Ethics and regulation in legal AI graphic with icons of scales, AI brain, and checklist.
Law firms using AI need clear rules for what information may enter a tool, how its output is checked, and who remains accountable for the work. A useful policy connects those decisions to the firm’s applicable professional obligations and the requirements of each matter.
Start with one approved use case and a named reviewer. Technology features can support the process, but they do not replace a lawyer’s judgment or establish compliance on their own.
Understand the guidance that applies to your work
The ABA’s July 2024 guidance on Formal Opinion 512 identifies competence, confidentiality, communication, and reasonable fees as central considerations in generative AI use. It explains obligations under the ABA Model Rules; firms should check the rules adopted in their jurisdiction and relevant court requirements.
Florida Bar Opinion 24-1, an advisory opinion, illustrates the practical questions involved: data retention and sharing, work-product review, billing, and advertising. It is not a universal rule for every firm.
Review confidentiality before using client information
Before approving a workflow, record the tool and account type, permitted data, access controls, retention terms, and whether inputs may be used to improve models. Assign someone to review changes in those terms. Obtain any required advice or consent before entering protected information.
For an initial test, use public or synthetic material. Do not assume that deleting names removes every identifying detail, or that a product marketed to lawyers automatically meets the firm’s requirements.
Make source verification and supervision explicit
Give the reviewer a defined checklist: open cited authorities, confirm quotations and holdings, check jurisdiction and currency, and compare summaries with the original record. Record unresolved issues and the final review decision in the appropriate matter workflow.
Ask reviewers to look for omitted facts, unsupported assumptions, and uneven treatment as well as obvious errors. An AI-generated explanation or citation list is a starting point for review, not evidence that the answer is sound.
Check regulatory scope before making broad claims
The EU AI Act does not classify every law-firm AI tool as high risk simply because it is used for legal work. Annex III specifies certain uses by or on behalf of judicial authorities and similar uses in alternative dispute resolution. Classification depends on the intended use and applicable provisions.
For each deployment, identify the jurisdictions, court rules, client commitments, and data requirements that need review. Assign a person to check current requirements before use and when the workflow changes.
Turn the policy into a repeatable workflow
Approve the task: State the purpose, allowed inputs, tool, and prohibited uses.
Name the reviewer: Define the checks required before material reaches a client, court, or other recipient.
Plan communications: Identify when disclosure, consent, or client discussion requires a decision under the applicable rules and engagement.
Keep appropriate records: Follow the firm’s retention and confidentiality policies when documenting inputs, outputs, corrections, and review.
Train and reassess: Use realistic examples, provide an escalation route, and revisit the process after errors or material tool changes.
Frequently asked questions
Does using a legal AI product remove the need for review?
No. Choose a review process suited to the task and its consequences. The responsible lawyer still needs to assess the work before relying on it.
Must every use of AI be disclosed?
Do not use a single answer for every situation. Check applicable professional rules, court requirements, client instructions, and the nature of the use with the responsible lawyer.
Where should a small firm start?
Choose one limited workflow, test with nonconfidential material, and write down the approval and review steps. Resolve problems before extending access or adding sensitive information.
Build an operating process your team can follow
Waybound is a fractional operations and growth partner for law firms. We help our partners connect tool adoption with ownership, training, and implementation, while the firm’s lawyers determine its professional obligations.
Contact Waybound to discuss the workflow your team needs to put into practice.
