This article is published by J-10, Jalubro's proprietary governance enforcement platform. It is part of a series exploring how regulated enterprises can enforce compliance inside operational workflows. To learn how Jalubro's advisory and implementation services support governed enterprise operations, visit our services page.

Harvey is becoming the AI platform of choice for sophisticated legal work. Governance has not kept pace.

Harvey has established itself as one of the most capable AI platforms for legal professionals. It is being adopted by law firms and in-house legal teams for contract analysis, due diligence, regulatory research, document review, litigation support and legal drafting. Its capabilities are deep, its output quality is high, and its adoption is accelerating across regulated industries.

The governance conversation around Harvey is almost entirely absent.

Most enterprises deploying Harvey have focused on data security, access controls and deployment architecture. These are important. But they are not the same as governance. Security controls protect the platform. Governance controls govern how your people use it, what data they provide to it, and what happens to what it produces before it reaches a decision, a contract or a client.

This article addresses both sides of the Harvey governance challenge and sets out what enforceable governance looks like for enterprises deploying Harvey across legal and enterprise workflows.

Harvey's strength is also the governance challenge

Harvey's value lies in its ability to work with complex, domain-specific legal content. It can analyse a 200-page contract suite and surface risk concentrations. It can review thousands of documents for due diligence and produce structured summaries. It can research regulatory frameworks across multiple jurisdictions and synthesise the results.

To do this well, Harvey needs access to the content. Users provide it with contracts, legal memoranda, regulatory filings, board materials, transaction documents and client correspondence. Harvey processes this content and produces outputs that legal professionals use to inform advice, structure transactions, draft documents and make decisions.

The governance challenge is that the very capability that makes Harvey valuable, its ability to process complex, sensitive legal content and produce sophisticated outputs, is precisely what requires governance. The more capable the AI, the more consequential its inputs and outputs, and the more critical it becomes to govern both sides of the interaction.

The input risk: what is being fed into Harvey

Harvey is typically deployed in environments where the work is high-value and high-sensitivity. M&A transactions. Regulatory investigations. Complex disputes. Cross-border restructurings. Board advisory work.

Transaction documents before announcement. A corporate team uses Harvey to analyse a target company's contract portfolio during a pre-announcement acquisition. The existence of the transaction, let alone its terms, is material non-public information. Every document fed into Harvey during this analysis is price-sensitive.

Privileged litigation strategy. A disputes team uses Harvey to review opposing counsel's filings and draft response strategies. In doing so, they provide Harvey with the firm's own privileged analysis, case theory and settlement positioning. This is the most protected category of legal information.

Regulatory investigation materials. A compliance team uses Harvey to analyse documents gathered in response to a regulatory investigation. These documents may include internal communications, whistleblower reports, and correspondence with the regulator. The sensitivity of this material is extreme.

Client confidential data across matters. Harvey's analytical capability works best with more context. The temptation for users is to provide as much information as possible: client financial statements, term sheets, cap tables, commercial agreements, employment records.

Personal data in employment and disputes matters. Employment disputes, data subject access requests, HR investigations and personal injury claims all involve personal data subject to GDPR and data protection requirements.

The security architecture of Harvey's deployment may be robust. The question is whether the enterprise has any enforceable control over which specific data, on which specific matters, is appropriate for AI processing under the enterprise's own policies. In most cases, the answer is no.

The output risk: what Harvey produces and where it goes

Harvey's outputs are sophisticated. That is part of the problem. A poorly written AI output is easy to spot and easy to discard. A well-written AI output that contains a subtle error, an incorrect citation, a mischaracterised risk, an omitted exception or a jurisdictional assumption is much harder to catch.

Due diligence summaries with material omissions. Harvey reviews a suite of 150 supplier contracts and produces a risk summary. The summary omits a change of control provision in one contract because the clause was embedded within a broader "miscellaneous" section and used non-standard language. The due diligence report is finalised with the omission intact.

Regulatory research with jurisdictional errors. Harvey produces a comparative analysis of data protection requirements across six jurisdictions. One of the jurisdictions has recently amended its regulations. Harvey's analysis reflects the prior version. The compliance team relies on the analysis to design a cross-border data transfer framework that does not comply with current requirements.

Contract analysis influencing commercial decisions. Harvey analyses a portfolio of customer contracts to identify renewal risk. The analysis categorises three contracts as low risk based on their termination provisions. It does not account for a side letter that modifies the termination terms of one of those contracts. The commercial team uses the analysis to deprioritise retention efforts for that customer.

Outputs entering workflows without provenance. A lawyer copies Harvey's analysis into a memorandum, a matter record, an email to a client or a board paper. At that point, the AI-generated content is indistinguishable from human-produced work.

What enforceable Harvey governance looks like

Governing inputs

Data classification enforcement at the point of interaction. Before any document or content is provided to Harvey, it is validated against the enterprise's data classification policy. Documents classified above a defined threshold are blocked unless an authorised exception is granted.

Matter-level and engagement-level controls. Certain matters or client engagements may carry restrictions on AI use. A client engagement letter may prohibit AI processing of their data. A regulatory investigation may require that all document handling is logged and controlled. Input governance enforces these restrictions at the matter level.

Transaction-sensitivity gates. For M&A, capital markets and other market-sensitive work, input governance can enforce transaction-specific controls. Documents associated with an unannounced transaction are blocked from AI processing until the transaction-specific restriction is lifted.

Personal data scanning. Inputs are scanned for personal data that would trigger GDPR or data protection processing requirements. If personal data is detected and the relevant processing activity has not been authorised, the input is blocked.

Complete input audit trail. Every document provided to Harvey, every prompt submitted, every input blocked and every exception granted is logged with full attribution, timestamps and policy references.

Governing outputs

Domain-specific validation rules. Harvey's outputs span contract analysis, regulatory research, due diligence, drafting and advisory work. Each domain requires different validation rules. Contract analysis outputs are validated against the enterprise's clause library and risk framework. Regulatory research outputs are checked against current regulatory databases. Due diligence outputs are validated for completeness against the scope of documents provided.

Confidence scoring and exception routing. Not all outputs carry the same risk. A Harvey-generated summary of a standard NDA carries less risk than a Harvey-generated analysis of termination provisions in a complex M&A transaction. Output governance can assign confidence scores based on the complexity and sensitivity of the task, routing lower-confidence outputs to mandatory human review.

Downstream flow control. AI-generated outputs that pass governance checks flow into matter management systems, document management, CLM platforms and enterprise reporting. Outputs that fail governance checks are held.

Provenance tagging across systems. Every Harvey-generated output that enters a downstream system carries a tag identifying its AI origin, the governance checks it passed, any exceptions that were granted, and a link to the complete audit trail.

Cross-system governance

Harvey does not exist in a vacuum. Its outputs flow into matter management platforms, document management systems, CLM tools, collaboration platforms, client communication channels, financial reporting systems and board papers. In many enterprises, Harvey also operates alongside CoCounsel, with different teams using different AI tools for different purposes.

Governance must apply consistently across all of these systems. For enterprises using both Harvey and CoCounsel, governance must also be consistent across AI tools. The same data classification policy, the same output validation standards, the same evidence requirements.

How J-10 governs Harvey in regulated enterprises

J-10 is a business-side governance enforcement platform that provides enforceable, two-way governance for Harvey and any other AI tool deployed across the enterprise.

On the input side, J-10 enforces data classification policies, matter-level restrictions, transaction-sensitivity gates and personal data controls at the point of interaction, before data reaches Harvey. On the output side, J-10 validates Harvey-generated content against the enterprise's governance policies, risk frameworks and accuracy standards before outputs enter any downstream system.

For enterprises using Harvey alongside CoCounsel, J-10 provides a single governance layer across both tools, enforcing consistent policies regardless of which AI platform the user is interacting with. One governance framework, applied uniformly, evidenced completely.

J-10 does not replace Harvey. It does not interfere with Harvey's capabilities. It governs how Harvey is used inside your enterprise, on both sides of the interaction, across every system the outputs touch.

To learn more about governing Harvey with J-10, visit j10.ai or contact the Jalubro team to book a briefing.