a vendor is approved, but the agent's data and transaction scope is not.
• Contract terms without operational evidence: audit, usage, outcome or incident clauses rely on records the system does not retain.
• One shared identity with no workload attribution: actions cannot be connected to the relevant agent, configuration or approving owner.
• Silent material change: a model, provider, tool or data scope changes without re-testing applicable terms and approvals.
• Overbroad preservation: every prompt or output is retained indefinitely without a purpose, schedule or privacy analysis.
• Incident reconstruction across disconnected systems: authorization, identity, logs, human review and notices use different names or time references.

Implications by stakeholder

• General counsel: define the legal record, material-change threshold, clause library, escalation path and preservation decision.
• Procurement: connect approved vendors and terms to the actual workflow, model, providers and renewal calendar.
• Security and privacy: operate discovery, identity, access, logging and data controls and retain completion evidence.
• Technology owner: keep the system composition and change history current enough to distinguish the deployed system.
• Business owner: document purpose, permitted actions, human review and the decision to continue, constrain or stop use.
• Finance and commercial teams: ensure pricing, usage, outcomes, credits and invoices can be reconciled under the contract.
• Board or risk committee: receive material exceptions and incidents at defined thresholds rather than every low-risk use.

Comparison with external research

These sources support the evidence design. Applicable legal analysis remains fact- and jurisdiction-specific.

Questions this report answers

What should a material AI agent legal record contain?

Record the agent and workflow identity, decision rights, technical composition, data scope, credential and permitted actions, human involvement, contract coverage, logging, incidents, exceptions and review decision.

Which AI contract clauses should counsel connect to the deployed system?

Connect permitted use, data rights, identity, providers, material changes, performance, audit records, incident response, output rights, liability and exit terms to the system's actual workflow and dependencies.

What evidence should be preserved after an AI agent incident?

Preserve the deployed system record, authorization, identity, relevant inputs and outputs, tool calls, actions, data scope, human decisions, contract mapping, notification timeline and remediation evidence, subject to applicable legal and privacy requirements.

Does shadow AI mean confidential data was leaked?

No. Shadow AI describes use outside an approved or visible path; data leakage describes a data event or concern. The CISO instrument reports them separately at 28 percent and 29 percent, respectively (base 151, any mention), and neither response confirms an incident.

How should counsel investigate suspected unauthorized AI use?

Validate the discovery signal, identify the system, user or agent, preserve proportionate evidence, determine data and action scope, contain ongoing exposure and then assess the applicable policy, contract and legal duties. A signal alone should not be treated as proof.

When should an AI system return for legal review?

Use defined material-change triggers such as a new model or provider, expanded data or action scope, customer-facing use, new geography, changed pricing or outcome terms, a significant exception, or an incident. Routine changes can follow a lighter risk-based path.

How does AI pricing affect contract language?

The contract must make the commercial unit administrable. Usage pricing needs a meter and dispute rules; outcome pricing needs a baseline and verification method; subscriptions need scope and renewal terms; seat pricing needs a definition that works when agents act for users.

Key citable facts

• Thirteen percent report no single owner of AI purchasing (base 467, any mention).
• Shared service accounts are used by 37 percent of applicable AI Leaders respondents (base 49).
• Securing AI agents and their access is named as a top security problem by 68 percent (base 151, any mention).

Methodology and limitations

This is a legal and governance synthesis of operator evidence, not a survey of general counsel and not legal advice. It does not infer legal noncompliance, causation or liability from a reported access method. The figures come from separate populations and are not combined. Respondents are deduplicated by email for each question, invited-only rows are excluded, and multi-select questions use any mention. The agent record, clause checklist and incident evidence chain are recommended working tools, not survey findings.

Related reading

• CISO AI Leverage Report
• Board Director AI Governance Report
• Executive AI Statistics
• Who Is Liable When an AI Agent Acts?
• What AI Vendor Terms Are Companies Demanding?
• What Is Shadow AI's Legal Exposure?
• Do Companies Have an AI Use Policy?

Citation

Suggested citation: Newlands, M. (2026). General Counsel AI Report, October 2026. Open Future Forum.

Share LinkedIn Twitter / X