Deployment Blueprint: A Mid-Size Law Firm Runs GLM-5.2 for Privileged Discovery

This blueprint is a representative reference architecture — anonymized and generalized from the deployment patterns we design for law firms. No client names appear, and no outcome figures are invented.

The situation

A 120-lawyer full-service firm — picture Toronto or Chicago — faces the same pressure as every litigation practice in 2026: document volumes growing faster than associate hours, clients pushing back on review bills, and competitors visibly using AI. Associates were already using consumer AI tools quietly; the firm's own audit found prompts containing matter facts. The partnership wanted the capability without the exposure, and an outright ban had demonstrably failed.

The constraint

Three duties frame everything the firm can build:

• Confidentiality. ABA Model Rule 1.6 in the US; rule 3.3-1 of the FLSC Model Code in Canada — a near-absolute duty to protect client information, which ABA Formal Opinion 512 (2024) applies directly to generative-AI inputs.
• Privilege. After US v. Heppner (SDNY, February 2026) held consumer-AI conversations unprivileged and discoverable, the firm's cleanest position is that privileged material is never communicated to any third party at all.
• Jurisdiction. For the Canadian variant, the US CLOUD Act (18 USC 2713) reaches data held by US providers even in Canadian regions, and Quebec matters trigger Law 25's cross-border assessment with penal exposure to C$25M or 4% of turnover.

Enterprise API contracts narrow these risks; none eliminates the third party. The firm required an architecture where the answer to "who else holds this?" is no one.

The architecture

Component	Choice
Model	GLM-5.2 (744B MoE, 40B active, 1M-token context, MIT license)
Fine-tune	LoRA adapters trained in-environment on two decades of firm precedents, styles, and clause libraries
Vision pipeline	Qwen3-VL for scanned exhibits, handwritten notes, and image-heavy productions
Hardware	Single rack, 8–12 datacenter GPUs at FP8, on-premise server room
Access control	SSO against the firm directory; role-based access mapped to matter teams; ethical-wall enforcement at the retrieval layer
Logging	Append-only audit log of prompts, outputs, model and adapter versions — the firm's own defensibility record
Egress	Zero. No third-party API calls; air-gap-capable segment for the most sensitive matters

Deployment followed the standard six-to-twelve-week engagement: sovereignty assessment and architecture, hardware procurement in parallel, hardening and security review before any client data touched the system, then fine-tuning against an evaluation harness built from the firm's actual work product — real memos, real productions, graded by partners.

What it unlocks

First-pass discovery triage at zero marginal cost. The economics of owned hardware invert the review problem: the rack is idle overnight, so a queue of documents run through relevance and privilege triage costs electricity, not per-token fees. A million-token context means an entire production folder is analyzed in one pass with cross-document consistency — the model sees the thread, not fragments. Human reviewers start each morning from a ranked, annotated set rather than a cold pile.

Precedent-aware drafting in the firm's own voice. The LoRA-tuned model drafts from the firm's precedent corpus — its clause constructions, its jurisdictional variants, its house style — rather than generic legalese. Because adapters were trained in-environment, the precedent bank that constitutes much of the firm's accumulated value never left the building to teach someone else's model.

Shadow AI ends. The sanctioned tool is better than the consumer tools associates were sneaking — unlimited use, no meter, tuned to the firm's work, inside the perimeter. Security-industry surveys consistently find roughly a quarter of employees paste confidential material into public AI tools; the durable fix is an approved tool nobody needs to route around.

A defensibility file, not a risk memo. When a client, court, or law society asks how the firm uses AI, the answer is architectural: privileged material never transits a third party; here is the access log, the model version, and the ethical-wall configuration. Post-Heppner, that is the strongest available position — a fact about infrastructure rather than an argument about contracts.

The full legal analysis behind this pattern is in our guide to what US v. Heppner changed for lawyers using AI, with hardware sizing in the GLM-5.2 GPU requirements guide. For the practice overview, see law firm deployments and our on-premise LLM deployment service.