When my partners and I sold our company four years ago, we hired a high-priced Silicon Valley legal team. The structure of the deal was relatively simple. What we were paying for was the text: hundreds of pages of agreements and schedules, backed by nearly a year of due diligence, that we hoped we'd never have to open again.
This wan't adversarial: everyone got along and wanted the deal to work. The buyer was easy to work with, and the two legal teams were friendly enough that I sometimes wondered whose side anyone was on. Even so, the fine points of wording drove all of us up the wall, and we'd lose days to a single phrase before anyone would let it go. Exhausting. But we slept.
I've been wondering lately what exactly we bought. I run contracts through AI nearly every week now, some through a tool trained specifically on law and some through a version of Claude I've trained myself, and I've been impressed. None of those contracts carries the weight of selling a company, and for anything structurally or strategically tricky I'd still call a human. But would I write that same check today? I'm not sure.
Software's been getting this treatment all year. In May, Anthropic reported that partners using its restricted Mythos Preview model had found more than 10,000 high- or critical-severity vulnerabilities in a month, and Mozilla alone fixed 271 in a single Firefox release. I was more struck by Anthropic's admission that the bottleneck has moved from finding bugs to verifying and patching them.
What I hadn't considered was the law. Statutes and regulations are code too, written in words instead of C, and nobody's ever pointed a scanner at them. Felix Ringe just did.
Their target was a quirk of the German constitution. Article 80 requires every executive regulation to cite the statute that authorizes it, and courts treat any provision outside the cited authority as void. Using LLMs, Ringe's team went looking for regulations that cited the wrong thing. They found what they describe as a substantial number nobody had recorded before, and published only the ones they think couldn't cause serious harm.
The published bugs seem small, but it makes you wonder what the larger are. A July 2026 amendment made an occupational-disease advisory council's working documents confidential, citing subsection (1) of the governing statute. The authority actually sits in subsection (1a). On that slip, a journalist trying to see what an employers' group told the council about night work and cancer could argue the confidentiality rule never took effect. The other examples follow the same pattern. One is a 2015 amendment that added Mali to Germany's airport transit visa list under the wrong subsections. The other is a 2025 rule denying overtime compensation to soldiers at a NATO command, which cited the wrong power.
Our Silicon Valley legal team would've caught every one of these. That's what the money bought: someone confirming that every reference pointed where it claimed to, across hundreds of pages and dozens of revisions. A ministry drafting on deadline gets nothing like that review. Ringe argues courts have quietly absorbed defects like these for decades, largely because almost nobody found them. Cheap legal reasoning changes that math, and his proposed fix sounds a lot like Glasswing: legislatures harden their drafting by running the same AI before anyone else does.
Who gets to look
Notice who benefits in Ringe's examples. Every one of them is an individual up against the state. Loophole hunting has historically belonged to whoever could afford the most expensive lawyers, which usually meant large companies and wealthy people working the tax code. The search that once took weeks for a firm like we hired is now within reach of anyone with an AI subscription and some patience.
Discovery is only half of it, though. Finding a void provision is the cheap part. Getting a court to agree still takes a lawyer and the nerve to sue a federal ministry, and Ringe is clear that none of these exploits have been tested. Software works the same way: finding a flaw in a website keeps getting easier, while exploiting it at scale still takes hardware. Anthropic says a serious bug found by Mythos takes about two weeks to patch on average. I'd love to know the equivalent figure for a German regulation. I suspect it's measured in years.
Turning the scanner inward
Every company I've been part of has had its own body of law: an operating agreement, policies, annual plans, strategy documents, work procedures. Different people wrote them in different years, and almost nobody reads them together. New policies and instructions get layered on top without anyone checking whether they contradict something adopted three years earlier, or whether the procedure they cite still exists.
That's Ringe's exercise pointed at your own file cabinet. Give an AI the company's governing documents. Then, every time someone drafts a new policy or instruction, have it check two things: whether the draft conflicts with anything already in force, and whether every reference points to something real, or is there at all. The second check catches the subsection (1) versus (1a) problem. The first catches the costlier one: two documents that each make sense alone and can't both be followed. And unlike the German cases, this one needs no court, and can probably be fixed very quickly.
So, would I write that check again? For the consistency work, the hours spent confirming that every section said what the other sections assumed it said, probably not. I've watched AI do that well enough, week after week. For judgment about how a deal should be built, I'd still want people who've done hundreds of them, at least for now. The sleep is harder to price. Part of it came from knowing the text was clean, and part came from knowing exactly whom to call if it wasn't.
If you run a business, how much of your legal bill pays for reading every word, and how much pays for someone who knows what the words should say? And if you draft regulations, assume someone with a laptop is now reading yours more carefully than you did.