The legal data services sector has moved decisively from exploration to execution, but its rush to scale AI-first capabilities is colliding with persistent gaps in financial discipline and cybersecurity prioritisation, according to industry and European agency analyses released in 2025. According to the 2H 2025 eDiscovery Business Confidence Survey by ComplexDiscovery OÜ and EDRM, a majority of surveyed leaders now rate business conditions as "good" and 64.06% report they are actively integrating and deploying Large Language Models (LLMs). The survey, conducted between 30 September and 15 November 2025, attributes adoption primarily to "improved service and product delivery" rather than immediate cost savings. [1]

Yet that optimism carries a material caveat: profitability and cash-flow visibility are under pressure. The ComplexDiscovery survey found a divergence between revenue expectations and profit forecasts , more respondents expect flat or modest revenue lifts while a larger share forecast flat or falling profits , and a worrying proportion of leaders admitted they do not know critical operational metrics such as Days Sales Outstanding (DSO). ComplexDiscovery warns this opacity risks a “liquidity crunch” as firms front-load investment in expensive AI infrastructure without matching billing cadence or revised pricing models. [1]

Those operational and financial tensions are mirrored by an industry-wide shift in cybersecurity investment priorities documented by the European Union Agency for Cybersecurity (ENISA). ENISA's 2025 NIS Investments report shows organisations increasingly prioritise technology and services over personnel, a movement driven by persistent talent shortages and the compliance demands of NIS2. The agency found 76% of organisations report difficulties hiring cybersecurity professionals and 71% struggle to retain them, pushing budgets toward tooling, managed services and external expertise. [2][3]

The juxtaposition of these findings exposes a dual risk for eDiscovery vendors and their clients: accelerated AI deployment without equivalent investment in defensive controls. ComplexDiscovery's results highlight accuracy and hallucination risk as the single largest barrier to LLM success, while ENISA cautions that shifting spend away from people can exacerbate operational fragility if governance, skills development and supplier security are not reinforced. Taken together, the reports argue that technology gains will be ephemeral unless paired with stronger governance, quality controls and workforce strategies. [1][2]

ENISA further emphasises that NIS2 compliance is a primary driver of recent investment increases but that implementation remains challenging for small and medium enterprises. The agency's Advisory Group and Skills Panel outputs recommend an EU-wide Cybersecurity Skills Academy, sector-specific capacity building and a horizontal framework for ICT supply-chain security to address those shortfalls. Those recommendations echo the needs identified in the eDiscovery survey for elevated reviewer expertise and defensible quality-control workflows around AI outputs. [5][6][1]

The structural market context amplifies the stakes. ComplexDiscovery projects that AI-driven efficiencies are already shifting task and spending mixes across eDiscovery , with review's share of spend declining as collection and processing grow , a dynamic that will require new pricing approaches and upstream information governance interventions to control downstream costs. ENISA's NIS360 work also stresses the importance of cross-sector collaboration and community-building to raise cyber hygiene and resilience, framing governance and workforce development as complements to technical investment. [1][4]

For commercial leaders the practical prescription is straightforward: reconcile aggressive AI adoption with sharper financial controls and explicit security input at procurement and deployment stages. ComplexDiscovery recommends real-time dashboards linking technical milestones to invoicing to close DSO blind spots; ENISA urges strategic prioritisation of workforce development and supplier risk management to prevent technology-led expansion from widening an organisation's attack surface. Both sets of authors argue that the winners will be those who treat governance and people as strategic investments rather than residual line items. [1][2][5]

Finally, the geographic and regulatory environments matter. The ComplexDiscovery survey is heavily U.S.-centric (90.63% of respondents operate primarily in North America), while ENISA's findings and recommendations are EU-focused and explicitly tied to NIS2 enforcement and EU-wide workforce initiatives. Firms operating across jurisdictions must therefore navigate differing compliance drivers and workforce realities: global AI scale‑up presents opportunity, but regulatory complexity and regional skills shortages require tailored governance and investment strategies. [1][2]

##Reference Map:

  • [1] (ComplexDiscovery OÜ and EDRM - 2H 2025 eDiscovery Business Confidence Survey) - Paragraph 1, Paragraph 2, Paragraph 4, Paragraph 6, Paragraph 7, Paragraph 8, Paragraph 9
  • [2] (ENISA - NIS Investments 2025) - Paragraph 3, Paragraph 4, Paragraph 7, Paragraph 8, Paragraph 9
  • [3] (ENISA - What's driving cybersecurity investments) - Paragraph 3
  • [4] (ENISA - NIS360 2024 report) - Paragraph 6
  • [5] (ENISA Advisory Group opinion paper on NIS2 post-implementation) - Paragraph 5, Paragraph 7
  • [6] (ENISA Cybersecurity Skills Panel - Expert Perspectives) - Paragraph 5

Source: Noah Wire Services