Legal risk assessment