Why Should Legal, Security, Privacy, and Compliance Operate as One Team?

Because siloed functions produce siloed answers. At NerdWallet, where the product is financial guidance and consumer trust carries the business model, a security incident is a trust problem, and a privacy gap in a product feature is simultaneously a legal, compliance, and security problem.

Lysonge merged the four functions into one Trust and Safety team, so the company hears one answer from one team.

Lysonge explains the structure with an analogy:

"I equate the legal and security function to being like air traffic control, the command center of the company. We're responsible for making sure crashes are avoided, making sure ideas, business strategies, and initiatives are able to take off undisrupted, and ultimately land those ideas squarely where they need to be landed in order to deliver on whatever the value promise is to the customer."

In most organizations, security sits in its own silo and works primarily with engineering. Legal sits in another, with compliance and privacy carved into their own swim lanes.

Lysonge saw the legal side of the house as the guardians of the trust NerdWallet built with consumers over two decades, and the security side as the safety keeping every customer interaction secure. He put both under one name: Trust and Safety.

The scale explains the stakes. NerdWallet serves what Lysonge describes as 25 million-plus customers a month, and the business has evolved from do-it-yourself financial content to comparison marketplaces to concierge offerings that route a customer to a mortgage expert or an investment advisor.

Every one of those interactions runs on the trust his team protects.

How Can Legal Say Yes More Often? Make the Yes Durable

Lysonge's framework for risk-tolerant legal advice comes down to one test. The yes has to be durable. A durable yes is grounded in the company's first principles, stands up to board scrutiny, and comes with rigor about what can and cannot be undone.

The safe move for a lawyer is to say no. Lysonge would rather get to a yes the business can build on.

"I've always looked at it through the perspective of you need to be in a position to always say yes, but the yes has to be durable. It can't be something that's a flash in the pan, that doesn't stand up to scrutiny. What comes with that is making sure that every time a decision is made, there's a certain amount of rigor and discipline around it."

Lysonge is candid that this calibration sets him apart. He describes himself as more risk tolerant than most CLOs he has interacted with, because he comes to conversations business centric first, a perspective built on operator roles earlier in his career.

Companies do not grow without taking risk, and a lawyer who wants to work inside a growth company has to be someone who enables it.

The discipline shows up hardest on irreversible decisions. Ziniti connects the idea to Jeff Bezos's one-way door framing. Some doors you can walk back through, and some you cannot.

Lysonge has his own phrase for the ones you cannot.

"Once something's in the decision box, certain decisions can't be remade. So it's the eyes wide open moment, guys. We're going to do this, but just know that this is a one-way ticket to whatever the destination is, and we all have to live with it... As long as everyone's locking arms and doing that together with their eyes wide open, I don't have any issues with taking risks."

The executive team makes the representation to the board as a group: we believe this decision is strategically aligned, we understand the consequences cannot be rewritten, and we are choosing it anyway. That shared ownership is what makes the yes durable.

How Do You Govern AI When Anyone in the Company Can Ship an Idea?

Match legal's velocity to the builders' velocity. NerdWallet runs a test-heavy culture, and Lysonge points out that AI has collapsed the distance between idea and shipped experience. Any of the company's 600-plus employees can vibe code a product concept into something customer-ready within minutes.

A governance model built for sequential human review cannot keep up with that explosion of ideation.

"AI has enhanced the velocity in which people can ideate, create, and ship ideas. Legal has to be able to evaluate, give perspective, and ultimately advise at the same velocity. There is absolutely no way to do that without leveraging some form of AI tooling, or in many senses, agentic solutions."

His operating model splits the work in two. Heightened, judgment-based questions go to a human lawyer, and routine, assembly-line work goes to an agent, with different SLAs and a different tolerance for error correction.

The business gets a clear explanation of which lane it is in. Lysonge asked the company for grace while his team figures that out in real time, and he is open that the answers change as fast as the questions do.

It comes down to presence. Legal teams that stand outside the process, handing over a risk matrix and the parade of horribles, get consulted after the fact.

Lysonge coaches his team, on both the legal and security sides, to be in the room saying: I see where we are trying to go, I am all in, but have we considered this? Be part of the solution, and the business brings you in earlier.

That is how a legal function stops being a bottleneck and starts operating, in his words, as the company's operating system.

How Should a Legal Team Pick Its First AI Use Cases?

Start where failure is not catastrophic. Lysonge's team began with routine, minimal-risk work: vendor agreements below a spend threshold and NDAs, where years of guardrails already exist.

Then a seasoned legal operations professional inventoried every workstream flowing through the department, flagged the routine and repetitive ones, and turned the list into an automation roadmap. NerdWallet's team is roughly three quarters of the way through that list.

"You start with the things that are routine and mundane and low and minimal risk, and you test. I don't think lawyers believe in testing a lot of things. We want everything to be perfect. That's part of our problem: we are slaves to perfection."

His accuracy standard breaks the perfection habit. Lysonge is comfortable deploying an AI solution that performs at 70 to 75%, because, as he tells Ziniti, most of the time the advice a practicing lawyer gives under real-world constraints is about 70 to 75% accurate anyway.

The lawyers who accept that, give themselves grace, and stay agile enough to correct course are the ones who ship. Teams comparing platforms for that first low-risk workflow can start with GC AI's guide to the best legal AI tools for in-house counsel, which ranks the options by fit for exactly this kind of rollout.

The payoff he cites is capacity. Clearing the routine list freed his legal professionals to bring judgment and expertise to the problems the business needs solved by a human. It is the same move lean in-house teams use to scale with AI without adding headcount.

What Has Been the Most Successful Part of NerdWallet's AI Rollout?

An agentic triage layer for the questions that never stop. Lysonge estimates he personally gets around 30 Slack messages a day from colleagues asking who to go to, whether something is approved, and where to route a request, and his 17-person legal team and 17-person security team each field 20 or 30 more of their own.

His team is in the final stages of deploying a Slack ask-me-anything agent that absorbs that triage.

"Small for some, huge for E... By solving for that and having an agentic solution for that, that frees up capacity for the entire team, that then gives the team the ability to really focus on much more substantive topics and render even more substantive advice that moves the business forward."

Multiply 30 daily interruptions across 34 people and the reclaimed capacity stops looking small. It is the same categorize-then-automate logic as the contract work, applied to the department's front door.

For teams building the skills to run this kind of rollout, GC AI runs free, CLE-eligible legal AI classes on prompting and workflow design.

Why Does AI Give In-House Lawyers a Permanent Seat at the Table?

Because decision discipline is the work AI cannot do alone. Lysonge's closing argument to his peers is simple. Do not fear the shift AI is driving in the practice of law.

The lawyer who brings rigor to strategic conversations, evaluates the gaps, carries the institutional memory of where the company has missed before, and facilitates the postmortems is the person every AI-accelerated business needs in the room.

"For those that have been practitioners, this is a doorway for what could be infinite job security, from my perspective... Because of the nature of AI, it gives us an automatic seat at the table, really in perpetuity, if we don't mess it up."

For so long, in-house lawyers have asked for a seat at the table. Lysonge's point is that AI hands it over, permanently, to the lawyers who show up as the voice of reason and discipline in the room.

He describes himself as a glass-half-full person, and he thinks the profession has every reason to be.

Recommended Reading

• AI in Legal Operations: how in-house teams inventory routine workstreams and route them to agents, the same categorize-then-automate approach Lysonge describes.

• Why Judgment Is the New Superpower for In-House Lawyers in the Age of AI: the case for decision discipline as the work AI cannot do alone.

• Not Admin Anymore: How Marvell's Two-Person Legal Team Cut Contract Time by 73%: a small, AI-enabled in-house team clearing routine work to focus on judgment.