Law Firm AI Policy Template and Governance Checklist

ABA Formal Opinion 512, issued July 29, 2024, explains that lawyers using generative AI must consider existing professional duties, including competence, confidentiality, client communication, supervision, meritorious claims, candor to tribunals, and reasonable fees. The opinion does not create a universal technology checklist, and individual jurisdictions may impose additional requirements.

A firm policy should therefore function as an operational control rather than a promise that a tool is automatically ethical or compliant. Each approved use still requires professional judgment, matter-specific review, and attention to governing court and client rules.

Define the policy's purpose and the people it covers. Include partners, associates, contract lawyers, paralegals, intake staff, administrators, and vendors who may use AI for firm work. Name a policy owner and a backup owner responsible for tool review, training, incident escalation, and scheduled reassessment.

State that AI assists—but does not replace—legal judgment. No employee should treat generated text, citations, summaries, calculations, classifications, or predictions as authoritative without appropriate review.

Maintain a central register of approved AI tools. For each tool, document its owner, contract status, data-retention settings, training-data terms, access controls, approved data classifications, and permitted tasks. Approval for one workflow does not imply approval for every workflow.

Examples of bounded uses may include drafting an internal outline from non-confidential instructions, restructuring attorney-authored text, or summarizing records inside an approved matter workspace. High-impact decisions, final legal advice, filing decisions, conflict determinations, trust transactions, and unsupervised client communications should remain outside autonomous AI authority.

Before entering information into an AI system, users should determine whether the tool and proposed use are authorized for that data. The policy should prohibit placing confidential, privileged, personal, health, financial, or sealed information into unapproved systems.

Require a documented vendor assessment covering retention, secondary use, model training, access by subcontractors, encryption, deletion, breach notice, and administrative controls. Removing a client's name may not be sufficient if the remaining facts can identify the client or matter.

The responsible lawyer should verify factual statements, quotations, calculations, authorities, record citations, and procedural requirements before using AI-assisted work. Review intensity should rise with the potential consequence of an error.

For court submissions, require the filing lawyer to confirm every cited authority in an authoritative source, examine applicable standing orders and local rules, and make any required disclosure. An AI-generated citation is not evidence that an authority exists or supports the stated proposition.

Define when lawyers must discuss AI use with clients and when informed consent may be required. The answer can depend on the engagement, the information involved, the degree of reliance, client instructions, and applicable law. The policy should route uncertain situations to the responsible attorney or ethics counsel rather than using a blanket disclosure statement.

Supervising lawyers should train staff on approved tools and monitor compliance. Billing policies should distinguish actual professional time from automated processing and ensure fees remain reasonable. Firms should not bill fictional hours that were not worked simply because a manual process would have taken longer.

A written policy becomes useful only when the firm can apply and audit it. Use this checklist during adoption and each scheduled review:

AttorneyCore's AI Co-Pilot and drafting workflows are designed to produce reviewable text rather than autonomous legal decisions. Availability depends on the workspace plan and a configured provider, and attorneys remain responsible for reviewing output before use.

During a guided demo, evaluate access controls, the source material available to the assistant, provider configuration, saved output handling, and the review steps your firm would require. Confirm that the proposed configuration matches your own policy and vendor-assessment standards before using client information.