How Gilbert + Tobin manages and expands its AI capabilities through OpenAI

If you're trying to roll out AI tools across a professional services firm, this case study is for you. Gilbert + Tobin, a major Australian law firm, has taken a deliberate, top-down approach to adopting ChatGPT Enterprise and Codex. In this article, we'll walk through the three pillars that make their rollout work — CEO-led commitment, structured governance, and clear human accountability — and what other organizations can realistically learn from it.

Why Leadership From the Top Matters

Many AI initiatives stall because staff see them as a side project owned by the IT department. Gilbert + Tobin took a different path: the firm's CEO has been a visible, active champion of AI adoption. When the person at the top personally endorses and uses the tools, it signals that working with AI is part of the firm's core strategy, not an optional experiment.

This kind of executive sponsorship does two things. First, it unlocks resources — budgets, training time, and attention from practice group leaders. Second, it removes the cultural friction that often surrounds AI in professional settings, where lawyers may worry that using ChatGPT could be seen as cutting corners or taking shortcuts. A CEO who openly supports careful AI use reframes the conversation: the shortcut is refusing to use good tools, not using them.

Governance That Goes Beyond a Policy Document

Of course, enthusiasm without guardrails is dangerous, especially in a law firm where confidentiality and professional obligations are paramount. Gilbert + Tobin pairs its leadership commitment with rigorous governance. Rather than treating AI policy as a one-time memo, the firm has built ongoing structures to decide where tools can be used, how client data is protected, and which use cases require extra scrutiny.

ChatGPT Enterprise itself supports this kind of approach, since enterprise deployments are designed with data protection controls that distinguish them from consumer accounts. But the tool alone isn't the answer — the firm's governance framework determines what is appropriate, and that framework reflects legal-industry realities like client confidentiality, privilege, and regulatory duties.

The takeaway is that governance works best when it's practical. Instead of a blanket ban or a blanket green light, Gilbert + Tobin treats adoption as a series of managed decisions: this tool, for this task, under these conditions.

Keeping Humans Accountable for the Output

The third pillar is the one that often gets overlooked: accountability stays with people. Lawyers using ChatGPT Enterprise or Codex remain responsible for verifying and owning whatever they produce. AI can draft, summarize, and accelerate — but a human professional signs off on the work.

This principle matters for two reasons. Practically, large language models can make mistakes or produce plausible-sounding but incorrect content, so review isn't optional. Culturally, keeping humans accountable preserves the professional judgment that clients are actually paying for. The firm's model treats AI as a capability amplifier for skilled people, not as a replacement for them.

The same logic applies to Codex, OpenAI's coding-focused tool. Developers and technically minded staff can use it to speed up work, but the output still passes through human review before it becomes part of anything real.

What Other Firms Can Take From This

You don't need to be a large law firm to borrow the Gilbert + Tobin playbook. The three elements translate well:

• Visible executive sponsorship. Leaders should use the tools themselves and talk openly about how they fit the organization's strategy.
• Living governance. Build a decision-making process for AI use that's specific enough to be useful and flexible enough to evolve as tools change.
• Clear ownership of output. Make it explicit that whoever produces work with AI assistance is still fully responsible for its accuracy.

Organizations that skip one of these pillars tend to hit familiar walls: employees quietly avoid the tools because leadership is lukewarm, or adoption runs ahead of safeguards and creates risk, or nobody is sure who signs off on AI-assisted work. Gilbert + Tobin's approach is notable precisely because all three pillars support each other — leadership makes governance credible, and governance makes human accountability enforceable.

It's also worth being realistic: the source material describes the firm's approach at a high level, and specific details about results, usage rates, or internal metrics aren't publicly spelled out. Firms considering a similar path should expect to adapt the model to their own size, regulatory environment, and client expectations rather than copy it wholesale.

Who Should Follow This Model / Who Should Wait

Follow it if: you lead a professional services organization where trust, confidentiality, and quality of output are the product. If your teams handle sensitive client information and your industry has real regulatory exposure, the combination of top-level commitment, firm governance, and human accountability is the safest template for scaling tools like ChatGPT Enterprise and Codex.

Wait or adapt if: you're a very small team with minimal compliance obligations, a full governance apparatus may be heavier than you need — though the principles of leadership buy-in and human review still apply. And if your leadership isn't genuinely committed, rolling out enterprise AI will likely stall no matter how good the tooling is; fix that first before investing in licenses and training.