Security Review Killed 41% of Failed Legal AI Pilots — Mid-Sized Firms Most Exposed

The Legal Stack's Procurement Decision-Maker Shift Report 2026 (published August 10) found that 41% of legal AI pilots that failed to convert to paid contracts cited "security review stalled or failed" as the primary factor — not product performance. At mid-sized firms, the structural change is the most dramatic: 18 months ago, 61% of AI tool purchases at mid-sized firms were initiated and approved by practice group leaders or individual partners; by the 2025 survey cycle, that figure fell to 39%, with the gap absorbed by a multi-stakeholder model involving the firm administrator or COO, IT director, and often fractional privacy counsel reviewing vendor DPAs. Security sign-off is now a formal approval requirement at 67% of mid-sized legal operations environments surveyed (up from 44% in 2023–2024). For COOs and IT directors at mid-sized firms, the practical implication is that vendor selection should begin with security posture — SOC 2 Type II certification, DPA flexibility, and 200-question security questionnaire response time — before evaluating workflow features.