Procurement Authority Has Migrated: Legal AI Deals Are Now Won at the CIO and CISO Level

The Legal Stack's Procurement Decision-Maker Shift Report 2026 documents the most significant structural change in legal AI sales: procurement authority has moved upward and outward, away from the practice group partner or innovation lead who wants the tool, toward CIOs, CISOs, AI governance committees, and central procurement. For AmLaw 100–200 firms, tools priced above $50,000 per attorney annually now require sign-off from an average of 4.2 stakeholder groups. For Fortune 500 legal departments, the GC is final budget authority in only 34% of AI purchases above $100,000 annually — in 66% of cases, the CIO, a joint GC/CIO committee, or central procurement holds the decision. Enterprise sales cycles at Harvey stretched from ~60 days in 2023 to over 140 days by mid-2025. The report's most operationally specific finding: 41% of legal AI pilots that failed to convert to paid contracts cited "security review stalled or failed" as the primary factor — not product performance. For operators, security questionnaire response time and DPA flexibility are now product features, not compliance overhead.