← All articles

What Is a Gap Assessment? A Guide for Legal Teams

Katie Pham
·
November 10, 2026

A gap assessment compares your current state with a defined required state, then lists every place the two differ. The required state can be a regulation, a contract, a policy, a standard or an internal commitment. The output is a list of gaps and a plan to close them. For legal departments and law firms, the most urgent required state today is governed AI use.

Neota Logic
Put Governance Around Legal AI
Neota Logic adds governed, auditable workflows to the AI tools legal teams already use, with logged steps and human checkpoints.

TL;DR

  • A gap assessment measures actual performance against a defined requirement. It ends in a remediation plan, not a grade.
  • A compliance gap is a requirement that is unmet, partly met, or met but not documented. The third kind is the one that hurts in an audit.
  • Gap assessment asks whether controls meet a standard. Risk assessment asks how likely and how damaging an event is. You need both.
  • For legal AI, the first gap is almost always visibility. You cannot govern tools you have not inventoried.
  • Closing a gap requires evidence. Logs, versioned policies and explainable decisions are what make a closed gap stay closed.

Table of Contents

What a gap assessment is

The Accountability Framework defines a gap assessment as a comparison of actual performance with the desired performance set by commitments, policies, goals, targets or other obligations. It identifies the gaps and informs the action plans that deliver full compliance.

That definition has three parts. Each one matters.

  1. A defined standard. No standard, no assessment. “Be more careful with AI” is not a standard. “No privileged material enters a tool without an approved enterprise agreement” is.
  2. An honest picture of current practice. Not the policy as written. The practice as performed.
  3. An action plan. A list of gaps with no owners and no dates is a report, not an assessment.

You will see the terms gap analysis and gap assessment used interchangeably. Harvard Business School Online describes gap analysis as measuring the difference between current operations and ideal performance, and ties it to strategic planning and target setting. In a compliance setting the method is the same. Only the yardstick changes.

What a compliance gap looks like

A compliance gap is a requirement that is not met, partially met, or met but not documented, according to MetricStream. The Institute of Quality Assurance adds that the gap may be a missing document, record, policy, instruction or operational environment needed to reach the intended result.

Take the third category seriously. A team can do the right thing every day and still fail a review because nothing proves it. In a legal department, that looks like this:

  • A policy says associates must review AI-drafted clauses. No record shows who reviewed what.
  • A triage rule routes high-risk matters to senior counsel. The rule lives in someone’s head and in a shared inbox.
  • An outside-counsel guideline bars certain data from third-party tools. Nobody can say which tools touched which data.

Each example is a gap. None is a failure of intent. All three are failures of evidence, and evidence is what regulators, courts, clients and auditors ask for.

Gap assessment versus risk assessment

Teams confuse these two constantly. They answer different questions.

MetricStream distinguishes them this way: gap analysis asks whether controls satisfy a defined standard, while risk assessment estimates the likelihood and impact of adverse events. Foley & Lardner frames them as complements. The risk assessment identifies the risks. The gap analysis tests whether your policies and controls address them.

Gap assessment Risk assessment
Core question Do we meet the standard? What could go wrong, and how badly?
Starting point A defined requirement A threat or exposure
Output Gaps and a remediation plan Ranked risks and likelihood-by-impact scores
Best used Before an audit, a new rule, a new tool rollout Before choosing controls, and on a recurring cycle

Our position is simple. Run the risk assessment first to decide which standards matter. Run the gap assessment to see how far you are from them. Then sequence the work by risk.

When to run one

MetricStream lists five common triggers: new regulations, upcoming audits, security incidents, major organizational change, and a periodic cadence. Legal teams should add a sixth. Run one whenever a new AI tool enters the building, officially or not.

The periodic cadence is the one most teams skip. A gap assessment done once is a snapshot. Tools change, vendor terms change, and staff find new shortcuts. Annual is the floor for anything touching client data.

How to conduct a gap assessment, step by step

The sequence below draws on guidance from Foley & Lardner, the International Institute of Business Analysis and the Institute of Quality Assurance. The IIBA lays out ten steps. In practice they collapse into seven.

1. Define scope and requirements

Name the standard. Name the business unit, the matter types and the tools in scope. Write each requirement as a statement a person could test. The Federal Acquisition Institute’s Project Manager’s Guidebook says requirements management includes documenting requirements, verifying and validating them, and tracing each one to its source. Do that. A requirement you cannot trace to a source cannot be defended.

2. Gather documentation

Collect policies, procedures, contracts, vendor terms, training records, prior audit findings and system logs. Do this before interviews. You want to know what the paper says before you hear what people say.

3. Assess current practice

The Institute of Quality Assurance says gap assessments commonly combine document review, interviews with workers and management, observation of work, evidence collection, comparison with requirements, and a judgment about conformity. Interviews matter most here. They surface the workarounds that no document records.

4. Rate each requirement

Use a fixed scale. SnapGRC recommends statuses such as compliant, partially compliant, non-compliant and not applicable. Fixed statuses make results comparable from one cycle to the next. Free-text findings do not.

5. Prioritize

SnapGRC suggests ranking findings by regulatory risk, audit risk, business risk and effort to fix, with a likelihood-by-impact matrix where it fits. In legal work, add a fifth lens: privilege and confidentiality exposure. A gap that can waive privilege outranks nearly everything else.

6. Build the action plan

Foley & Lardner says the plan should specify tasks, timelines, responsible parties and resource requirements. Every gap gets an owner. Every owner gets a date. No exceptions.

7. Close, verify and keep the evidence

Closure is not a status change. SnapGRC says closure requires document review, technical testing, process walkthroughs or sample testing, followed by an updated status and retained evidence. The PCAOB’s remediation spotlight makes a related point for auditors: remedial efforts should be diligent and appropriately aggressive, and longer plans can run past 12 months only when they carry reasonable milestones and the firm does everything reasonably possible within the period. Credible progress counts. A theoretical plan does not.

What “gap compliant” means

People search for this phrase, but no formal status carries the name. The useful reading comes from certification. Under ISO, the Institute of Quality Assurance notes, certification requires evidence that non-conformances have become conformances and that conformances are maintained.

So the working definition is this. You are compliant with respect to a gap when the fix exists, works, and can be proven on demand. Remove any one of the three and the gap is still open.

Most legal departments and firms already run AI. Some tools are approved. Many are not. Lawyers paste text into consumer chat tools. Vendors add AI features to existing products through a quiet update. The gap between the AI policy and the AI practice is wide in almost every organization we see.

Start with the inventory

The Stoel Rives readiness checklist tells legal, privacy and cybersecurity teams to inventory all known and informal AI uses. That includes code generation, predictive systems, monitoring, decision-making and generative text or image tools. It then asks you to assess risk by how each tool is used, whether it is off-the-shelf or proprietary, your organization’s role, and the legal frameworks that apply.

The Law Society of Ireland gives the same direction to legal practices in its shadow-AI guidance. Identify every tool, the data it processes and its contractual terms. Then decide which tools to stop and which to formalize under governance. It also recommends restricting consumer tools from client or privileged data absent suitable enterprise terms, documenting governance decisions, and reviewing the inventory annually and whenever tools or vendor terms change. The guide is Irish, but the discipline carries over to a U.S. practice.

The order matters. Organizations that understand AI’s role in compliance begin by identifying actual and informal AI use. Only then do they assess legal risk and design controls. Teams that write the policy first end up governing the tools they wish they had.

Start with the inventory

Measure against requirements you can name

For a U.S. legal team, the yardstick usually comes from several places at once:

  • Professional duties. The ABA’s Formal Opinion 512, issued July 29, 2024, addresses generative AI and recommends that lawyers secure informed consent before using client confidences in these tools. It says boilerplate consent in engagement letters will not be adequate.
  • A risk framework. The NIST AI Risk Management Framework organizes its core into four functions: govern, map, measure and manage. It treats governance as cross-cutting. That is a usable skeleton for your requirement list.
  • Client and contract terms. Outside-counsel guidelines and data-handling clauses often say more about AI than your own policy does.
  • Your own policy. The gap between what you wrote and what staff do is a finding by itself.

Rate what you find

A realistic AI gap register has rows like these:

Requirement Current practice Status
Approved tools only for client data Approved list exists, no technical enforcement Partially compliant
Human review of AI output before client delivery Expected by custom, not recorded Partially compliant
Record of which model produced which output No logging Non-compliant
Annual review of vendor AI terms Done once, no schedule Partially compliant

Notice the pattern. Intent is present. Enforcement and evidence are missing. That pattern is why policy alone does not close AI gaps.

> Perspective

Our view is that a gap assessment is only as good as the controls you can close it with.

Most AI gaps in legal organizations are not gaps in awareness. Counsel know the risks. The gaps are in enforcement and proof. A policy tells a lawyer what to do. It does not stop a privileged document from reaching the wrong tool, and it does not show a regulator or a client what happened afterward.

That is why we build governance as infrastructure, not as a document. Decisions that cannot be wrong belong in a deterministic rules engine. A rules engine applies the same logic every time, and it does not generate the answer on the decision path. AI belongs where it helps: drafting, classification, summarizing. A human checkpoint belongs wherever your firm wants a lawyer to sign off. Every step is logged.

Three properties turn a closed gap into a durable one. Audit trails show what happened. Versioning shows which rule or policy applied at the time. Explainability shows why a decision came out the way it did. Without all three, you are asserting compliance. With them, you are demonstrating it.

Run the gap assessment. Then close the gaps with controls that produce their own evidence.

Patrick

Turning findings into controls

A remediation plan has to survive contact with real workflows. Three principles help.

Put the control in the workflow. A rule that depends on memory will fail on a busy Friday. If a request needs senior review when it crosses a threshold, build the routing. Do not rely on a reminder.

Separate decisions from drafting. Eligibility, escalation, approval and jurisdiction rules should be deterministic and testable. Summaries and first drafts can use AI, with a checkpoint after them. This split lets you explain the decision path to an auditor in plain language.

Keep the log by default. Evidence collected after the fact is expensive and thin. Evidence generated at the moment of action is cheap and complete. Closure under the SnapGRC standard depends on retained evidence, so design for it from day one.

Turning findings into controls

What a good gap assessment report contains

A useful report is short enough to act on. Include these elements:

  1. The standard assessed, with version and date.
  2. The scope: units, matter types, tools.
  3. Method: documents reviewed, people interviewed, systems observed.
  4. A findings table with requirement, evidence, status and owner.
  5. Priorities with the reasoning behind them.
  6. The action plan with tasks, dates and resources.
  7. The re-test date.

MetricStream’s perspective is worth keeping in mind here. A gap analysis is diagnostic and forward-looking. It turns regulatory text into an implementation roadmap and does not stop at a pass or fail opinion. Write the report for the person who has to execute it.

Common mistakes

  • Assessing the policy, not the practice. Interviews and logs reveal the real state.
  • Skipping the “documented” test. Compliant but unprovable is still a gap.
  • No owner. Gaps without names do not close.
  • One-time exercise. Tool and vendor changes reopen gaps. Schedule the re-test.
  • Treating all gaps equally. Rank by privilege exposure, regulatory posture and effort.

Put governed controls under your AI tools

If your gap assessment shows AI use without enforcement, logging or review, we can help you close it. Neota Logic is governed AI infrastructure for legal and compliance teams. It is not a point solution and it is not a chatbot. It sits on top of the AI tools you already run, applies deterministic rules to decisions that cannot be wrong, adds human checkpoints where you want them, and logs every step. Our legal engineers scope and build each solution, so your team stays on client work.

Neota Logic

See how AI Enabled Solutions apply governed controls to the tools you use today. Explore risk assessment and compliance advisory solutions, or talk to us about the platform.

FAQ

What is the purpose of a gap assessment?

Its purpose is to show where current practice falls short of a defined requirement and to produce an action plan to close the shortfall. It turns vague concern into a specific list with owners and dates. It also gives you a baseline to measure progress against.

How is a gap assessment different from an audit?

A gap assessment is usually a forward-looking review of documents and practice against a standard, often done before a formal audit. An audit is a formal evaluation that produces an opinion on conformity. Many teams run a gap assessment first so the audit finds nothing new.

How often should we run one?

Run one before a new regulation takes effect, before an audit, after an incident, after major organizational change, and on a regular cycle. For AI tools that touch client data, review the inventory at least annually and whenever a tool or vendor term changes.

Who should own a gap assessment?

Legal, compliance or risk should own it, with input from IT, security and the business units in scope. The owner should have authority to assign remediation tasks. Without that authority, findings stall.

Sources

Ready to make your AI workflows defensible?

Book a demo and we'll walk one of your real processes through Neota.

Book demo