The New Reality of Law Firm Risk

Estimated listening time: 12 minutes

By Gina Rubel

Law firms advise clients how to manage crises, but in the past five years, they have increasingly wound up in the middle. Law firms are no longer simply advisers on risk. The traditional approach to law firm risk management, conflicts, malpractice, cybersecurity, professional responsibility and insurance is insufficient.

Following a series of destabilizing global political, technological, and legal developments over the past six years, law firms have reshaped how they operate. Think about it. Firms have navigated the COVID-19 pandemic, the murder of George Floyd and the ensuing social justice movement, and deepening political polarization that culminated in events like January 6. Then, in 2025, the legal industry itself became a target. Executive actions and federal agencies put the profession at the center of politics, client expectations, employee concerns and public opinion.

Technology has spiked the risk to the double jeopardy level. The traditional means of communication have expanded rapidly, crossing boundaries from social media to AI. A problem that began as a regulatory matter can quickly become a client, talent and reputational crisis within hours. Law firms need to prepare to navigate any crisis and develop clear plans to anticipate problems before they arise. When and what will spark the next disruption is right around the corner.

Government and Regulatory Pressure

Law firms are facing a level of scrutiny that would have been difficult to foresee a decade ago. In March 2025, the U.S. Equal Employment Opportunity Commission sent letters to 20 AMLaw law firms and requested information about their diversity, equity and inclusion-related employment practices. The agency flagged concerns that practices involving hiring, compensation, promotion, fellowships, mentoring and professional development could be discriminatory.

What followed was silence and then unorganized chaos without uniformity. Some firms engaged with the agency, and others challenged its authority. Some law firms changed the wording on their websites. Some law firm leaders needed to make decisions that spanned not only employment law but also government relations, employee privacy, company morale, and cultural business values, all while maintaining client relationships. This risk did not end with the government’s inquiry.

Just last month, Americans for Equal Opportunity filed an EEOC discrimination charge asking the agency to investigate Sponsors for Educational Opportunity and 14 partner law firms over SEO’s Law Fellowship. This organization was the same one that initially filed charges in 2025 regarding the affirmative action guidance that law firms had followed and that the EEOC and executive orders addressed, demonstrating that regulatory scrutiny does not necessarily begin with the regulator.

The fallout can be dramatic. The Mansfield Certification, which was widely embraced as a means of expanding access to leadership opportunities, is now nonexistent. In June 2026, Diversity Lab, the organization behind Mansfield Certification, ceased operations and moved to dissolve following the Federal Trade Commission (FTC) investigation, which had sent warning letters to 42 law firms alleging anticompetitive employment practices.

The lesson learned is that established industry norms can be upended overnight. Firm leaders need a crisis team prepared to help make decisions that extend well beyond their knowledge and sometimes of technical legal compliance.

Geopolitical Risk Comes Home

Law firms are national and international. Lawyers travel everywhere to meet their clients. Wars and political uncertainty in Iran, Ukraine and the Middle East, growing political tension with China, evolving sanctions, fluctuating tariffs and export controls can all affect business. These circumstances affect where firms operate, which clients they represent, whether money can move from country to country, and whether lawyers can safely travel. For instance, Russia’s invasion of Ukraine quickly became an international event that directly impacted global firms. Many AmLaw firms with Russian offices and clients simultaneously faced sanctions, client relationship concerns, apprehensions over employee safety, office closures and reputational risks.

The world isn’t so big when it is impacting business. While we have seen these geopolitical events create internal challenges, there are also external challenges. Clients may expect one response while employees expect another. In many cases, silence isn’t an option. Key talking points need to be drafted for clients, and employees may need a more personal response. Meanwhile, the firm needs a story or statement to share with the media that reflects both its communications to clients and employees. Teams need to be established and prepared to navigate geopolitical risk. The communications questions cross ethics, employment, client relations, security, sanctions compliance and culture. All of this risk must be considered by global law firms.

The Silence Shift

One of the biggest changes we have seen over the past year isn’t louder communication. It is hesitation. How do you make the decision to comment?

Conversations that once took an afternoon now take weeks, statements are repeatedly rewritten and routine decisions receive executive-level review. Caution is understandable, but silence should be a decision, not a default. Employees, clients, recruits and the public will all have an opinion and interpret it differently.

The challenge is not to comment on every situation. There was a time, about a decade ago, that law firm leaders spoke more freely about the legal industry and trends in other industries. Now many clients are sensitive to law firms speaking about political topics, specific industry trends and even national or international events. It is to have a framework for determining when to speak, when not to speak, who makes that decision and why. The decision to speak is a firm commitment, as information spreads instantly.

Reputation Risk in the Viral Era

Reputational risk has also changed dramatically. A recent incident involving two lawyers reportedly affiliated with Wachtell, Lipton, Rosen & Katz illustrates the speed at which risk spreads.

A video showing a partner and an associate kissing on a bench in Central Park went viral on social media. What began as a moment involving two individuals became internet content and legal-industry news, putting the firm’s name into a public conversation about workplace relationships, professional hierarchy, privacy and culture. There was virtually no lag time between the conduct, exposure and reputational consequence. A smartphone, social media account and algorithm can create a law firm issue before firm leadership knows anything has happened.

Gone are the days of hoping Above the Law or Legal Cheek will miss the coverage. Now there’s coverage scooped up straight from YouTube, Instagram, Threads and X. Everyone makes mistakes at some point. It’s unfortunate, but as Peloton’s Becs Gentry says, it is often a “First Attempt in Learning,” which makes a stronger athlete or person. Law firms must prepare for the unexpected failure of an individual that becomes public, fairly or unfairly, and immediately attaches the firm’s name to the story. That person could be a strong player, but mistakes happen, and with cameras everywhere, their actions could be a reputational risk.

The New Client Risk Calculus

Firms maintain conflict checks on clients and matters. While a representation may be entirely permissible under professional conduct rules, it could still create significant risk to a firm’s business, particularly when it involves political figures, foreign governments, sanctioned entities or famous people.

Can it accept the work? Maybe. But should it? And does it have the internal and public framework and communications to support any scrutiny?

Lawyers have an essential role in representing unpopular clients and causes. It is an argument for understanding potential consequences before accepting an engagement rather than discovering them during a crisis.  Client intake is increasingly an exercise in both prudence, communications, business practicality and ethics.

Talent Risk

Partner and associate mobility is another defining risk. When senior lawyers leave, clients and other lawyers can follow, creating a domino effect that can destabilize even established firms.

We have seen this firsthand. A mid-market firm lost its largest practice group and voted to dissolve soon afterward. What appeared to be a talent issue became an existential business issue. Compensation matters, but so do culture, leadership, succession, strategy and alignment with firm values. Decisions involving clients, public statements, DEI programs and institutional values can also influence whether people join, stay or leave.

Retention is no longer simply a human resources responsibility. It is enterprise risk management.

AI and the Next Category of Risk

Artificial intelligence adds another category of risk, ranging from confidential information entering inappropriate systems and hallucinated citations in legal filings to cybersecurity, supervision and competence concerns.

But the most consequential AI risk may be the one firms have not identified yet. Technology is developing faster than many institutions can create policies governing its use. Firms therefore need governance, training, clearly defined responsibility and escalation protocols before an AI incident establishes the rules for them.

When Risks Collide

Perhaps the most important development is that these risks no longer occur independently. Law firms have historically been organized around specialties. Risk has no organizational boundaries. Firms need to see the connections before a crisis exposes them. Consider a scenario when risks collide:

A firm represents a multinational client that becomes subject to sanctions following an international conflict. Lawyers disagree about continuing the representation, and another lawyer from the firm criticizes the client on social media. A journalist begins asking questions. Clients call firm leadership. An advocacy group targets the firm online. A partner with a significant book of business threatens to leave unless the firm responds.

Law firms must be prepared to respond to risk in real time. Earlier in our careers, true crisis matters were relatively rare. Communications heard from the general counsel once or twice a week. Today, risk is part of everyday operations, and many firms remain reactive. Not speaking to their communications teams and addressing problems until after they escalate.

Effective crisis management begins before the crisis. Firms need a cross-functional team that includes leadership, general counsel, communications, human resources, information security and risk management, with clearly defined roles and authority.  Questions should be answered before the crisis, not during it.

Media training, message development and scenario-based simulations, often called tabletop exercises, should become standard risk-management practices. Planning, training, testing and alignment across leadership, legal, risk, human resources, technology and communications needs to happen before a crisis. Everyone has a role, even associates and professional staff. Speed matters in a 24/7/365 information environment, but speed without structure creates additional risk.

A Permanent Industry Shift

The new reality of law firm risk is the institutional capacity to respond to what they did not predict. Exposure can come from virtually every direction. One form of risk can rapidly trigger another.

A firm’s reputation is established long before it is challenged. A crisis simply reveals whether that reputation, and the infrastructure supporting it, can withstand the pressure.