A written AI use policy helps a firm translate its confidentiality, competence, and supervision duties into consistent practice. It should identify approved tools, permitted uses, review responsibilities, and when client disclosure or consent is needed.
Why a Policy Matters
Clear guidelines help attorneys and staff make consistent decisions about AI use. They address risks such as confidentiality breaches, inaccurate citations, and reliance on unverified output.
ABA Formal Opinion 512, issued July 29, 2024, addresses competence, confidentiality, communication, and supervision when lawyers use generative AI. Apply the professional rules and court requirements that govern your practice. A firm policy should address:
- Competence: Understand the capabilities and limits of the tools used for client work.
- Confidentiality: Evaluate what information a tool receives, who can access it, and how the provider retains or uses it.
- Court requirements: Check the rules and standing orders applicable to each matter, including any AI disclosure requirements.
Key Components of an AI/ML Use Policy
Scope and Definitions
Define what counts as “AI” within the firm. This includes large language models, document review platforms with predictive coding, legal research tools with AI features, and any automated drafting or analysis tools.
Ethical Guidelines
Specify which tasks AI may assist with and which require purely human judgment. Establish mandatory human review for any AI-generated content before it reaches a client or court. Require verification of all AI-generated legal citations.
Data Protection
Identify which client data may be processed by AI tools and under what conditions. Require enterprise agreements with AI vendors that include data processing agreements. Prohibit use of consumer-grade AI tools for client matters unless specifically approved.
Client Consent and Disclosure
Assess the tool, proposed data use, and applicable rules to determine whether disclosure or informed consent is required. When consent is required, explain the specific risks and benefits. A general engagement-letter clause may be insufficient. Establish a process for checking and following applicable court disclosure orders.
Training Requirements
Mandate baseline AI literacy training for all attorneys. Require tool-specific training before use on client matters. Establish a process for evaluating new AI tools before firm-wide adoption.
Essential Supporting Documents
Beyond the core policy, firms should develop:
- Approved tool list: Vetted AI tools with documented security assessments
- Incident response plan: What to do when AI produces errors or data breaches occur
- Client communication templates: Standard language for engagement letters and disclosures
- Audit procedures: How the firm monitors AI use and compliance
Leadership Considerations
Designate a responsible partner or committee to maintain the policy. This person or group should track regulatory developments, evaluate new tools, and update the policy as the landscape evolves.
Managing Risk
Risks of unmanaged AI adoption are fabricated citations, confidentiality breaches, and over-reliance on unverified output. A good policy addresses all three with specific, enforceable requirements rather than vague aspirational language.
At Legal1Up, we agree on source checks for litigation-support assignments before work begins. No client data enters consumer AI tools. We do not use client documents to train AI models. We can discuss our AI use framework with firms developing their own policies.
Contact us to discuss AI governance for your firm, or read about our citation, quotation, and record checks.