What should a law firm's generative AI policy cover?

A firm’s generative AI policy should say which tools lawyers may use, what client information may go into them, how output gets checked, what courts and clients must be told, how AI work is billed, and who gets trained. Each of those sections maps to an ethical duty that ethics regulators have already applied to AI. The ABA, the State Bar of California and The Florida Bar have each published guidance that names them.

Does a firm need a written AI policy at all?

The ABA thinks so. Formal Opinion 512, issued July 29, 2024, says “Managerial lawyers must establish clear policies regarding the law firm’s permissible use of GAI.” It ties that to the supervision duties in Model Rules 5.1 and 5.3. (Our guide to ABA Formal Opinion 512 walks through the opinion section by section.)

State guidance points the same way. California’s 2026 Practical Guidance, which replaces its 2023 version, says managerial and supervisory lawyers should set clear policies on generative AI use, including agentic tools that act with little human direction. The State Bar’s Board of Trustees approved the update on May 14, 2026. Florida Bar Ethics Opinion 24-1 says lawyers must develop policies and practices to verify that AI use fits their ethical obligations.

These are ethics opinions, not rules. Florida’s opinion says so on its face: “Advisory ethics opinions are not binding.” Your state’s rules and opinions may differ. The duties underneath them, such as competence and confidentiality, are in the rules themselves.

What sections should the policy have?

The table maps each section to the duty it serves and where the guidance comes from. Rule numbers are ABA Model Rules unless noted. California and Florida have their own numbering.

Policy section	What it covers	Duty it serves	Source
Approved tools and vendor review	Which tools are allowed, and how a tool gets vetted before use	Competence (1.1), confidentiality (1.6), supervising nonlawyer help (5.3)	ABA 512; California 2026; Florida 24-1
Client information	What may be entered into which tools, and when client consent is needed	Confidentiality (1.6)	ABA 512; California 2026; Florida 24-1
Verification	Who reviews AI output, and how closely	Competence (1.1)	ABA 512; California 2026; Florida 24-1
Court filings	Citation checks and court disclosure rules	Meritorious claims (3.1), candor (3.3), honesty (8.4(c))	ABA 512; California 2026; N.D. Tex. LR 7.2(f)
Client communication	When to tell clients, and following client AI instructions	Communication (1.4)	ABA 512; California 2026
Billing and costs	Hourly time, flat fees, learning time, tool costs	Reasonable fees (1.5)	ABA 512; California 2026; Florida 24-1
Training and supervision	Who is trained, on what, and who answers for compliance	Supervision (5.1, 5.3)	ABA 512; California 2026
Client-facing chatbots	Intake bots and AI in marketing	Advertising rules, prospective clients	Florida 24-1
Bias	Checking output used in hiring or client screening	California rule 8.4.1	California 2026
Review schedule	When the policy and tool list get revisited	Competence (1.1), supervision (5.1)	ABA 512; California 2026

How should the firm approve tools?

Start with a list of approved tools and a vetting step before anything is added. ABA Opinion 512 says lawyers should read and understand a tool’s terms of use, privacy policy and related contract terms to learn who can access what they type in. It says lawyers may need IT or cybersecurity experts to understand those terms.

For outside vendors, Opinion 512 points to earlier outsourcing opinions. It lists reference checks, vendor credentials, the vendor’s security policies, confidentiality agreements and the vendor’s conflicts check system. It says those concepts apply to AI providers.

California adds that “Reasonable efforts require more than reliance on generalized marketing assurances.” Florida’s Opinion 24-1 says to check the provider’s policies on data retention, data sharing and self-learning. It also says to confirm whether the provider keeps the firm’s data after the service ends.

What client information can go into an AI tool?

This is the section most likely to need a firm-specific rule. Opinion 512 says many self-learning tools could disclose client information through their output. Because of that, it says client informed consent is required before entering information relating to the representation into such a tool. It adds that general boilerplate in an engagement letter is not enough for that consent.

Opinion 512 also says consent is not needed when no client information goes in, such as using a tool for idea generation. Florida says the same: no informed consent is required if no confidential information goes to a third party. Florida recommends consent before using a third-party tool that would involve confidential information. California says a lawyer must not enter confidential client information into a tool that may present material confidentiality or security risks, absent informed client consent.

A workable policy sorts tools into tiers. One tier is approved for client information after vetting. Another is approved only for work with no client information. The rest are not approved.

Who checks the output, and how closely?

Opinion 512 says relying on a tool’s output without an appropriate degree of independent verification could violate the duty of competence. It also says the right amount of review depends on the tool and the task. A policy can state that rule and assign the reviewer for each kind of work.

Florida treats AI like a nonlawyer assistant. Under Opinion 24-1, a lawyer must verify the accuracy and sufficiency of all research done by generative AI. California’s 2026 guidance says lawyers remain responsible for reviewing and approving all outputs, decisions, advice and filings.

Opinion 512 offers one practical step: mark AI-produced materials as such when they are stored in a client or firm file. That way, later readers know the work may contain errors.

What should the policy say about court filings?

Opinion 512 names Model Rules 3.1, 3.3 and 8.4(c). It lists the problems seen so far, including citations to nonexistent opinions. It also tells lawyers to check the court’s local rules on AI use. Our record of AI hallucination cases involving lawyers tracks what happens when that check is skipped.

Some courts now require disclosure. In the Northern District of Texas, Local Civil Rule 7.2(f) took effect September 3, 2024. A brief prepared with generative AI must say so on the first page, under the heading “Use of Generative Artificial Intelligence.” A brief without that disclosure certifies that no part was prepared with AI. Judges can also set their own requirements. Judge Brantley Starr once required a separate AI certification, and his page now says he no longer does because of the new local rules.

California’s guidance says lawyers should check for rules or orders requiring AI disclosure in their jurisdiction, and it says lawyers must not let AI systems file documents with the court on their own. A filing section should require a check of the local rules and the judge’s standing orders for every matter.

When should clients be told?

Opinion 512 says the facts decide, but it names cases where clients must be told or consulted. These include when a client asks, when the lawyer proposes to enter client information, when AI use is relevant to the fee, and when the output will influence a significant decision in the representation.

California says lawyers must consider telling clients they intend to use AI, including how and the risks. It also says lawyers must follow client instructions or guidelines that limit AI use. A policy should require lawyers to check each client’s guidelines before using AI on that client’s work.

How should AI work be billed?

Opinion 512 says lawyers who bill hourly must bill their actual time. Its example: a lawyer who spends 15 minutes entering information to draft a pleading may bill those 15 minutes plus the time spent reviewing the draft. For flat fees, it says charging the same fee may be unreasonable if the tool makes the work much faster. It also says a lawyer may not charge a client to learn a tool the lawyer will regularly use for clients, and may not bill general office overhead.

California says subscription fees for general tools are typically overhead. It allows charging per-use fees for specialized tools specifically incurred for a client, without markup absent the client’s informed written consent. Florida says to tell the client, preferably in writing, before charging the actual cost of AI. If the actual cost for one matter cannot be determined, Florida says not to prorate the subscription and to treat it as overhead.

Who needs training, and on what?

Opinion 512 says supervisory duties include making sure lawyers and nonlawyers are trained in the ethical and practical use of the tools they use. It suggests covering the basics of the technology, the tools’ capabilities and limits, ethical issues, and secure data handling. California calls for periodic training for both lawyer and nonlawyer staff.

What else belongs in the policy?

Three more sections apply to some firms and not others.

• Chatbots and marketing. Florida’s Opinion 24-1 says an intake chatbot must tell prospective clients they are talking to an AI program, not a lawyer or employee. It warns that a chatbot can create a prospective client relationship without the lawyer knowing. It also says firms may not claim their AI is better than other firms’ unless the claim is objectively verifiable.
• Bias. California’s guidance, under its rule 8.4.1, says firms should set policies to identify and address AI bias. It gives employment actions and client or candidate screening as examples.
• Agentic tools. California says lawyers must limit what agentic systems can access. It says they must not let those systems send client information outside the firm without safeguards and human review.

How often should the policy change?

Opinion 512 says of technological competence, “This is not a static undertaking.” California says supervisory lawyers should review and update firm policies, controls and training as the tools change. A fixed review date, with an owner, makes that happen. Each review should check the approved-tool list, any new ethics opinions in the firm’s states, and new disclosure rules in the courts where the firm files.