AI Policy for Law Firms: A Practical Template

An AI policy for law firms should define approved tools, protect client information, require independent source checks, and put a named lawyer in charge of reviewing work. It should also explain when to discuss AI use with clients, how to record actual work, and where to report mistakes.

Use the clauses below as a draft for your firm’s ethics counsel and practice leaders to adapt to the jurisdictions and matters involved. fenbs can keep approved firm rules and the reasons behind revisions available to connected assistants without placing client files in the policy record.

Which professional duties should shape the draft?

The ABA’s Formal Opinion 512↗ (opens in a new tab) addresses generative AI through existing duties, including competence, confidentiality, communication, supervision, candor, and reasonable fees. It is guidance about the ABA Model Rules; check the rules and opinions that actually govern your lawyers, plus court orders and client requirements.

Avoid a policy that merely says “use professional judgment.” A junior lawyer needs to know whether a particular account may receive a deposition excerpt, who checks an AI-generated citation, and what to do when a client prohibits AI. Assign those answers before approving the first workflow.

For a general organization-wide framework beyond legal practice, see the separate AI policy guide. This page provides law-firm clauses and the review steps needed to make them usable.

What clauses can the firm copy and adapt?

Replace the bracketed roles and attach a maintained list of approved tools and uses. The following is a proposed firm policy, not a universal statement of legal obligations. Have a responsible partner approve the complete version rather than circulating disconnected clauses.

• Scope: This policy applies to lawyers, staff, contractors, and others using AI for [Firm] work. It covers stand-alone assistants and AI features in research, document, email, transcription, and practice software.
• Approved use: Use only the tool, account type, configuration, and purpose approved by [policy owner]. Approval for public marketing drafts does not authorize client information, confidential internal material, or a connection to a matter repository.
• Confidentiality: Do not enter information relating to a client representation unless the responsible lawyer has confirmed the proposed use satisfies applicable duties, firm requirements, and client instructions. Obtain informed consent when required. Public availability alone does not settle every confidentiality question.
• Verification: Treat generated material as an unverified draft. Open and read every authority relied on, confirm quotations and citations, check relevant jurisdiction and subsequent treatment, and verify factual statements against the matter record.
• Human responsibility: A named lawyer reviews substantive legal output before it is relied on, sent, filed, or used to advise a client. AI must not independently communicate advice, make commitments, file documents, or change a deadline.
• Client and tribunal requirements: The responsible lawyer checks engagement terms, outside counsel guidelines, court rules, and case-specific orders. Discuss AI use with the client and obtain consent or provide disclosure when required by the applicable duties or circumstances.
• Work records and fees: Record actual time and work performed. Do not bill hypothetical hours the tool saved. Tool expenses and fee arrangements require review under firm billing policy, the engagement agreement, and applicable rules.
• Incidents and exceptions: Stop an unsafe workflow and notify [contact] promptly after suspected disclosure, fabricated authority, or unauthorized action. Preserve relevant evidence in the approved location. Exceptions need documented partner approval, boundaries, and an expiration date.

Give the approval list a practical shape: exact service and account, permitted data, permitted activity, required reviewer, approving person, and review trigger. Save the human-approved boundaries in fenbs Decisions and rules, with a link to the firm’s authoritative policy document.

How should confidentiality and tool approval work?

ABA Model Rule 1.6↗ (opens in a new tab) protects information relating to representation and calls for reasonable efforts against unauthorized disclosure or access. A confidentiality review therefore needs more than asking whether a document is privileged. Map the actual information that would leave the firm and who could receive it.

Ask about retention, model training, service-provider access, connected sources, deletion, contractual protections, and account administration. Evaluate the exact service arrangement. A product label such as “enterprise” is not a substitute for that review, and replacing names can leave a matter identifiable.

Say an associate wants help outlining a public-law issue. A fictional fact pattern may be an approved starting point. Uploading the client’s draft settlement agreement is a different request and needs its own information-handling decision. Record that distinction so permission does not spread by analogy.

What must a lawyer check before using the output?

ABA Model Rule 1.1↗ (opens in a new tab) requires the knowledge, thoroughness, and preparation necessary for competent representation. Build the review around the work product, not around whether the model sounds confident. An authentic case can still be quoted inaccurately or applied to the wrong issue.

1. Match every material fact to the record. Distinguish a witness statement, an allegation, and an established fact instead of letting a summary merge them.
2. Read each cited authority in an appropriate source. Check the proposition, citation details, current validity, and jurisdiction before relying on it.
3. Review omissions and framing. Ask whether contrary authority, an exception, a deadline, or a client instruction was lost during generation.
4. Keep a proportionate review record in the matter system: work reviewed, source checks completed, corrections made, and responsible lawyer.

Train with fictional files before live matters. The practical workplace AI guide helps structure a small trial, while the AI brain explainer covers retaining approved work context across assistants.

Who owns supervision, billing, and policy revisions?

Give practice leaders responsibility for examples and training, information security responsibility for technical assessment, and a designated partner authority over exceptions. ABA Model Rule 5.1↗ (opens in a new tab) addresses firm measures and lawyer supervision. A policy document is only useful if someone checks how people apply it.

Have billing counsel review the fee clause against ABA Model Rule 1.5↗ (opens in a new tab) and the governing jurisdiction. Keep time entries accurate and make fee communications consistent with the engagement. Do not let an assistant decide whether a tool expense can be passed through.

How to do this with fenbs

1. Create a free account and add a project for the firm’s AI policy review.
2. Create tasks for ethics, security, billing, and practice review. Use fictional examples and references to approved documents rather than client information.
3. Record the partner-approved rules, their scope, and the decisions behind them. Keep questions needing counsel as open decisions.
4. Ask connected assistants to read those rules before policy-related work and save progress with unresolved reviews and next steps.

fenbs is not a legal research service, matter repository, or guarantee of professional compliance. Keep client materials in the firm’s approved systems. Use the AI governance hub for related policy topics, and review this policy when tools, engagements, or governing requirements change.