Risks and Counterarguments
A register of 16 risks and answers to sceptics
Below is a register of 16 risks of a national Legal AI infrastructure, each with a mitigation mechanism, followed by detailed answers to the objections sceptics typically raise.
1. Risk register
| # | Risk | How it shows up | Mitigation |
|---|---|---|---|
| R-1 | Hallucinations | Fabricated rules, cases, quotations (empirical data: 58–82% for public LLMs; 1,733 court cases) | Mandatory linking to sources ("no source — no strong conclusion"); automatic citation-check against primary sources; a status model for facts; human confirmation of significant conclusions |
| R-2 | Errors and outdated sources | Analysis based on a repealed version | Machine-readable data with validity periods; a date-check against legally significant dates; a verified_at field on every source |
| R-3 | Leaks of confidential information | Case materials go to external models / the wrong hands | A layered access architecture; local/isolated processing of the confidential layer; redaction before external calls (Ukrainian dictionary: RNOKPP, passports, addresses, requisites); logging of every request |
| R-4 | Dependence on foreign suppliers | A change of terms or a vendor cut-off paralyses the work | A provider-independent architecture (open formats, MCP, AGENTS.md); configurations portable between environments; a track for open/local models; a demo mode with no external calls |
| R-5 | Model opacity | "Why this conclusion?" — unanswerable from inside the model | Transparency at the level of the process, not the weights: the chain of provenance, artifacts, checks; the model's hidden reasoning is deliberately not treated as evidence |
| R-6 | Automation of bias | The model reproduces skews in the data/practice | A mandatory critique_pack (counterarguments); testing on Ukrainian benchmark cases; comparing the conclusions of different models on sensitive tasks; the human as final arbiter |
| R-7 | Insufficient user qualification | Blind trust, inability to frame tasks | A mentorship institution (P-10); starter configurations with protective defaults; a university track (P-5); certification for sensitive roles |
| R-8 | Absence of common standards | A zoo of incompatible practices | An open artifact standard v0.1 from day one; validators; schema versioning through an open repository |
| R-9 | Over-reliance on answers | "The AI said so" as an argument | Mandatory confidence and open-question fields; UI marking of the unconfirmed; the position of the Supreme Court of Ukraine (AI does not overturn the court's conclusions) — built into training |
| R-10 | Liability problems | It is unclear who is responsible for an error | A hard rule: legally significant actions are technically available only to a human (human-only operations); every decision has a confirmer; conformity with Article 14 of the EU AI Act, ABA 512, CCBE |
| R-11 | Institutional resistance | Sabotage of something "handed down from above" | Voluntary pilots with measurable benefit; quick wins from wave 1; involvement of professional associations; mentors from within the profession, not "IT people from outside" |
| R-12 | Fragmentation of solutions | Every agency invents its own | A coordinating centre holds only standards/data/security; a network of practices; compatibility as a condition of certification |
| R-13 | Incompatibility of artifact formats | Packages cannot be read across environments | Only open formats (MD/JSON/YAML); schema validation on receipt; a compatibility test: a package from a Codex environment is checked in a Claude environment and vice versa |
| R-14 | Excessive logging | A bureaucracy of logs kills the benefit | Three levels of detail; the usefulness metric for a log is participation in checks/decisions; a stopping criterion in the pilots (overhead) |
| R-15 | A false sense of control from the volume of logs | "It is all recorded" does not equal "it is all verified" | Distinguish the log from the check: only performed checks with results matter; the unsupported claim rate as a metric of real control |
| R-16 | Confidential data in artifacts | A package with personal data leaves the perimeter | An automatic redaction-check before a handoff is formed; confidentiality levels in the artifact envelope; a ban on passing a package below the required level; a handover log |
2. Counterarguments from sceptics — and answers
"This will replace lawyers and judges." No. Architecturally: legally significant decisions are technically unavailable to the agent (human-only). In regulatory terms: the EU AI Act, CEPEJ and UNESCO require human oversight, and the concept complies. In practice: the tool removes the routine of structuring and checking, returning time to professional judgement.
"Models hallucinate — so all of this is dangerous." Hallucinations are the main argument for the proposed architecture, not against it. What is dangerous is the "bare chat" with no sources and no checks. The whole construction (sources, statuses, citation-check, the human) is built around this very risk. The comparison should be not with an ideal but with current practice: a tired lawyer with no verification loop also makes mistakes — but no one logs theirs.
"The state has no money for yet another reform." The model is cheaper than the status quo: the configurations are text files, the data is already open, and the environments are commercially available or open-source. The start costs single-digit sums, not tens of millions; funding the pilots is compatible with existing mechanisms (the Ukraine Facility, Pravo-Justice). It is the centralised mega-system that is expensive.
"Confidential data must not be given to AI." The correct formulation is: it must not be given uncontrolled. The layered architecture exists precisely for this: the confidential layer is processed locally/in isolation, and what goes outside is anonymised. The wave-1 pilots do not touch sensitive data at all.
"Lawyers will not use it." They will — if the tool saves their time and they control its configuration. The bet is on mentors from within the profession and on voluntary pilots. The stopping criterion is honest: if a team does not continue voluntarily, the standard is simplified.
"This is dependence on American corporations." The architecture is provider-independent by design: open formats, interchangeable models, a track for local models. Ukraine has already travelled this road with Diia.AI (a hybrid: the data does not leave the perimeter). What actually creates dependence is procuring a single proprietary SaaS.
"An AI law is needed first." The existing framework is sufficient for pilots: the recommendations of the Ministry of Digital Transformation and the Ministry of Justice for legal professionals (2025), the Supreme Court's provision on the use of AI, personal-data legislation and its GDPR reform. Ukraine's White Paper deliberately chose bottom-up: practice → regulation. The pilots will give the regulator empirical evidence.
"Artifact exchange is unnecessary bureaucracy." This is testable: pilot P-11 measures the overhead against the gain (time to review, handoff completeness). If the hypothesis is not confirmed, the standard will be simplified; the stopping criteria are public. Proportionality is built in (three levels of detail).
"Why not wait for ready-made solutions from the market?" Market SaaS products solve the problems of firms, not of national infrastructure: they will not hand Ukraine a data standard, the institutional memory of its bodies, or independence from the vendor. To wait is to get fragmentation (R-12) by default and to lose the European-integration window in which harmonisation is funded and incentivised.
"This is just another never-ending IT project: by the time it is built, it will be obsolete." There is nothing here to become obsolete: there is no development. The workstations are built on agentic environments that are already available and running in production (OpenAI Codex, Anthropic Claude Code, open-source analogues); the national layer is a repository of instructions, skills, roles and training courses that is updated like files, not like a software product. A change of model generation is an engine swap; the configurations are preserved. Adoption can begin today.
3. Link to the evidence base
Empirical data for risks R-1 and R-9: sources B1–B6, source tables. Regulatory framework for R-10: E1–E8. Architectural mechanisms: the artifact standard, §§4–7. Verification of the mitigations' effectiveness: the metrics of the pilot plan, §1 (P-11) and §5.