AI Ethics and Confidentiality for Law Firms

AI ethics and confidentiality for law firms comes down to applying the duties you already have to a new kind of tool. Before using AI on client work, a firm should weigh competence, confidentiality, client communication, supervision, and fair fees, then vet any vendor’s data practices with care.

This guide is for managing partners, general counsel, and operations leads at firms with roughly 3 to 50 attorneys. It walks through the ABA Model Rules most often cited in this area, what ABA Formal Opinion 512 covers in general terms, and a due-diligence checklist you can use with any vendor.

This article is general information, not legal advice. Ethics rules vary by state. Check your state bar’s rules and guidance, and consult ethics counsel for your firm’s situation.

Why AI Ethics and Confidentiality for Law Firms Feels Familiar

Lawyers have adapted ethics rules to new tools before: email, cloud storage, e-discovery platforms, and remote work. AI tools raise the same core questions in a new form. Where does client data go? Who can see it? How do you know the output is right? Who is responsible when it is wrong?

The good news is that you do not need a new ethical framework. You need to apply existing duties carefully and document how you did it.

The Core Duties Firms Weigh

The ABA Model Rules of Professional Conduct are a common starting point. Most states have adopted rules based on them, though wording and comments differ. Here are the duties firms most often weigh when they consider AI tools.

Competence (Model Rule 1.1)

Rule 1.1 requires competent representation. A comment to the rule, adopted in some form by many states, says lawyers should keep up with the benefits and risks of relevant technology. This is often called the duty of technology competence.

For AI, that means understanding enough about a tool to use it responsibly. You do not need to know how it was built. You do need to know what it is good at, where it tends to fail, and how your team will check its work.

Confidentiality (Model Rule 1.6)

Rule 1.6 requires lawyers to protect information relating to the representation of a client. It also asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of that information.

This is the duty most firms focus on first. Before any client information enters an AI tool, the firm should understand how the vendor handles that data. The checklist later in this article covers the questions to ask.

Communication With Clients (Model Rule 1.4)

Rule 1.4 covers keeping clients reasonably informed and explaining matters so clients can make informed decisions. Whether a firm must tell clients about AI use, or get their consent, depends on the facts, the tool, and your state’s guidance.

Some firms address AI use in engagement letters. Others decide case by case based on what data is involved and how the output is used. Either way, be ready to answer a client who asks how their information is handled.

Supervision (Model Rules 5.1 and 5.3)

Rule 5.1 covers the responsibilities of partners, managers, and supervising lawyers. Rule 5.3 covers responsibilities regarding nonlawyer assistance. Together, they ask firm leaders to make reasonable efforts to ensure that the firm has measures in place so that lawyers and nonlawyer assistance meet professional obligations.

Many commentators apply this thinking to AI tools. In practice, it means firm policies on approved tools, defined review steps, training for staff, and a named person who checks AI-assisted output before it is used. For more on how this plays out day to day, see our guide on human-in-the-loop AI for legal work.

Reasonable Fees (Model Rule 1.5)

Rule 1.5 prohibits unreasonable fees. If an AI tool cuts a ten-hour task to two hours of review, billing the client for ten hours raises a clear concern. Hourly billing should reflect the time actually spent.

Firms also need to decide how to treat the cost of the tool itself. Some treat it as overhead. Others may pass on certain costs with proper disclosure. Your state’s guidance and your engagement terms should shape that call.

What ABA Formal Opinion 512 Covers

In July 2024, the ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512 on generative AI tools. In general terms, the opinion walks through how existing Model Rules apply to lawyers’ use of these tools. It discusses competence, confidentiality, communication, supervision, candor toward the tribunal, and fees.

A few broad themes stand out:

• Lawyers should understand the capabilities and limits of the tools they use.
• Lawyers should assess the risk that client information could be disclosed or accessed by others, both inside and outside the firm.
• In some cases, informed client consent may be needed before entering client information into a tool.
• Output must be reviewed, and lawyers remain responsible for their work product.
• Fees should reflect actual time and reasonable costs.

Read the opinion itself rather than relying on any summary, including this one. ABA opinions are not binding on their own, but many state bars look to them.

Check Your State Bar’s Guidance

Many state bars have issued their own guidance on AI tools, through formal ethics opinions, practice guides, or task force reports. Some courts have also adopted local rules or standing orders on AI use in filings.

The details vary. One state may focus on client consent, another on supervision, another on billing. Some guidance is formal and some is advisory. Because the landscape keeps changing, check your state bar’s website for current materials before you set firm policy. If your firm practices in several states, review each one.

You can find more on state-level considerations on our states page.

A Vendor Due-Diligence Checklist

Confidentiality depends heavily on the vendor you choose. Use these questions in any vendor review. Ask for answers in writing, and have your firm’s IT or security advisor review them. These questions apply to any vendor, including us.

Data Use

• What client data does the tool collect, and for what purposes?
• Is client data used for anything other than providing the service to our firm?
• Is client data used to train or improve models, for our firm or for other customers?
• Can we opt out of any secondary use, and is that in the contract?

Data Retention and Deletion

• How long is our data kept, including inputs, outputs, and logs?
• Can we delete our data on request, and how is deletion confirmed?
• What happens to our data when the contract ends?

Access Controls

• Who at the vendor can access our data, and under what conditions?
• How is access logged, and can we see those logs?
• Can we control which users at our firm see which matters?

Subprocessors and Third Parties

• Which subprocessors or third-party services handle our data?
• Where are they located, and what agreements govern them?
• Will we be notified before a new subprocessor is added?

Security and Incident Response

• What security documentation can you share for our firm’s security review?
• How will you notify us of a security incident, and how quickly?
• Have you completed any independent assessments, and can we review the results?

Contract Terms

• Does the agreement address confidentiality of client information directly?
• Are there limits on the vendor’s liability for data incidents?
• Can we audit or request evidence of compliance with the contract terms?

Keep the vendor’s answers in a file. If a regulator, client, or insurer ever asks how you vetted a tool, that record is your best evidence of reasonable effort.

If you are reviewing NewClerk, you can request a security review and our team will respond to your firm’s questions directly.

Building a Simple Firm AI Policy

A short written policy helps you apply these duties the same way across the firm. It does not need to be long. A good first version covers:

1. Approved tools. Which tools staff may use for client work, and which they may not.
2. Approved uses. Which tasks may be assigned, such as indexing records or legal document review, and which stay with attorneys.
3. Data rules. What client information may enter each tool, and what must never be entered.
4. Review steps. Who checks each type of output and how that check is recorded.
5. Client communication. When and how the firm tells clients about AI use.
6. Billing. How time and costs are recorded when AI assists.
7. Training. How staff learn the policy and how often it is refreshed.

Revisit the policy at least once a year, or when your state bar issues new guidance.

Where a Defined Workflow Helps

Ethics risk often grows when AI use is loose and informal. Staff paste client facts into whatever tool is handy, and no one knows what was shared or checked.

A defined workflow narrows that risk. When an AI paralegal performs a specific task, follows configured procedures, and returns work for human review, the firm can see what was assigned, who reviewed it, and what was sent back. That structure makes supervision easier to show and easier to repeat. See how it works for one example of a review-first approach.

Frequently Asked Questions

Do I need client consent to use AI on a matter?

It depends on the tool, the data involved, and your state’s guidance. ABA Formal Opinion 512 notes that informed consent may be needed in some situations, especially where client information could be disclosed. Many firms address AI use in engagement letters. Check your state bar’s guidance and consult ethics counsel.

What does the duty of technology competence mean for AI?

It means understanding a tool well enough to use it responsibly. You should know what it does well, where it tends to make errors, and how your team will check its output. You do not need technical expertise, but you do need a clear review process and staff training.

Can I bill clients for time saved by AI tools?

Hourly billing should reflect the time actually spent. If a task takes two hours of review instead of ten hours of manual work, billing ten hours raises concerns under Model Rule 1.5. How to treat the tool’s cost, as overhead or a passed-through expense, depends on your engagement terms and state guidance.

What is the most important question to ask an AI vendor?

Ask how client data is used beyond providing the service, including whether it is used to train or improve models. Get the answer in writing and in the contract. Then ask about retention, deletion, access controls, and subprocessors so your firm’s security review has the full picture.

Has every state bar issued AI guidance?

No, and the guidance that exists varies widely in scope and form. Some states have formal ethics opinions, others have practice guides or task force reports, and some courts have their own rules for filings. Check your state bar’s website regularly, since new guidance continues to appear.

Take the Next Step With Confidence

AI ethics and confidentiality for law firms is manageable when you apply familiar duties, vet vendors carefully, and keep humans in charge of review. A clear policy and a defined workflow make that easier to show to clients and regulators.

Book a demo to see a review-first AI paralegal in action, or request a workflow assessment to talk through which tasks your firm could delegate safely.