STRATEGIC SAAS LEGAL TECH ALIGNMENT AND SHADOW AI MITIGATION: A SYSTEMATIC REVIEW
DOI:
https://doi.org/10.32524/ukmcic.v3i1.2307Keywords:
Legal Tech, Shadow AI, Personal Data Protection, TOE Framework, Strategic Alignment ModelAbstract
Indonesian law firms face a governance duality: manual filing persists while junior lawyers covertly use public generative artificial intelligence, Shadow AI, threatening client confidentiality. This study synthesizes evidence on centralized Software as a Service Legal Tech adoption and identifies alignment mechanisms that mitigate Shadow AI under Indonesia's Personal Data Protection Law Number Twenty Seven of Two Thousand Twenty Two and the Two Thousand Twenty Six AI Guidelines for Advocates of the Indonesian Advocates Association. A systematic literature review following the Kitchenham guidelines and the PRISMA Two Thousand Twenty statement searched five databases for studies published from Two Thousand Twenty Two to Two Thousand Twenty Six. Of Two Hundred Forty Five records, seventeen primary studies met the inclusion and quality criteria and were coded thematically using the Technology Organization Environment framework and the Strategic Alignment Model. Efficiency is the most consistent technological driver, whereas hallucination, data security, and liability are the dominant barriers. Change capacity, staff skills, and partner consensus matter more than capital. Shadow AI reflects functional misalignment between work demands and firm provided information technology, so sanctioned tools mitigate it better than bans. Corporate firms face strategic fit challenges, whereas litigation firms are more exposed to hallucination and Shadow AI risks. The study integrates both theories into a framework with six propositions, positions strategic alignment as a moderator, and identifies five research gaps for partnership structured organizations. Managing partners gain a four stage roadmap: inventory and policy, sanctioned tools selected through vendor due diligence, workflow integration with output verification, and continuous monitoring. To the authors' knowledge, this is the first review to connect Software as a Service Legal Tech adoption, Shadow AI, and Indonesia's post transition data protection regime in a single integrated framework, reframing Shadow AI as an alignment failure rather than merely a disciplinary problem.
References
American Bar Association Standing Committee on Ethics and Professional Responsibility. (2024, July 29). Formal opinion 512: Generative artificial intelligence tools. American Bar Association.
Armour, J., Parnham, R., & Sako, M. (2022). Augmented lawyering. University of Illinois Law Review, 2022(1), 71–138.
Baker, J. (2012). The technology–organization–environment framework. In Y. K. Dwivedi, M. R. Wade, & S. L. Schneberger (Eds.), Information systems theory: Explaining and predicting our digital society (Vol. 1, pp. 231–245). Springer. https://doi.org/10.1007/978-1-4419-6108-2_12
Brooks, C., Gherhes, C., & Vorley, T. (2020). Artificial intelligence in the legal sector: Pressures and challenges of transformation. Cambridge Journal of Regions, Economy and Society, 13(1), 135–152. https://doi.org/10.1093/cjres/rsz026
Calaguas, M. (2025). 2024 artificial intelligence TechReport. American Bar Association Law Practice Division. https://www.americanbar.org/groups/law_practice/resources/tech-report/2024/2024-artificial-intelligence-techreport/
Chan, Y. E., & Reich, B. H. (2007). IT alignment: What have we learned? Journal of Information Technology, 22(4), 297–315. https://doi.org/10.1057/palgrave.jit.2000109
Choi, J. H., Monahan, A., & Schwarcz, D. (2024). Lawyering in the age of artificial intelligence. Minnesota Law Review, 109. https://ssrn.com/abstract=4626276
Coltman, T., Tallon, P., Sharma, R., & Queiroz, M. (2015). Strategic IT alignment: Twenty-five years on. Journal of Information Technology, 30(2), 91–100. https://doi.org/10.1057/jit.2014.35
Dahl, M., Magesh, V., Suzgun, M., & Ho, D. E. (2024). Large legal fictions: Profiling legal hallucinations in large language models. Journal of Legal Analysis, 16(1), 64–93. https://doi.org/10.1093/jla/laae003
DPN Perhimpunan Advokat Indonesia (PERADI). (2026). Pedoman penggunaan kecerdasan buatan (artificial intelligence) bagi advokat [Guidelines on the use of artificial intelligence for advocates] [Official policy document, enacted 6 August 2026]. Dewan Pimpinan Nasional PERADI.
Dwivedi, Y. K., Kshetri, N., Hughes, L., Slade, E. L., Jeyaraj, A., Kar, A. K., Baabdullah, A. M., Koohang, A., Raghavan, V., Ahuja, M., Albanna, H., Albashrawi, M. A., Al-Busaidi, A. S., Balakrishnan, J., Barlette, Y., Basu, S., Bose, I., Brooks, L., Buhalis, D., ... Wright, R. (2023). "So what if ChatGPT wrote it?" Multidisciplinary perspectives on opportunities, challenges and implications of generative conversational AI for research, practice and policy. International Journal of Information Management, 71, 102642. https://doi.org/10.1016/j.ijinfomgt.2023.102642
Greenwood, R., Hinings, C. R., & Brown, J. (1990). "P2-form" strategic management: Corporate practices in professional partnerships. Academy of Management Journal, 33(4), 725–755. https://doi.org/10.5465/256288
Haag, S., & Eckhardt, A. (2017). Shadow IT. Business & Information Systems Engineering, 59(6), 469–473. https://doi.org/10.1007/s12599-017-0497-x
Henderson, J. C., & Venkatraman, N. (1993). Strategic alignment: Leveraging information technology for transforming organizations. IBM Systems Journal, 32(1), 4–16. https://doi.org/10.1147/sj.321.0004
Hughes, L., Davies, F. B., Li, K., Gunaratnege, S. M., Malik, T., & Dwivedi, Y. K. (2026). Beyond the hype: Organisational adoption of generative AI through the lens of the TOE framework – A mixed methods perspective. International Journal of Information Management, 86, 102982. https://doi.org/10.1016/j.ijinfomgt.2025.102982
Hukumonline. (2026, August 6). Peradi luncurkan pedoman AI bagi advokat, ingatkan etika dan perlindungan data klien [Peradi launches AI guidelines for advocates, reminds of ethics and client data protection]. https://www.hukumonline.com/berita/a/peradi-luncurkan-pedoman-ai-bagi-advokat--ingatkan-etika-dan-perlindungan-data-klien-lt6a748379a7427/
Kim, S., Yi, S., & Park, S.-P. (2025). Prioritizing challenges in AI adoption for the legal domain: A systematic review and expert-driven AHP analysis. PLOS ONE, 20(6), e0326028. https://doi.org/10.1371/journal.pone.0326028
Kitchenham, B., & Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering (Technical Report EBSE-2007-01). Keele University & Durham University.
Kronblad, C. (2020). How digitalization changes our understanding of professional service firms. Academy of Management Discoveries, 6(3), 436–454. https://doi.org/10.5465/amd.2019.0027
Kusnadi, A., & Hariati, N. A. (2026). Digital data privacy and legal professional ethics: Implications of the 2022 PDP Law on client confidentiality. Al-Qadha: Jurnal Hukum dan Syari'ah, 2(1), 115–121. https://doi.org/10.64317/alqadha.v1i2.18
Low, C., Chen, Y., & Wu, M. (2011). Understanding the determinants of cloud computing adoption. Industrial Management & Data Systems, 111(7), 1006–1023. https://doi.org/10.1108/02635571111161262
Luftman, J. (2000). Assessing business-IT alignment maturity. Communications of the Association for Information Systems, 4, Article 14. https://doi.org/10.17705/1CAIS.00414
Magesh, V., Surani, F., Dahl, M., Suzgun, M., Manning, C. D., & Ho, D. E. (2025). Hallucination-free? Assessing the reliability of leading AI legal research tools. Journal of Empirical Legal Studies. https://doi.org/10.1111/jels.12413
Mäntymäki, M., Minkkinen, M., Birkstedt, T., & Viljanen, M. (2022). Defining organizational AI governance. AI and Ethics, 2(4), 603–609. https://doi.org/10.1007/s43681-022-00143-x
Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023).
Microsoft & LinkedIn. (2024, May). 2024 Work Trend Index annual report: AI at work is here. Now comes the hard part. https://news.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
Ministry of Communication and Informatics of the Republic of Indonesia. (2023). Surat Edaran Menteri Komunikasi dan Informatika Nomor 9 Tahun 2023 tentang Etika Kecerdasan Artifisial [Circular Letter of the Minister of Communication and Informatics No. 9 of 2023 on Artificial Intelligence Ethics].
Mipon, I. P., & Putra, M. F. M. (2023). Penyelenggaraan pelindungan data pribadi oleh notaris berdasarkan Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi [Personal data protection by notaries under Law Number 27 of 2022 on Personal Data Protection]. Jurnal Hukum & Pembangunan, 53(3), 479–492. https://doi.org/10.21143/jhp.vol53.no3.1576
Oliveira, T., Thomas, M., & Espadanal, M. (2014). Assessing the determinants of cloud computing adoption: An analysis of the manufacturing and services sectors. Information & Management, 51(5), 497–510. https://doi.org/10.1016/j.im.2014.03.006
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E. A., Brennan, S. E., Chou, R., Glanville, J., Grimshaw, J. M., Hróbjartsson, A., Lalu, M. M., Li, T., Loder, E. W., Mayo-Wilson, E., McDonald, S., ... Moher, D. (2021). The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ, 372, n71. https://doi.org/10.1136/bmj.n71
Papagiannidis, E., Mikalef, P., & Conboy, K. (2025). Responsible artificial intelligence governance: A review and research framework. The Journal of Strategic Information Systems, 34(2), 101885. https://doi.org/10.1016/j.jsis.2024.101885
Republic of Indonesia. (2022). Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi [Law Number 27 of 2022 on Personal Data Protection]. State Gazette of the Republic of Indonesia Year 2022 Number 196.
Resultsense. (2026, May 19). Survey: 59% of UK legal professionals using unauthorised AI [Censuswide survey for Access Legal]. https://www.resultsense.com/news/2026-05-19-uk-lawyers-unauthorised-ai-use/
Rodgers, I., Armour, J., & Sako, M. (2023). How technology is (or is not) transforming law firms. Annual Review of Law and Social Science, 19, 299–317. https://doi.org/10.1146/annurev-lawsocsci-111522-074716
Saragih, S., Khalishah, N., & Sampun, G. (2025). Kecerdasan buatan dan perlindungan privasi data: Perbandingan hukum Undang-Undang Nomor 27 Tahun 2022 Indonesia dengan Personal Data Protection Act 2010 Malaysia [Artificial intelligence and data privacy protection: A legal comparison of Indonesia's Law Number 27 of 2022 and Malaysia's Personal Data Protection Act 2010]. Maleo Law Journal, 9(2), 158–173. https://doi.org/10.56338/mlj.v9i2.8826
Schneider, J., Abraham, R., Meske, C., & vom Brocke, J. (2023). Artificial intelligence governance for businesses. Information Systems Management, 40(3), 229–249. https://doi.org/10.1080/10580530.2022.2085825
Silic, M., & Back, A. (2014). Shadow IT – A view from behind the curtain. Computers & Security, 45, 274–283. https://doi.org/10.1016/j.cose.2014.06.007
Singh, S., Singh, R., Gehlot, A., Akram, S. V., Thakur, A. K., & Dogra, S. (2025). Adoption of digitalization and sustainable services for Legal Practice 4.0: A comprehensive review. Asian Journal of Interdisciplinary Research, 8(2), 21–34. https://doi.org/10.54392/ajir2522
Thomson Reuters Institute. (2025, June). Future of professionals report 2025. https://www.thomsonreuters.com/en/institute/reports/future-of-professionals-2025
Tornatzky, L. G., & Fleischer, M. (1990). The processes of technological innovation. Lexington Books.
von Nordenflycht, A. (2010). What is a professional service firm? Toward a theory and taxonomy of knowledge-intensive firms. Academy of Management Review, 35(1), 155–174. https://doi.org/10.5465/amr.35.1.zok155
Waters-Lynch, J., Allen, D. W. E., Potts, J., & Berg, C. (2025). Shadow user innovation: Governing covert generative-AI use for dynamic-capability renewal. Innovation: Organization & Management. Advance online publication. https://doi.org/10.1080/14479338.2025.2519546
Yang, J., Blount, Y., & Amrollahi, A. (2024). Artificial intelligence adoption in a professional service industry: A multiple case study. Technological Forecasting and Social Change, 201, 123251. https://doi.org/10.1016/j.techfore.2024.123251
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Rama Rivansyah, Antonius Wahyu Sudrajat
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
