ABA Model Rules and AI: What Law Firms Need to Know

Attorneys across the country are using ChatGPT, Claude, Copilot, and other AI tools daily — for drafting, research, document review, and client communication. The productivity gains are real. So are the ethical risks.

The ABA Model Rules of Professional Conduct don't mention "artificial intelligence" explicitly, but several rules directly govern how attorneys can — and cannot — use these tools. Understanding these obligations isn't optional; it's a matter of professional responsibility.

This guide breaks down the key rules, explains how they apply to AI usage, and outlines what "reasonable safeguards" actually means in practice.

The Three Rules That Matter Most

While multiple Model Rules touch on technology use, three are most directly relevant to AI:

• Rule 1.1 (Competence) — The duty to provide competent representation, including understanding the technology you use
• Rule 1.6 (Confidentiality) — The duty to protect client information from unauthorized disclosure
• Rule 5.3 (Supervision) — The duty to supervise non-lawyer assistants — including AI tools

Let's examine each in the context of generative AI.

Rule 1.1: The Competence Duty

Rule 1.1 requires that lawyers provide "competent representation," which includes "the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation."

Comment 8 to Rule 1.1 was amended in 2012 to explicitly include technology:

"To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology."

This means attorneys have an affirmative duty to understand how AI tools work — not just their benefits, but their risks.

What This Means for AI Usage

• Understand the tool: Know whether prompts are used for training, how data is stored, and what the provider's terms of service say about confidentiality
• Verify outputs: AI-generated content can contain "hallucinations" — fabricated citations, incorrect legal standards, or outdated information. Attorneys must review and verify all AI outputs
• Stay current: AI capabilities and risks evolve rapidly. What was true six months ago may not be true today

Rule 1.6: The Confidentiality Duty

Rule 1.6 prohibits attorneys from revealing "information relating to the representation of a client" unless the client gives informed consent or disclosure is impliedly authorized.

Comment 18 addresses electronic communications:

"A lawyer must act competently to safeguard information relating to the representation of a client against unauthorized access by third parties."

When an attorney pastes client information into a commercial AI platform, they are transmitting that information to a third party. The question becomes: is this an "unauthorized disclosure"?

The Training Data Problem

Many AI platforms use prompts to improve their models — meaning client data could theoretically become embedded in future outputs. Even when providers claim they don't train on enterprise data, the risk of inadvertent disclosure remains.

Key considerations:

• Read the terms: Does the AI provider use prompts for training? Do they retain prompt data? For how long?
• Enterprise vs. consumer: Consumer-tier ChatGPT has different data handling than ChatGPT Enterprise. Know which you're using
• What you paste matters: Client names, case details, opposing party information, privileged communications — all of this is confidential

What "Reasonable Safeguards" Means

Rule 1.6 doesn't require perfect security — it requires "reasonable efforts" to prevent inadvertent or unauthorized disclosure. Factors include:

• The sensitivity of the information
• The likelihood of disclosure if additional safeguards are not employed
• The cost of additional safeguards
• The difficulty of implementing the safeguards
• The extent to which the safeguards adversely affect the lawyer's ability to represent clients

For AI usage, reasonable safeguards might include:

• Firm-wide AI usage policies
• Training on data leakage risks
• Technical controls (like PromptFence) that prevent sensitive data from being submitted
• Using enterprise-grade AI tools with appropriate data handling agreements
• Audit logging to document what was sent and when

Rule 5.3: The Supervision Duty

Rule 5.3 requires partners and supervising attorneys to ensure that non-lawyer assistants comply with the Rules of Professional Conduct.

But what about AI? Is ChatGPT a "non-lawyer assistant"?

The ABA hasn't formally ruled on this, but the logic is straightforward: if you're using AI to perform tasks that would otherwise require human judgment — drafting, research, analysis — you have a duty to supervise that work just as you would supervise a paralegal or associate.

Supervision in Practice

• Review all AI outputs: Never file AI-generated content without attorney review
• Verify citations: Check that cases exist and say what the AI claims
• Monitor usage: Know who in your firm is using AI and for what purposes
• Establish policies: Define what's acceptable and what's not

State Bar Guidance

While the ABA Model Rules provide the framework, state bars are issuing their own guidance on AI. Notable examples include:

• California: Practical Guidance for the Use of Generative AI in the Practice of Law (2024)
• Florida: Proposed Advisory Opinion 24-1 on AI usage
• New York: Guidelines from the NYSBA on AI in legal practice
• Texas: AI task force recommendations

The common themes across all state guidance:

1. Attorneys remain responsible for AI outputs
2. Client confidentiality must be protected
3. AI usage should be disclosed to clients when material
4. Firms should have policies governing AI use

See our comprehensive guide to state bar AI opinions for detailed coverage.

Building a Compliant AI Practice

Given these obligations, what should law firms do? Here's a practical framework:

1. Establish an AI Use Policy

Every firm should have a written policy addressing:

• Which AI tools are approved for use
• What types of information can (and cannot) be input
• Requirements for reviewing and verifying AI outputs
• Client disclosure requirements
• Consequences for policy violations

2. Implement Technical Controls

Policies alone aren't enough. Technical controls provide enforcement:

• Monitor AI platform usage across the firm
• Block or warn when sensitive data patterns are detected
• Maintain audit logs for compliance documentation
• Consider tools that automatically redact client identifiers

3. Train Your People

Attorneys and staff need to understand:

• How AI tools handle data
• What constitutes confidential information
• How to verify AI outputs
• When to disclose AI usage to clients

4. Document Your Safeguards

If a bar complaint or malpractice claim arises, you'll want evidence that you took reasonable steps. Maintain records of:

• Your AI policy and when it was implemented
• Training completed by attorneys and staff
• Technical controls in place
• Audit logs of AI interactions

The Bottom Line

The ABA Model Rules don't prohibit AI usage — but they do impose clear obligations on attorneys who use these tools. Competence, confidentiality, and supervision duties all apply.

The firms that thrive will be those that embrace AI's productivity benefits while implementing the safeguards necessary to meet their professional obligations. The alternative — ignoring AI or using it recklessly — creates liability exposure that no firm should accept.

"Reasonable safeguards" isn't a vague aspiration. It's a specific, documentable set of policies and controls that demonstrate you took your ethical obligations seriously.

This article is for informational purposes only and does not constitute legal advice. For specific guidance on AI ethics compliance, consult your state bar or a legal ethics professional.