Privilege Is a Zoning Law for Data. The Moat Is Below Grade.

In February 2025, the Professional Ethics Committee for the State Bar of Texas issued Opinion No. 706, one of the first ethics opinions in the country to squarely address the management-company structures now reshaping legal services. The opinion is remembered for its holding, a clean kill on fee design: a lawyer may not pay the company a percentage of firm revenue. What almost nobody remembers is the fact pattern's data architecture, which the parties had engineered with surgical care before they ever asked their question. On the stated facts, "all revenue information provided to the Company will be pooled and anonymized so that... the Company will not receive any confidential client information." The company would get no client list. It could not associate any dollar of revenue with any particular client. The arrangement failed anyway, but it failed on the fee formula, not on the data. The committee's silence about the data design is the loudest thing in the opinion.

Everyone read Opinion 706 as a fee opinion, a ceiling on how a nonlawyer company may be paid. Read it again as a zoning map. In the course of rejecting a percentage fee, a state regulator recited, without objection, a data architecture engineered to stay on the lawful side of confidentiality: pooled, anonymized, operational, and stripped of everything that relates to a client. This memo is about what sits on the legal side of that line, why it compounds, and why the rules, not the market, force it into the MSO.

"Below privilege" is the wrong phrase and the right concept

The data thesis most investors carry into legal AI goes like this: the moat is the matter corpus, the briefs, contracts, work product, and outcomes, and whoever accumulates the most of it compounds an advantage, whether a model company at the top of the stack, a vertical specialist, or the law firm itself. On that thesis the management services organization is plumbing, a structure with no data story. We think both halves are wrong, and that the reason is regulatory rather than competitive.

Start with the precision this argument lives or dies on. The instinctive boundary, privilege, is the wrong one. Attorney-client privilege is an evidentiary rule; the constraint that actually governs what legal data may move is ABA Model Rule 1.6, the confidentiality rule, and it is far broader. Rule 1.6 covers, with narrow exceptions, all "information relating to the representation of a client," not merely confidential communications, and Rule 1.18 extends a version of the duty to prospective clients, people who never hire the firm at all. So the title of this memo trades on a shorthand its first move must correct: below privilege is the wrong phrase and the right concept. The real zoning ordinance is Rule 1.6, and the legally poolable stratum sits below that, which makes it far thinner than any data-moat model in circulation assumes.

Zone legal data the way a city zones land and it sorts into five strata. First, privileged matter content, the advice and work product itself. Second, Rule 1.6-confidential matter information, everything non-public relating to the representation, a stratum much wider than the first. Third, consented or genuinely anonymized derivatives, the pooled-and-anonymized benchmark data of the Opinion 706 fact pattern. Fourth, operational exhaust that, once genuinely de-identified and aggregated so that no client or matter can reasonably be identified, falls outside Rule 1.6 and Rule 1.18: intake volume, conversion rates, cycle times, cost-to-serve, staffing ratios, vendor performance, the instrument readings of a legal business rather than the content of its matters. In raw, client-linked form, much of this stratum still relates to representations; de-identification is what moves it below the line, and it must be de-identification that holds. Fifth, public-record residue: dockets, filed briefs, verdicts, recorded outcomes. That last stratum pools freely and moats no one, and the proof is that it has been a product for years. Lex Machina has sold analytics built on exactly that corpus for more than a decade, which establishes both that the stratum is real and that a corpus anyone can assemble confers exclusivity on no one.

When this series says the below-privilege corpus, it means strata three and four, defined against Rule 1.6 and Rule 1.18, not against privilege. Privilege is a zoning law for data. The top two strata are zoned residential: occupied, valuable, and never poolable across owners. The fifth is the public park. The question that matters is what is left in between, and who is allowed to own it.

The consent wall

Stratum three looks like an escape hatch, because Rule 1.6 yields, by its own terms, to informed consent: a client may authorize disclosure of information relating to the representation. So pooling matter data into a self-improving asset is not categorically forbidden by the confidentiality rules; it is consentable in theory and, as far as the published record shows, unobtained in practice. The reason is ABA Formal Opinion 512, issued in July 2024, which requires informed client consent before a lawyer inputs information relating to a representation into a self-learning generative AI tool, and which states that "general, boiler-plate provisions to engagement letters" are not sufficient. The consent must address what client information will be disclosed, the risk that others may use it against the client, and the benefits the client gets in exchange. That is not a checkbox. It is a bespoke negotiation, per client, about a self-learning system.

Sketch, as a hypothetical, what assembling a multi-firm matter-data pool would actually require: every participating firm, times every client, times a per-client informed-consent conversation of the kind Opinion 512 describes, times a realistic refusal rate, and the refusals will not be random. The most sophisticated clients with the most valuable matters are precisely the ones most likely to say no, which punches holes in the corpus exactly where it is worth the most. We will not pretend to arithmetic we have not done, so we state the observable instead: no multi-firm, consented matter-data pool at scale exists anywhere in print, and Opinion 512's specificity requirement is the most economical explanation of why. We call this the consent wall. The matter corpus fails as a poolable asset on transaction costs, not on legality.

The one workaround the rules themselves permit, and the one the Opinion 706 committee let pass without comment, is genuine anonymization, pooled across clients, with nothing traceable back; its real authority is Rule 1.6's own comment, which treats information as unprotected only where there is no reasonable likelihood it can be linked to a client. That keeps stratum three alive, but as a thin layer of benchmarks and derivatives, not as the rich training corpus the data-moat thesis imagines.

If legal AI doesn't need legal data, the moat is the exhaust

In April 2026, Jordan Furlong published a piece on Slaw asking, in its title, "What If Legal AI Doesn't Need Legal Data?" Working from three data points, offered with his own caution against drawing broad conclusions, he suggested it "might turn out that general-purpose Gen AIs like Claude Cowork really can, with enough focused preparation and effort, match or even outperform far more expensive legal-specific Gen AIs in at least some settings," and that if so, "Legal data would still matter... but the absence of that data might no longer be disqualifying." Read as an attack on the legal data moat, even in its hedged form, the argument is strong, and we concede it in full.

Then notice what the concession does. If frontier models already contain the law, the proprietary matter corpus loses its premium, and the scarce residual input is the one thing no foundation model ships with: ground truth about how legal matters actually run. What does this matter type cost to produce, where does it stall, what does intake convert at, what should a fixed fee be, which outcomes are underwritable. That is stratum four, the operational exhaust, and it is the training set for the economics layer of legal AI, the layer where pricing, throughput, and risk get decided. Furlong's argument does not kill the moat. It relocates it downward, out of the strata that never pool and into the one that does.

One hedge belongs in the body of this argument, not in a footnote. Operational exhaust supports a premium on services economics; it does not confer a software multiple, and the services-to-software re-rating remains genuinely contested. And who captures the efficiency that exhaust-trained operations produce is a fee-clause question, which "The AI Dividend Has an Address," an earlier memo in this series, treats at length; we will not rerun it here.

The forcing function

So the compounding corpus is operational exhaust. Three kinds of entity could in principle hold it: the law firm, the software vendor, and the MSO. Two of the three are disqualified, and the disqualification is the point of this memo.

The firm is disqualified twice over. A single firm's exhaust does not compound across firms, and firms will not pool operations data with competitors; more fundamentally, in the great majority of states, the firm is the one entity outside capital is not permitted to own, so even a firm that built the asset could not sell exposure to it. The vendor is disqualified by position, which the next section walks through two famous examples to show. That leaves the structure everyone treats as plumbing. Rule 5.4's separation requirement, the rule the entire genre describes as the tax on legal-MSO investing, is the mechanism that deposits the business of law, its systems, its operations, and the exhaust they throw off, by contract, into the one entity investors are allowed to own. Sidley, in its March 2026 survey of private equity in US law firms, calls the management services agreement "the fulcrum of the MSO structure." "The MSA Is the Cap Table," the opening memo of this series, read that instrument as a bond indenture; this memo adds that it is also a deed. The same instrument that defines the fee defines who owns the systems and the data they generate.

A fair objection: most MSOs today serve one affiliated practice, and one practice's exhaust is not yet a pool. True, and worth stating plainly: in the realistic starting state the asset is not the pool but the contractual option on the pool, which no firm and no vendor can hold at any scale. The moat is the zoning entitlement before it is the building.

EvenUp and Clio: the boundary survey

Two companies look like counterexamples, and they are better read as the survey stakes that mark the boundary. Plot legal data businesses on three axes: depth, exclusivity, and the instrument that holds the data.

EvenUp, the personal-injury AI company, sits in stratum three: matter data that is deep and consent-based by design, gathered through its customer relationships, and confined to a single vertical. It shows that the consent wall can be climbed locally, one vertical and one customer base at a time, at a cost that is the business itself. Clio sits in stratum four, but on the wrong side of the other two axes: its telemetry is vast and shallow, the view from a software product's own surface rather than from inside the operations it serves, it is non-exclusive infrastructure shared by every firm on the platform, and Clio publishes the aggregate away every year in its Legal Trends Report. A SaaS terms of service is a license to observe. A management services agreement is an instrument of ownership over the operations themselves.

Deep but consented and narrow; wide but shallow and shared. The quadrant those two corners leave open, deep, exclusive, and owned by contract, is the one only the MSO can occupy, because only the MSO runs the operations, keeps the exhaust captive, and holds it under an ownership instrument rather than a license.

The steelman, in full strength

The strongest objection deserves printing whole: you have rigorously proven that the MSO owns the only poolable legal corpus, and it is the worthless one. Scheduling, billing, intake, and workflow telemetry is commodity operations data; Clio holds a version of it at a scale no MSO will ever match; and none of it improves legal work product by a single sentence. You have built an airtight title to an empty lot.

Three answers. First, the Furlong judo runs straight through this objection: if content knowledge is being commoditized by frontier models, the value in legal AI migrates to the economics layer, pricing, fixed-fee design, throughput, the underwriting of outcomes, and operational exhaust is precisely, and exclusively, that layer's training set. Second, depth and exclusivity: telemetry observed from a product surface and given away in a public report is not the same asset as exhaust from operations the holder actually runs, tied to a single accountable P&L. Third, a concession this memo makes without flinching: this corpus will not train a legal-reasoning model, and we never claim it will. It trains the pricing and operations engine, which is the business the MSO is actually in, and the basis on which, per the lender practices Sidley's survey describes, it is already underwritten. The empty lot is empty only if you intended to build a cathedral on it. The MSO is building a factory.

Right address, wrong cargo

The people who saw this first published it as a warning. Lund and Talley, writing in Bloomberg Law in November 2025 on private equity and Big Law tie-ups, named the feared cargo with unusual precision: once the structure exists, "the MSO could own, operate, and continuously train a private LLM," an investor-owned company quietly compounding a model on the firm's work. Breydo's forthcoming Yale Law Journal Forum essay supplies the governance frame, summarized in one line by the Columbia Law School Blue Sky summary: "No state bar has issued model governance standards for law firm MSOs." Law.com ran the polemic version under a title that does its own arguing: "The MSO Trap: Why Private Equity's Legal Workaround Hollows Out Law Firms."

Take the concern seriously, because it is real: value is accreting in an investor-owned entity outside the firm, faster than anyone has written rules for it. The warnings have the address exactly right. What they have wrong is the cargo. Lund and Talley's private LLM, to the extent it would train on matter content, dies on the consent wall, and it dies both as a fear and as a moat; Rule 1.6 and Opinion 512 make that corpus unpoolable for the MSO for the same reasons they make it unpoolable for everyone else. What actually accretes at that address is the pricing and operations engine built on the exhaust stratum. Right address, wrong cargo. That correction cuts in both directions: the governance problem is smaller than the warnings fear, and the investable asset is cleaner than they imagine, because every warned-about dynamic converts into a design requirement for a well-built MSO. A data-flow schedule in the MSA drawn to the Opinion 706 line. Anonymization that would survive an audit, not a press release. Nothing relating to a representation crossing the boundary without consent of the kind Opinion 512 actually requires. Who enforces that line in practice, and why the malpractice carrier got there before any bar did, is the subject of "Carriers Drew the Line," this series' memo on the carrier as regulator, and we leave it there.

The prediction that missed by one vehicle

None of this is a new forecast. In 2020, Armour and Sako argued in the Journal of Professions and Organization that the economics of legal AI favor vehicles other than the traditional law firm, and they named the alternative legal services provider as the vehicle. The driver was right. The vehicle was wrong, and the miss is instructive, because Rule 5.4 picked the winner. An ALSP competes with law firms for legal work, which places it inside the profession's regulatory perimeter and inside the same confidentiality zoning this memo has been mapping. The MSO sits beneath firms rather than instead of them, outside the perimeter, which makes it the only non-firm vehicle the data asset is legally allowed to accrete in. Armour and Sako could not have known the two facts that completed the argument: generative AI made the pooling constraint confidentiality-grade, through Opinion 512, and the American deal tape chose the MSO, most visibly in the Rafi Law Group transaction announced in April 2026, roughly $125 million into the firm's MSO per Bloomberg Law, at a valuation the firm's own announcement put near $450 million. The mechanism that overrode their forecast is the mechanism this memo names.

The Arizona control group

There is a natural experiment running that isolates the mechanism. Rule 5.4's nonlawyer-ownership bar holds in 48 states, with the Arizona ABS regime and the Utah sandbox as the carve-outs, plus the District of Columbia's narrower allowance for minority nonlawyer partners. In Arizona, where the rule is repealed, the prediction of this memo inverts on cue: the data asset and the practice reunify inside one ownable entity. As of January 2026, 151 alternative business structures were licensed by the Arizona Supreme Court, by a count published through the Arizona State Law Journal; estimates in circulation put private-equity or hedge-fund backing at roughly forty to fifty percent of them, a figure best treated as directional rather than audited. KPMG Law US, the first Big Four entrant licensed to practice law in the United States, came through that regime in February 2025. Where the wall is down, the vendor can simply be the firm, and the moat moves back inside it. Which is exactly the point: everywhere the wall stands, the moat's address is not competitively determined. It is regulatorily determined, and it is the MSO.

The new diligence question

"Show me your data moat" is the wrong question in legal AI, because it assumes the moat's location is a choice. The right question is: which stratum does your corpus live in, and what instrument owns it. That question is answerable from the MSA and a data-flow diagram, not from a pitch deck, which is fitting, since the investors who underwrite these structures already read the MSA before they read anything else.

Which stratum does your corpus live in, and what instrument owns it? · Strata defined against Rule 1.6 confidentiality, which is broader than privilege.

Place the familiar names on the map and the grid reads itself. Harvey's ambition lives in strata (i) and (ii), the strata that never pool, so its moat must be product, not corpus. EvenUp lives in stratum (iii), deep but consent-based and single-vertical. Clio lives in stratum (iv), non-exclusive and published away. Lex Machina lives in stratum (v), pooled, public, and owned by no one. An MSO lives in stratum (iv), captive, and owned by contract. The bottom-right of that grid is the moat, and the reader who finds it has answered the diligence question before asking it.

The zoning metaphor finishes itself. You do not buy the land the city will never let you build on, however beautiful the renderings. You buy the parcel zoned for compounding. In legal AI there is exactly one such parcel, the rules drew its boundary in writing, and the same rules that drew it dictate its owner. The moat is below grade, and it has a mandatory address.

This memo is published by Jopese, a legal management services organization operated by HIRO PARTNERS LLC, a Texas limited liability company. It is offered for educational and analytical purposes only. It is not legal, tax, or investment advice, and it is not an offer to sell or a solicitation of an offer to buy any security or service. Jopese is not a law firm and does not provide legal advice or legal services; legal services are delivered by an independent law firm under a separate engagement in which Jopese does not participate. References to specific funds, firms, companies, transactions, ethics opinions, and regulatory developments are drawn from public sources and are provided as market commentary, not as an endorsement, a recommendation, or a representation of any relationship.