AI playbook for Legal, Protection, IT and Procurement: what to delegate, what to keep

Six playbooks in, and this one is the odd entry in the series: not one department but four, bundled together because none of Legal, Protection, IT, or Procurement is usually large enough on its own to warrant a standalone chapter, and because all four share the same underlying shape despite covering completely different ground. A wide base of routine, well-defined work sits underneath a narrow set of decisions that carry legal, safeguarding, security, or financial consequence, and no tool can absorb that narrow slice regardless of which of the four functions it sits in.

This piece sorts real work across all four functions the same way as the last five: what is genuinely worth delegating, and what never should be.

What these four functions actually spend their time on

Legal handles contract review, compliance filings, and policy drafting. Protection handles the intake, assessment, and referral of anyone reporting harm. IT handles systems administration, access provisioning, and security monitoring. Procurement handles vendor sourcing, quote comparison, and purchase approval. The domains are unrelated, but the pattern repeats: most of the volume is matching, drafting, and comparison against criteria that already exist, and a small number of decisions concentrate all of the real consequence.

What's worth delegating

• Drafting first-pass redlines on a routine contract against an approved clause library. Matching known clauses to known risk positions is drafting work, and a lawyer still reviews everything before it is signed.
• Triaging routine IT helpdesk tickets against a known issue log before human escalation. Recognising a password reset request or a documented printer fault is pattern-matching, not judgement.
• Comparing vendor quotes against fixed procurement criteria before sign-off. Checking quotes against a published scoring rubric is arithmetic, and a human still approves the winning bid.
• Summarising security log alerts into a daily digest for a human analyst to review. Filtering flagged events into a reviewable list is aggregation, not a judgement about which alert is a genuine incident.

What never gets delegated

• Any decision to receive, assess, or refer a safeguarding disclosure. We have written before about the four-class data table: this is exactly the class of case that never touches a general-purpose tool, and the judgement about what a disclosure means has to sit with someone trained and accountable for it.
• Signing a contract or agreeing its final legal terms. A lawyer's sign-off carries professional and legal accountability that cannot transfer to a tool, whatever drafted the redline underneath it.
• Granting or revoking system access to sensitive data. This is a security decision with a named person accountable if it goes wrong, not a routine ticket to be cleared quickly.
• Selecting the winning vendor on a procurement decision above a material threshold. Once real money and a real relationship are at stake, the choice needs a human who can answer for a conflict-of-interest question later.

A tool can sort the routine work. It cannot carry the safeguarding, legal, security, or procurement judgement underneath it.

The trade-off in bundling four functions into one playbook

Treating Legal, Protection, IT, and Procurement as one article risks flattening how differently serious their worst-case failures actually are: a misconfigured access grant and a mishandled safeguarding disclosure are not equivalent, and putting them side by side here is a simplification for the sake of one readable playbook, not a claim that they carry equal weight. The honest answer is that all four genuinely share the same structural principle even though their consequences differ wildly: the matching and comparison work underneath each function is safe to delegate, and the moment a decision requires professional accountability, security clearance, a person's safety, or a material financial commitment, it stops being delegable regardless of which function it sits in.

The practical takeaway

Delegate the matching, triage, and comparison work that touches no legal, security, safeguarding, or monetary decision directly; never delegate a safeguarding disclosure, a contract's legal sign-off, a system-access grant, or a material vendor selection.

No external statistic cited; this article presents an internal department playbook rather than third-party evidence.