Metric 0 Pre-Check
Complete all five gates before any integration architecture design or implementation:
- Gate M0.1 — GOV-02 verified: AI Use Policy is current; AI usage categories define permissible integration patterns.
- Gate M0.2 — AI BoM verified: All AI systems to be integrated are registered in the AI Bill of Materials.
- Gate M0.3 — DAT-01 verified: Data Governance Framework is in force; integration must respect data rules per category.
- Gate M0.4 — STR-07 verified: AI Task Force Charter is active; escalation channels open for Class 6 Shadow AI.
- Gate M0.5 — VEN-04 verified: AI Vendor Security Checklist completed for all AI vendors in scope.
All five gates must be confirmed before integration work begins.
1. Executive Summary and Strategic Context
Integration vision: Enable secure, compliant integration between core legal systems and AI capabilities, creating a unified ecosystem that enhances legal service delivery while preserving confidentiality, security, and professional responsibility.
Business objectives include: improving operational efficiency, maintaining security and compliance, enabling scalable AI, reducing complexity, supporting resilience, and demonstrating ROAI across Protect, Comply, Grow, and Transform.
Architectural principles:
- Security by design
- API-first approach
- Event-driven architecture
- Data minimisation (DAT-04)
- Vendor neutrality
- Defensible AI governance (AI BoM, Agentic Tier, Class 6 detection)
- Operational excellence (monitoring and optimisation)
A ROAI alignment table maps how integration supports each quadrant.
2. Current State Assessment and System Inventory
- Core systems inventory: Catalogue DMS, CRM, eBilling/financial, matter management, and email/communications platforms, including current integration points and constraints.
- AI BoM registration assessment: For each system, record whether AI components exist, are BoM-registered, and operate at Agentic Tier; register any missing entries before design proceeds.
- Class 6 Shadow AI audit: Identify ad-hoc or unapproved AI tools processing legal data. Any unregistered AI constitutes a Class 6 incident and must be escalated via STR-07 before continuing.
- Gap analysis: Document legacy limitations, API quality issues, security gaps, manual processes, data silos, unregistered AI tools, and absence of Agentic Tier controls.
3. Target Architecture and Integration Design
3.1 Three-Tier Integration Architecture
- Tier 1 — Core Legal Systems: DMS, CRM, eBilling, matter management, email and other data sources. Integrate via standardised, authenticated, monitored APIs. All data classified per DAT-02 before entering Tier 2.
- Tier 2 — Integration Layer (Middleware): API gateway, message broker, data integration platform, service mesh, and AI BoM registry hook that validates all AI-to-system calls.
- Tier 3 — AI Processing Infrastructure: GPAI platforms, legal-specific AI, enterprise AI services, and Agentic AI layer, all registered in the AI BoM.
3.2 API-First Integration Strategy
Design REST/GraphQL APIs with OpenAPI specs, versioning, and standard error handling. Use OAuth 2.0/OIDC, JWT, scoped API keys, certificate-based auth where required, and MFA for admin access. Implement rate limiting, circuit breakers, load balancing, and caching.
3.3 Event-Driven Architecture
Adopt publish-subscribe, request-reply, and queuing patterns. Define event categories: system, data, business, AI, and Class 6 events (unauthorised AI attempts). Use Kafka or cloud-native brokers for streaming and routing.
3.4 Data Synchronisation and Consistency
Apply real-time, near real-time, or scheduled sync based on criticality. Use strong consistency for financial/compliance data and eventual consistency for analytics. Enforce DAT-02 classification checks and enhanced controls for Level 3–4 data.
3.5 Agentic Tier Architecture Provisions
For any Level 4 (AI as Executor) tool:
- Scope-limited API access: Only the minimum systems and objects needed.
- Kill-switch API endpoint: Standardised endpoint that halts processing and revokes access within 60 seconds.
- Audit API: Complete, privilege-protected logs of actions, data accessed, and decisions.
- Intervention callback: Mechanism for attorneys to pause, review, and override actions.
- Cross-system data isolation: Matter-level partitioning to prevent cross-matter access.
No Agentic Tier integration goes live until all five provisions are documented and verified; exceptions require STR-07 approval.
4. Security and Compliance Framework
4.1 Data Protection and Encryption
Use AES-256 and TDE for data at rest, encrypted backups, and HSM-backed key management. Enforce TLS 1.3, end-to-end encryption for Level 3–4 data, VPN tunnels, and message-level encryption for streams.
4.2 Access Controls and Identity Management
Require MFA for admin access, integrate with corporate IdPs, and apply RBAC aligned to legal roles with just-in-time elevation. Validate all AI API access against AI BoM entries.
4.3 Network Security and Segmentation
Implement DMZs, internal segmentation, a dedicated AI processing segment, micro-segmentation, IDS/IPS, DDoS protection, and zero-trust principles for remote access.
4.4 Regulatory Compliance
Map controls to ABA Model Rules (1.1, 1.4, 1.6, 5.3), GDPR (data minimisation, rights, DPIAs), EU AI Act (high-risk documentation, oversight, monitoring), and Risk Taxonomy 2026 classes.