Every law firm should have a written AI acceptable use policy. State bar guidance is converging on this recommendation, and for good reason: policies establish expectations, document safeguards, and provide a foundation for training and enforcement.
But what should an AI policy actually say? This guide walks through the key components and provides sample language you can adapt for your firm.
📌 Why You Need a Policy
A written AI policy serves multiple purposes: (1) It communicates expectations to attorneys and staff, (2) It documents reasonable safeguards for ethics compliance, (3) It provides a basis for training, and (4) It demonstrates due diligence if questions arise later.
Key Components of an AI Policy
An effective AI use policy for law firms should address these areas:
- Purpose and scope
- Approved tools and prohibited uses
- Client confidentiality requirements
- Data handling and anonymization
- Output review and verification
- Client disclosure
- Training requirements
- Enforcement and consequences
Let's examine each component with sample language.
1. Purpose and Scope
Start by explaining why the policy exists and who it applies to.
Section 1: Purpose and Scope
Purpose: This policy establishes guidelines for the acceptable use of artificial intelligence tools in the practice of law at [Firm Name]. It is designed to enable productivity benefits while ensuring compliance with our professional responsibility obligations, including duties of competence, confidentiality, and supervision.
Scope: This policy applies to all attorneys, paralegals, legal assistants, and staff who use AI tools in connection with firm business, regardless of whether those tools are provided by the firm or accessed through personal accounts.
Covered Tools: This policy covers generative AI platforms including, but not limited to, ChatGPT, Claude, Gemini, Copilot, and any other tools capable of generating text, code, or analysis from natural language prompts.
2. Approved Tools
Specify which tools are approved for use and which are prohibited. This prevents "shadow AI" usage.
Section 2: Approved and Prohibited Tools
Approved for Client Work:
- [Firm-provided AI tool with enterprise agreement]
- Microsoft Copilot (through firm Microsoft 365 subscription)
- Legal research platforms with AI features (Westlaw, Lexis+AI)
Approved for Non-Client Work Only:
- ChatGPT Plus (personal accounts) — for administrative tasks, general research, and learning only
Prohibited:
- Free-tier AI tools (ChatGPT Free, free Claude, etc.) for any firm-related work
- AI tools accessed through VPNs or methods that bypass firm monitoring
- Any AI tool not explicitly approved in this policy
3. Client Confidentiality
This is the most important section. Be explicit about what can and cannot be entered into AI tools.
Section 3: Client Confidentiality
General Rule: Do not enter any information relating to client representation into AI tools unless you have confirmed that the tool meets our confidentiality requirements and you have followed the anonymization procedures below.
Absolutely Prohibited Inputs:
- Client names or identifiers
- Opposing party names
- Case numbers or matter identifiers
- Social Security numbers, financial account numbers, or medical information
- Privileged communications
- Settlement terms or negotiation positions
- Trade secrets or confidential business information
- Information subject to protective orders
When Using Approved Tools: Even with approved enterprise tools, minimize the confidential information entered. Ask yourself: "Does the AI need this specific information to help me, or can I describe the issue generically?"
4. Data Handling and Anonymization
Provide practical guidance on how to anonymize information before using AI.
Section 4: Anonymization Requirements
Before entering any fact pattern into an AI tool:
- Replace client names with generic identifiers (e.g., "Client," "Company A")
- Replace opposing party names with generic identifiers
- Remove specific dates that could identify the matter
- Remove location details that could identify parties
- Generalize industry or business details that are identifying
- Remove any numerical identifiers (SSNs, account numbers, case numbers)
Example:
Instead of: "Our client John Smith is being sued by ABC Corp for breach of a software licensing agreement signed on March 15, 2025."
Use: "A technology company is being sued by a vendor for breach of a software licensing agreement."
5. Output Review and Verification
Require human review of all AI outputs. This addresses the competence and supervision duties.
Section 5: Review and Verification
Mandatory Review: All AI-generated content must be reviewed by a licensed attorney before use in any client deliverable, court filing, or external communication.
Citation Verification: Every legal citation generated by an AI tool must be independently verified. Confirm that: (1) the case exists, (2) the citation is accurate, (3) the case says what the AI claims it says, and (4) the case has not been overruled or limited.
Factual Verification: AI tools may generate plausible-sounding but inaccurate factual statements. Verify any factual claims through independent research.
No Blind Reliance: AI outputs should be treated as a starting point for analysis, not a finished product. Apply the same critical review you would to work from a first-year associate.
6. Client Disclosure
Address when and how AI use should be disclosed to clients.
Section 6: Client Disclosure
General Approach: The firm uses various technological tools, including AI, to assist in providing legal services. We do not routinely disclose the use of specific research or drafting tools unless:
- The client specifically asks
- AI use is material to the representation
- The engagement letter or client agreement requires disclosure
- Applicable ethics rules require disclosure
When in Doubt: If you are uncertain whether to disclose AI use to a client, consult with your supervising partner or the firm's ethics counsel.
7. Training Requirements
Establish training requirements so the policy is understood and followed.
Section 7: Training
Initial Training: All attorneys and staff must complete AI acceptable use training within 30 days of joining the firm or within 30 days of this policy's effective date.
Annual Refresher: All personnel must complete annual AI security awareness training.
Training Topics: Training will cover: (1) This policy's requirements, (2) How AI tools handle data, (3) Anonymization techniques, (4) Output verification procedures, (5) Recognizing AI limitations and hallucinations.
8. Enforcement
Specify consequences for policy violations.
Section 8: Enforcement
Compliance Monitoring: The firm may implement technical controls to monitor AI platform usage and enforce this policy.
Violations: Violations of this policy will be addressed through the firm's standard disciplinary process. Depending on severity, consequences may include: (1) additional training requirements, (2) temporary suspension of AI tool access, (3) disciplinary action up to and including termination, and (4) referral to the state bar if ethics violations occurred.
Reporting: If you become aware of a potential policy violation or inadvertent disclosure of confidential information, report it immediately to [designated contact].
Additional Considerations
Billing Guidance
Some firms include guidance on billing for AI-assisted work. Consider whether time saved through AI efficiency should affect billing, and whether time spent reviewing AI outputs is billable at normal rates.
Policy Review
AI technology evolves rapidly. Include a provision for regular policy review — at least annually, or when significant new tools or guidance emerge.
Technical Controls
Policies are more effective when paired with technical enforcement. Consider tools that can monitor AI usage, block sensitive data patterns, and maintain audit logs.
Implementation Checklist
After adopting your policy:
- ✓ Distribute the policy to all attorneys and staff
- ✓ Require signed acknowledgment of receipt and understanding
- ✓ Conduct initial training sessions
- ✓ Implement technical monitoring/controls if available
- ✓ Add policy review to annual calendar
- ✓ Update engagement letters if needed
- ✓ Brief practice group leaders on enforcement expectations
Enforce Your AI Policy with Technical Controls
PromptFence helps law firms enforce AI usage policies — monitor what's being sent, block sensitive data, and maintain audit logs for compliance.
Learn More for Law Firms →This article is for informational purposes only and does not constitute legal advice. Customize any policy language for your firm's specific circumstances and consult ethics counsel as needed.