Legal Triage Framework: A Governed Model for Legal Teams

A legal triage framework is the set of rules that decides what happens to a request the moment it reaches your team. It classifies the request, ranks it, routes it and defines when it escalates. Most frameworks stop there. They describe a queue. A framework built for a modern legal department has to go further. It must record why each decision was made, show which version of the rules made it, and prove that a lawyer stayed in control.

This guide gives GCs and legal ops leaders a working model. It covers criteria, tiers, routing, self-service, escalation and measurement. It also takes a position on AI in triage. Use it, but only inside a governed workflow.

TL;DR

• Triage is a decision system, not an inbox. Define criteria, tiers, routes and escalation paths before you pick a tool.
• Risk overrides volume. A simple-looking request with regulatory or privilege exposure goes to a lawyer.
• Every triage decision needs an audit trail: inputs, rule version, outcome, reviewer.
• AI can classify and draft. It must not decide alone. Keep deterministic rules and human review around it.
• Review the framework on a schedule. Rules that never change are rules nobody is checking.

Table of Contents

• What a legal triage framework does
• There is no universal triage rule
• Criteria: what to assess on every request
• Tiers: three lanes that hold up
• Intake: the step everything depends on
• The six-step workflow
• Routing rules and escalation paths
• Self-service and where to stop it
• AI in triage: use it, and govern it
• Perspective: governance is the framework
• Measuring and improving the framework
• Putting the framework into a governed workflow
• A 30-day launch plan
• FAQ
• Sources

What a legal triage framework does

Legal triage is the structured sorting of legal problems by need so that each one reaches the right service. The Law and Justice Foundation of NSW defines it as sorting problems by degree or type of need to decide the appropriate service when resources are limited. The setting there is legal aid. The logic transfers directly to a corporate legal department. Demand exceeds capacity. Someone has to choose.

The framework solves three problems.

1. Mismatch. Senior counsel spend hours on work a template could handle. Junior staff receive matters that carry real exposure.
2. Invisibility. Requests arrive by email, chat and hallway conversation. Nobody can say what the team handled last quarter or why.
3. Indefensibility. When a decision is questioned, there is no record. The argument against you writes itself.

The third problem is the one most frameworks ignore. A triage decision is a legal judgment about priority and risk. If you cannot reconstruct it, you cannot defend it.

There is no universal triage rule

The NSW research makes a point worth taking seriously. No single rule is correct. Services may prioritize first-come requests, urgency, the worst-off, expected outcomes or the greatest number of people helped. The right choice depends on purpose and capacity.

For a corporate legal team, this means you must state your purpose before you write rules. Ask four questions.

• What is the department there to protect? Revenue, reputation, regulatory standing, speed of deals?
• Which business clients and request types are in scope?
• What outputs can the team deliver? Advice, documents, reviews, representation?
• What happens to requests outside scope?

Write the answers down. They become the preamble to your rules. When a business leader asks why a request waited, you point to the stated purpose and the criteria that follow from it.

Criteria: what to assess on every request

The NSW framework lists criteria that can include the type, severity and urgency of the problem, available assistance options, and likely outcomes. The CLOC and Morgan Lewis Matter Life Cycle Management guide is closer to in-house practice. It lists issue description, classification, requested assistance, desired outcome, value or exposure, timetable and available resources as core intake inputs. For triage and assignment, the same guide points to risk rating, urgency, level of effort, strategic alignment and matter classification.

Turn that into a scoring set your team can apply in under two minutes.

Keep the list short. Every criterion you add slows intake and invites inconsistent scoring. Seven is a ceiling.

Risk outranks everything

Complexity and risk are different axes. A request can be simple and dangerous. A one-line question about sharing a document with an outside consultant can waive privilege. A routine vendor onboarding can create a data-protection exposure. Your framework must let risk lift a request out of the automated lane regardless of how easy it looks.

Encode this as a rule, not a habit. Habits fail when the team is busy.

Tiers: three lanes that hold up

A three-tier model works for most departments. It is simple enough to enforce and rich enough to route sensibly.

Tier 1: Governed self-service. Low-risk, repeatable, rules-based work. Standard NDAs, routine policy questions, basic intake for common requests. A workflow handles it. A lawyer owns the rules and reviews samples.

Tier 2: Structured legal review. Moderate complexity with a defined process. Contract negotiation within playbook limits, vendor risk review, standard regulatory questions. A lawyer or trained legal ops professional handles it with templates and checklists.

Tier 3: Counsel judgment. High-stakes, novel or bespoke work. Disputes, investigations, regulatory inquiries, matters with board visibility. Senior in-house counsel or specialist outside counsel handles it. No automation decides anything here.

The access-to-justice research offers a useful check on this logic. A 2023 Harvard Law School Center on the Legal Profession paper describes a practical model built on legal-issue impact and client vulnerability. High-impact or high-priority matters go to advice. Lower-impact, lower-vulnerability matters go to information and self-help. In a corporate setting, replace client vulnerability with business exposure. The structure is the same.

Intake: the step everything depends on

Triage is only as good as the data it receives. The CLOC guide defines intake as receiving a legal-service request and agreeing its goals, scope, resources, value and timetable before execution. That definition is the standard to hold yourself to.

A free-text email fails that standard. A structured form passes it. Build intake around these fields.

• Requester, business unit and jurisdiction
• Request type, chosen from a controlled list
• Description of the issue in the requester’s words
• Desired outcome
• Deadline and the reason for it
• Known exposure: regulator, counterparty, data type, dollar value
• Attachments

Use conditional logic. If the requester selects personal data, ask where it is stored and who receives it. If they select a government contact, flag the request for immediate review. The form should do the first pass of questioning so lawyers do not have to.

The six-step workflow

The CLOC guide describes a sequence that fits a governed workflow well. Receive and profile the request, confirm objectives and data, classify risk and priority, review active matters and resource availability, assign a responsible lawyer, and decide whether additional resources are needed.

Here is how to operationalize each step.

1. Receive and profile. Capture the request through one front door. Close side channels or redirect them.
2. Confirm objectives and data. Check completeness. Return incomplete requests automatically with specific questions.
3. Classify. Apply the criteria table. Assign a matter type, risk rating and priority.
4. Check capacity. Compare against active matters and availability.
5. Assign. Name one responsible lawyer. A shared inbox is not an owner.
6. Decide on resources. Determine whether outside counsel, a specialist or a vendor is needed.

Each step produces a record. That record is your audit trail.

Routing rules and escalation paths

Routing rules should read like policy, not like preferences. Write each one as a condition and an outcome.

• If matter type is NDA and risk is low and counterparty is on the approved list, route to Tier 1.
• If the request involves personal data of EU residents, route to the privacy lead regardless of tier.
• If value exceeds the delegated authority threshold, route to the GC for approval.
• If the request names a regulator, escalate to Tier 3 immediately.

Escalation paths need owners and clocks. Define who receives the escalation, how fast they must respond, and what happens if they do not.

Triage is not a single decision

The NSW framework distinguishes primary triage from later secondary triage. Triage can occur repeatedly as new facts emerge. Build that into your workflow. A Tier 1 request can become Tier 3 when the business reveals a fact on day four. Give the assigned lawyer a one-click path to re-triage, and record the reason.

Self-service and where to stop it

Self-service works when the answer is stable and the exposure is low. It fails when teams extend it to work that only looks stable.

Good candidates:

• Standard-form agreements within pre-approved terms
• Policy lookups with a single correct answer
• Routine acknowledgments and intake confirmations
• Checklists for onboarding processes

Poor candidates:

• Anything touching privilege, litigation holds or investigations
• Regulatory interpretation
• Novel contract terms
• Matters with a named regulator or counterparty in dispute

Set a hard stop. If the answer depends on judgment, the workflow routes to a lawyer. Do not let a requester override that by choosing a different category.

AI in triage: use it, and govern it

AI classification is attractive because intake volume is the bottleneck. A model can read an email, suggest a matter type and propose a risk rating in seconds. That is useful. It is also where the exposure starts.

An ungoverned model in triage creates four problems.

• No explanation. The model classified a request as low risk. Nobody can say why.
• No version control. The prompt changed in March. Nobody recorded it. Decisions before and after are not comparable.
• No oversight. The output routed work directly. No lawyer saw the decision.
• No portability. The process depends on one vendor’s model. When it changes, your triage changes with it.

The professional duties here are not new. ABA Formal Opinion 512, issued July 29, 2024, addresses generative AI under the Model Rules. Its themes include competence, confidentiality, client communication, candor toward tribunals, supervisory responsibilities and reasonable fees. Supervision applies to a triage model the same way it applies to a junior associate. A lawyer remains responsible for the output.

The NIST AI Risk Management Framework gives a voluntary structure for managing these risks. It was released on January 26, 2023, and NIST states that it is being revised. Use it as a reference for your governance model and check the current version.

Five controls for AI-assisted triage

1. Deterministic rules around the model. The model suggests. Rules decide. If risk flags fire, the rule routes to a lawyer whatever the model says.
2. Human review at defined points. Specify which tiers require sign-off and who signs.
3. Full logging. Store the input, the model used, the prompt version, the output, the rule that fired and the reviewer’s action.
4. Versioned logic. Every change to rules, prompts or thresholds gets a version, an owner and an effective date.
5. Model independence. Keep the workflow separate from any single model so you can swap or compare models without rebuilding triage.

These controls make the decision explainable. They also make it defensible. When a regulator, a court or your own board asks how a request was handled, you produce the record.

Perspective: governance is the framework

We build governed AI infrastructure for legal and compliance teams. That shapes how we read every triage framework we see.

Most frameworks describe categories. They tell you to sort requests into tiers and route them. That is necessary. It is not enough. The question a GC will face is not whether the team had tiers. The question is whether the team can show how a specific request was classified, by what logic, under which version, and who approved it.

We take a clear position. Governance is the differentiator, not features. A triage tool that classifies quickly but cannot explain itself creates risk faster than it creates efficiency. A chatbot answering legal intake questions is not infrastructure. It is a point solution with no memory.

Our approach rests on three commitments. Rules are deterministic where the law demands certainty. AI is used for decision support, never as the sole decision maker. Every action is recorded for audit. Because we are model-agnostic, your triage logic does not depend on one vendor’s roadmap or terms.

If your triage process cannot survive an audit, it is not finished.

— Patrick

Measuring and improving the framework

A framework that never changes is a framework nobody is testing. Treat triage as a learning system. Recorded routing outcomes show which work can move to a lower-cost lane and which lanes can absorb more complexity.

Track these measures every month.

• Time to triage. Hours from submission to classification.
• Misroute rate. Share of requests re-triaged to a different tier.
• Escalation rate. Share of Tier 1 and Tier 2 requests that escalate.
• Self-service containment. Share of Tier 1 requests closed without lawyer involvement, with sample review of quality.
• Override rate. How often lawyers change a model or rule recommendation.
• Incomplete intake rate. Share of requests returned for missing information.

Read them together. A high override rate means the rules or the model are wrong. A high misroute rate means the criteria are unclear. A low escalation rate with rising complaints means Tier 1 is absorbing work it should not.

Set a quarterly review. Pull a random sample of closed requests from each tier. Compare the recorded classification with what a senior lawyer would decide today. Fix the rules, version the change and log the reason.

For context on why this matters, a 2016 access-to-justice white paper reports that in Massachusetts more than half of callers to one intake hotline hung up after waiting between 30 minutes and two hours. The setting is legal aid. The lesson applies anywhere. Slow intake loses the requester. In a corporate department, the requester does not hang up. They go around you.

Putting the framework into a governed workflow

A framework on paper is a document. A framework in a workflow is a control. The gap between them is where most legal departments stall.

Neota Logic is where we close that gap. Our platform turns your intake form, classification logic, routing rules and escalation paths into a governed workflow. It orchestrates multiple AI models for decision support, keeps lawyers in the loop at the points you define, and records each action for audit. You can see how our workflow and AI governance solutions apply to intake, matter triage, contract automation and risk assessment.

If you are not sure where to start, a Discovery Sprint maps your current intake to a governed design. You leave with a clear view of which requests can be automated, which need review and which logic must be deterministic. You can also start at neotalogic.com.

A 30-day launch plan

You do not need a year. You need discipline.

Week 1: Audit. Pull three months of requests. Categorize them. Identify volume by type, source and outcome. Note where requests bypass the front door.

Week 2: Define. Write your purpose statement, criteria, tiers and routing rules. Name owners. Get GC sign-off.

Week 3: Build. Create the intake form and workflow. Configure logging, versioning and review points. Test with real historical requests.

Week 4: Pilot. Run one business unit. Review every Tier 1 closure. Fix errors. Record every change.

Then expand. Review monthly measures. Review the framework quarterly.

FAQ

What is a legal triage framework?

It is a documented set of criteria, tiers, routing rules and escalation paths that sort incoming legal requests by need, risk and urgency. It directs each request to the right person or process. A strong framework also records every decision so you can explain and defend it later.

What criteria should a legal team use to prioritize requests?

Start with matter type, risk, urgency, value, effort, strategic fit and capacity. These track the inputs that CLOC guidance lists for intake and assignment. Let risk override the others. A simple request with serious exposure belongs with a lawyer.

Can AI make triage decisions?

AI can suggest a classification and flag issues. It should not decide alone. Wrap it in deterministic rules, require human review at defined points, and log every input, output and rule version. A lawyer stays accountable for the result.

Which requests are safe for self-service?

Low-risk, repeatable requests with stable answers. Standard-form agreements, policy lookups and onboarding checklists are typical. Anything involving privilege, regulators, investigations or novel terms goes to a lawyer.

How often should we revisit the framework?

Review measures monthly and run a full review each quarter. Sample closed requests from every tier and compare them against current judgment. Version every change and record the reason.

Sources

• Developing a triage framework: linking clients with services at Legal Aid NSW
• Matter Life Cycle Management (MLM) for Legal Teams, CLOC and Morgan Lewis
• Is access for all really access to justice? Harvard Law School Center on the Legal Profession
• There’s an App for That? Access-to-justice white paper, 2016
• ABA Formal Opinion 512: The Paradigm for Generative AI in Legal Practice
• NIST AI Risk Management Framework