Nobody Owns Compliance at Most Law Firms — And in 2026 That Became a Structural Risk, Not a Staffing Gap

🧱 Four Signals, One Direction

Taken individually, each of these looks like a discrete rule change to be handled by whoever handles that sort of thing. Taken together they describe a shift in how the profession is regulated.

Named accountability for trust accounts. California's client trust account regime now requires a designated licensee tied to each account, with the attorney's State Bar license number provided to the financial institution, and a 30-day window to appoint a replacement if that person becomes inactive, ineligible, or leaves the firm. Financial institutions report account information to the State Bar. The trust account is no longer the firm's account in a regulatory sense — it is a specific lawyer's responsibility, recorded at the bank.

Named accountability for AI. The EU AI Act's high-risk obligations became fully applicable in August 2026, and they attach to the party that deploys a system, not only the party that builds it. A U.S. firm with EU-facing work now inherits deployer-side documentation duties for tools it merely bought.

Underwritten technology. Malpractice and cyber carriers increasingly price coverage against specific technical controls — access management, audit logging, backup posture, vendor security. The questionnaire is no longer a formality; the answers move the premium.

Direct data reporting. When banks report trust data to the bar directly, the firm is no longer the sole narrator of its own compliance. The regulator has an independent feed.

🕳️ The Ownership Gap

Ask a 40-attorney firm who owns compliance and the honest answer is usually a distribution: the managing partner owns the bar relationship, the controller owns the trust reconciliation, the office administrator owns the carrier questionnaire, an IT vendor owns security, and a technology-curious partner owns whatever the firm is doing with AI.

Each of those people is competent. None of them can answer a question that crosses two domains — and every 2026 obligation crosses at least two. "Which systems touch client funds, who has access to them, when was that access last reviewed, and can you produce the log?" is a question with no natural owner at most firms.

📉 Why Attestation-Based Compliance Is Failing

The traditional model works like this: something is required annually, someone assembles evidence in the weeks before the deadline, an attestation is signed, and the file is closed. It worked because the evidence request was predictable and infrequent.

That model breaks under three conditions, all of which now apply. First, when a third party has an independent data feed, your assembled narrative can be contradicted. Second, when the obligation attaches to an individual, "the firm believed it was compliant" is not a defense for that individual. Third, when requests arrive unpredictably — a carrier mid-renewal, a client's diligence team, a bank's periodic review — there is no annual window to prepare in.

The replacement is not more paperwork. It is systems that produce evidence as a byproduct of doing the work.

🏗️ What "Evidence as a Byproduct" Actually Means

🧭 A Practical Governance Model for Mid-Size Firms

You do not need a chief compliance officer. You need four things written down.

1. A named owner per obligation. One person per domain — trust accounts, data security, AI use, client confidentiality — with the name recorded and the successor identified. Not a committee, and not "the managing partner" as a catch-all.

2. A defined evidence source for each. For each obligation, state where the evidence lives and who can produce it. If the answer is "we would have to pull that together," the obligation is unowned in practice.

3. A succession trigger. California's 30-day replacement window is a useful template regardless of jurisdiction. Any owner departure, license status change, or role change should trigger a documented reassignment inside a fixed number of days.

4. A quarterly evidence rehearsal. Once a quarter, pick one obligation at random and produce the evidence as if a third party had asked. Time it. The exercise costs an hour and reliably finds the gaps that annual attestation hides.

🔗 Why Architecture Decides the Outcome

Firms usually treat this as a policy problem. It is mostly an architecture problem. When client funds live in a general accounting package, matters live in a practice management tool, documents live in a file share, and access is managed in three separate admin consoles, producing cross-domain evidence requires a human to join four systems by hand — under time pressure, from memory, with no audit trail on the join itself.

When matters, documents, permissions, and the general ledger share one platform with one audit trail, the same request is a query. That is the entire difference between compliance as a project and compliance as a property of the system.

🎯 The Question Worth Asking This Quarter

Not "are we compliant?" — every firm believes it is. Ask instead: "If a carrier, a bank, a client's diligence team, and the state bar each sent us a different evidence request tomorrow morning, how many people would we need, and how many days would it take?"

Firms with named owners and unified systems answer in hours. Firms with committees and split systems answer in weeks, if at all. In 2026, that difference has stopped being an efficiency question and started being a risk question.