Conflict of Interest Checks at Machine Speed: Policy Enforcement for Legal AI

Category: Legal & Professional Services | Reading time: 5 min

---

The 30-Second Rule That Takes Three Days

Every law firm has a conflict check process. A new matter comes in, the intake team searches the conflicts database, reviews the results, escalates to a partner if anything flags, and clears the matter for assignment. The process exists to protect the firm and the client. In practice, it takes between 30 minutes and three days, depending on firm size, database quality, and workload.

When AI agents handle matter intake — extracting information from emails, populating matter management systems, assigning matters to practice groups — they can move in seconds. But if the conflict check doesn't move at the same speed, you've created an expensive bottleneck: an AI that opens matters faster than compliance can close them.

The answer isn't to skip the conflict check. The answer is to make the conflict check part of the AI's policy layer, evaluated at machine speed before the matter is ever opened.

---

Why Prompts Don't Work for Conflict Checks

The instinctive approach is to tell the AI in its system prompt: "Always check for conflicts before accessing matter documents." This fails for several reasons:

• Conflict databases are external systems. The LLM can't query them — only purpose-built tools can.
• Conflict checks produce structured data. The result is "cleared," "conflict found," or "requires review" — not natural language.
• Conflict rules are firm-specific. What constitutes a conflict at your firm depends on client relationships, matter history, and jurisdiction — not general legal knowledge.
• Prompts can be overridden. Under certain input conditions or prompt injections, the LLM may proceed despite the instruction.

What you need is a pre-condition check that evaluates conflict status before any matter access is permitted — enforced by the kernel, not requested of the LLM.

---

Conflict Policy in Rego

package taos.legalops.conflict_check

# Stage 1: Conflict check must have been performed
deny_unchecked_matter {
    input.conflict_check_performed == false
}

deny_unchecked_matter {
    input.conflict_check_performed == null
}

# Stage 2: Conflict check must have cleared
deny_conflict_found {
    input.conflict_check_status == "conflict_found"
}

# Stage 3: Pending review is not clearance
deny_pending_review {
    input.conflict_check_status == "pending_review"
}

# Allow only when explicitly cleared
allow {
    not deny_unchecked_matter
    not deny_conflict_found
    not deny_pending_review
    input.conflict_check_status == "cleared"
}

action = "deny" { not allow }

This policy is evaluated by the Taos kernel before any step that accesses matter documents. The result is binary and deterministic: either the matter is cleared, or the workflow stops.

---

The Matter Intake Workflow

A well-designed AI matter intake workflow with Taos governance looks like this:

Step 1: Extract matter details from intake email AI extracts client name, matter type, opposing parties, jurisdiction. No matter data is accessed yet.

Step 2: Run conflict check tool The kernel calls the firm's conflict API: check_conflicts(client_name, opposing_parties, matter_type). Returns conflict_check_status.

Step 3: Policy evaluation Rego evaluates the conflict check result. If cleared, continue. If anything else, stop.

Step 4: Open matter in matter management system AI creates the matter record with extracted details — only executed if step 3 cleared.

Step 5: Route to practice group Matter is assigned based on type and jurisdiction.

The conflict check (step 2) executes in milliseconds if the API is fast. The policy evaluation (step 3) takes microseconds. What was a three-day process is now a sub-second gate that the AI cannot bypass.

---

Escalation for Review Cases

Not all conflicts are hard conflicts. Some require partner review — related client relationships, former client situations, ancillary matter connections. Taos handles these with require_approval rather than deny:

# Potential conflict requires partner review
require_partner_review {
    input.conflict_check_status == "potential_conflict"
}

action = "require_approval" { require_partner_review }
required_role = "conflicts_partner"  { require_partner_review }

When this fires, the kernel creates an approval request for the conflicts partner — a structured summary of the potential conflict with the AI's extracted context. The partner reviews, makes a business judgment, and approves or denies. The workflow resumes or stops accordingly.

The AI surfaces the issue instantly. The partner provides the judgment in minutes rather than days.

---

Audit Trail for Bar Compliance

Many state bar rules require that firms document their conflict check procedures. For AI-assisted intake, the documentation requirement extends to every AI action taken in the intake process.

The Taos audit log provides, for every matter intake workflow:

• When the conflict check was run
• What data was submitted to the conflict API
• What result was returned
• Which Rego rule evaluated the result
• Which partner reviewed a potential conflict (if applicable)
• How long elapsed between intake request and matter opening

This is not a manual log entry. It is a system-generated, tamper-evident record created automatically by the governance kernel.

---

Multi-Office, Multi-Jurisdiction Firms

Large firms operate across multiple offices and jurisdictions, each potentially with different conflict rules. A conflict in the London office may not be a conflict in the New York office under the same representation. Taos handles this with jurisdiction-scoped policy bundles:

# UK jurisdiction: adverse party conflicts extend to affiliates
deny_conflict_found {
    input.jurisdiction == "UK"
    input.adverse_party_affiliate_conflict == true
}

# US jurisdiction: affiliate conflicts require review, not denial
require_partner_review {
    input.jurisdiction == "US"
    input.adverse_party_affiliate_conflict == true
}

The compliance team maintains these policies in the control plane. When bar rules change in a jurisdiction, the policy is updated — no engineering involvement required.

---

The Bottom Line

Conflict checks at machine speed don't mean conflict checks are less rigorous. They mean the check happens every time, for every matter, in milliseconds, with a complete audit record. The AI does the extraction work; the policy engine enforces the clearance requirement; the partner reviews the edge cases.

The result is faster matter intake, stronger conflict compliance, and an audit trail that satisfies bar requirements.

---

Tags: conflict of interest, legal AI, matter intake, law firm compliance, policy-as-code, bar association requirements