Lawyers and staff are already using AI tools to summarize documents, draft letters and research questions. Some firms have approved tools and clear rules. Many have neither, and the tools are being used anyway.
The technology is useful. The risk is what goes into it. Client information typed into the wrong tool may be stored, reviewed or used to improve the product, and that runs straight into a lawyer’s duty of confidentiality.
This is a general overview, not legal or ethics advice. Rules vary by state, so check with your state bar.
The short version
- The ABA addressed generative AI directly in Formal Opinion 512, issued July 29, 2024.
- Know what a tool does with client information before anyone uses it for client work.
- Everything AI produces has to be checked by a lawyer.
- A short written firm policy and an approved tool do more than a ban.
What the ABA opinion says
Formal Opinion 512 applies the existing Model Rules to generative AI. In plain terms:
- Competence. Lawyers need a reasonable understanding of what a tool can and cannot do, and its output must be independently verified.
- Confidentiality. Before entering client information, a lawyer has to weigh the risk that it will be disclosed or accessed by others. For tools that learn from what users put in, the opinion says the client’s informed consent is needed first, and boilerplate language in an engagement letter is not enough.
- Communication. There are situations where clients should be told that AI is being used on their matter.
- Candor. Lawyers are responsible for what they file. Courts have sanctioned lawyers for briefs that cited cases an AI tool made up.
- Supervision. Firm leaders should set clear policies and train lawyers and staff.
- Fees. Time saved by AI should be reflected in what the client is charged.
Your own state may have issued its own guidance, and some courts have their own disclosure rules.
Six questions to settle before using a tool for client work
- Does the tool keep what we type or upload, and for how long?
- Is our data used to train or improve the product? Look for a written commitment that it is not, or a setting that turns it off.
- Who at the vendor can see it? Ask about employee access and whether it is logged.
- Where is it stored, and is it encrypted?
- Can we control who in the firm uses it? Work accounts with multi-factor authentication, not personal sign-ups.
- What happens to our data if we cancel?
Free consumer versions of AI tools often fail several of these. Business versions are more likely to pass, but read the terms instead of assuming.
A firm policy that fits on one page
- A list of approved tools. Everything else is off limits for client information.
- No client names, facts or documents in unapproved tools.
- A lawyer reviews and takes responsibility for anything AI helped produce.
- Every citation is checked against the actual source.
- One person approves new tools, and asking is easy.
- Mistakes get reported the same day, without blame.
The IT side
A policy works better with tools behind it. Your IT team can limit which apps and browser extensions are installed on firm computers, require multi-factor authentication on approved tools, and keep AI features inside the systems you already control. That is part of the cybersecurity and managed IT work we do for law firms.
Want help choosing and locking down AI tools?
We can review the tools your firm is considering and set up the controls behind your policy.
Common questions
Can lawyers use AI tools at all?
Yes. The ABA opinion does not prohibit them. It says the existing duties of competence, confidentiality, communication, candor, supervision and reasonable fees apply to how they are used.
Is it safe to paste client information into a public chatbot?
Treat it as unsafe unless you have confirmed how the tool stores and uses what you enter. Many free tools keep inputs and may use them to improve the product.
Who is responsible if AI gets something wrong?
The lawyer. AI output is a draft, and the lawyer who relies on it is responsible for checking it.
