10 Lessons in Adapting Document Management and Information Governance to an AI World: Practice Points

Get specific about the problem before you go shopping for tools. "We need AI" and "our documents are a mess" will not get you anywhere useful. Misty pushed for something concrete, like the business giving you grief because finding the right document takes so long that diligence responses slip, or renewals getting missed because nothing tracks expiration dates well. A precise problem tells you what to fix first. It also gives you something far better to ask funding for than the line every department in America is using right now.

Define what success looks like in terms you can actually test. Better information governance is not a roadmap. Misty's example was that each team member can find the golden source document in under two minutes, and a golden source document means the single authoritative current version, which for contracts is usually the executed one. Objective and specific beats aspirational here. Without a described end state, you have no way to confirm the exercise was worth doing.

Pick one document type or workflow and start there. An enterprise information governance program can easily run over a year, and the urge to fix everything at once is what stalls people before they begin. Misty recommended choosing one repository, document type, or workflow with high business value or high document volume, like getting all executed vendor agreements into one place. Choose something where success is easy to identify objectively. You want early ROI and measurable progress, not a project nobody can point at.

Find out where your documents really live today. The honest inventory covers the DMS, but also emails, desktops, assorted share drives, e-signature platforms, client files that never came back, and the one Misty flagged with an emoji, which is personal email and cloud accounts. She shared a story about someone who could not get on the company's DocuSign, so they opened their own account and had the other side sign there, leaving the GC asking how she would ever reach those records after that person left. Talk to the contract administrators, paralegals, and admins who do the daily work, because they know where things actually sit. Make IT your partner rather than something to work around, since they understand your permission structure and repository options in ways you probably do not.

Make it easy to tell which version governs. An AI tool has no concept of what "current" means. When your 2018 template is easier to pull than the 2025 version, the 2018 version is what shows up in the output, worded with dangerous confidence. Misty's open book exam framing stuck with us, since you would never walk into that exam carrying a draft edition or an outdated one. Contracts teams feel this first because referencing the correct version is the whole job.

Revisit who can see what on a regular schedule. Access often gets set up correctly at the start, and then people change roles and the structure drifts. Misty had HIPAA-protected information, sensitive financial data, and a lot of PII in her benefits work, and none of that belongs in a chatbot answering questions for the whole company. She described a GC whose colleague built a slide deck in Copilot and pulled in sensitive deal information nobody realized the tool could reach. She read that as a permissions problem rather than an AI one. Think about every share drive link you sent during a deal and never went back to kill.

Build so you can show your work later. "The AI generated it" is not an answer you want to give your CEO, your business clients, a regulator, or a court. You need to be able to say where output came from, what the tool relied on, and, most importantly, who validated it. Good information governance is what keeps you out of the garbage in, garbage out situation. It also saves you the time you would otherwise spend validating and fixing whatever the tool produced.

Clear out the redundant, obsolete, and trivial before you point anything at it. ROT covers duplicate copies, superseded versions, and low-value content with no business purpose. Misty asked whether you really need all twelve iterations of a contract fifteen years after signature, and that is a fair question to put to your own repository. This is among the highest value work available, and it does not demand a high level of judgment as long as you set guardrails in advance for what to keep, what to discard, and when to flag something. When the delete debate gets stuck, archive the candidates somewhere else rather than letting a records retention argument kill the whole cleanup.

Choose a few metadata fields people will actually fill in. Metadata is now more important for search than file naming conventions, because an AI tool looks behind the file name. Misty suggested thinking carefully about the fields you genuinely need, such as document type, execution status, effective and expiration dates, and access restrictions, and landing on three to six of them. A handful of fields applied consistently will outperform twelve that people route around. She met a banker who makes information up to get past his bank's CRM because entering it properly is too hard, which is exactly the outcome you are trying to avoid.

Give information governance a named owner and a plan for making it stick. Assign a person or a role rather than a committee or a general handoff to legal ops, because when everyone is in charge, no one is in charge. Capture metadata as documents go in rather than tagging retroactively, schedule your permission reviews instead of waiting for time that never arrives, and put the work on someone's goals with a real timeline. Misty walked through the Prosci ADKAR model developed by Jeffrey Hiatt, covering awareness, desire, knowledge, ability, and reinforcement, and reinforcement is the piece that most often gets skipped. Spot checks, periodic audits, and accountability for use are what keep a beautiful new system from degrading back into what it replaced.