Writing a Generative AI Policy for a Law Firm

Most firm policies now build on ABA Formal Opinion 512, issued in July 2024. It applies existing professional rules to generative AI rather than creating new ones. State bars have issued similar guidance, including Florida Bar Ethics Opinion 24-1 and practical guidance from the State Bar of California. A workable policy usually has these sections: Scope and definitions: who is covered (lawyers, staff, contractors) and what counts as generative AI, including AI features built into familiar software. Approved tools: a list, plus a process for approving new tools that includes a review of the vendor's data handling. Confidentiality: rules on which categories of information may go into which tools. Opinion 512 says lawyers generally need a client's informed consent before entering confidential information into a self-learning tool that could expose it to others. Verification: a lawyer is responsible for every output. Citations must be read and checked in the original source. In Mata v. Avianca (2023), lawyers were sanctioned after filing a brief with cases ChatGPT had invented. Client communication: when to tell clients about AI use, and how to follow client guidelines that restrict it. Billing: Opinion 512 says hourly billing must reflect time actually spent. Lawyers generally should not bill clients for time spent learning a tool they will use across their practice. Supervision: partners' responsibilities for associates and staff under Model Rules 5.1 and 5.3. Court rules: tracking standing orders on AI disclosure. The remaining sections cover required training, how to report incidents, and a review schedule, because tools and guidance change quickly. A common misconception is that banning AI outright is the safest choice. A ban often pushes people toward personal accounts the firm cannot see or control, which increases confidentiality risk.