AI for Law Firms: Protecting Client Confidentiality

A law firm's core product is trust in confidentiality — a client tells a lawyer things they'd tell almost no one else, on the understanding that it stays protected. Generative AI tools are useful for exactly the kind of work law firms do — drafting, summarizing, research — which is precisely why the American Bar Association moved to give firms a clear ethical framework for using them.

What ABA Formal Opinion 512 actually covers

Formal Opinion 512, issued July 29, 2024, doesn't invent new rules for AI. Instead, it walks through the existing Model Rules of Professional Conduct and explains how each one applies when a lawyer uses generative AI tools. That's a deliberate choice — it means firms don't need to wait for AI-specific legislation to know where they stand; the applicable rules already exist, and the opinion clarifies how to read them in this context.

The opinion covers seven areas directly relevant to firms adopting AI: competence, confidentiality, communication with clients, meritorious claims, candor to the tribunal, supervision of AI use across the firm, and fees.

Confidentiality: the section that matters most

Rule 1.6 requires lawyers to make "reasonable efforts" to prevent unauthorized disclosure of client information. Opinion 512 applies this directly to AI: a lawyer must ensure adequate safeguards exist for any client data processed by a generative AI tool, and — notably — the opinion suggests that generic "we may use AI" language buried in a standard engagement letter isn't necessarily enough. Specific, informed client consent may be needed depending on how sensitive the matter and the AI tool's data handling are.

In practice, this means a firm needs to know, tool by tool: does the vendor use client data to train its models? Where is the data stored? Who can access the prompts and outputs? These are the same questions any business should ask before using AI with sensitive data — see our full AI vendor security checklist — but for a law firm, the stakes attach directly to a professional-conduct rule, not just a general best practice.

Competence: understanding the tool you're using

Rule 1.1 requires lawyers to provide competent representation, and Opinion 512 extends that to mean understanding "the capacity and limitations" of any generative AI tool used in the matter — and keeping that understanding current, since the tools change quickly. This doesn't mean every lawyer needs to understand how a language model works internally. It means knowing, at minimum, what the tool is good at, where it tends to make mistakes (fabricated citations being the most cited example), and when a task calls for the tool versus a human associate.

Candor to the tribunal: checking AI output before it's filed

Rules 3.3 and 8.4(c) require honesty with courts and prohibit dishonest conduct. Opinion 512 applies these to a specific, well-documented failure mode: generative AI tools sometimes produce confident-sounding but fabricated case citations or legal propositions — commonly called hallucinations. The opinion is direct about where responsibility sits: the lawyer must review AI output for accuracy before it's filed, and a fabricated citation reaching a court is the lawyer's error, not a defense based on the tool's mistake.

This is the legal-industry version of a rule that shows up across every regulated field using AI: a human reviews the output before it reaches someone outside the firm. See our guide on human review for AI-generated content for how to build that check into a workflow without slowing everything down.

Supervision: a firm-wide policy, not an individual choice

Rules 5.1 and 5.3 place responsibility on managing lawyers to supervise both lawyers and nonlawyer staff — and Opinion 512 extends that supervisory duty to AI use specifically. That means a firm needs a written AI policy covering which tools are approved, what can and can't go into them, and who's accountable for reviewing output — not an informal understanding that "everyone knows to be careful." Our AI acceptable use policy guide has an adaptable starter template; a firm's version should add the confidentiality-consent language Opinion 512 discusses.

Fees: what you can and can't charge for AI use

Opinion 512 also addresses billing directly. A lawyer generally can't charge a client for the time spent learning to use an AI tool as part of general technology competence — that's treated like learning any other piece of standard practice software. Learning a tool specifically because a client requested it, though, can be billable if disclosed. Beyond that, the actual cost of an AI tool can either be absorbed as a firm overhead expense or passed through per-use, provided the client has been told about it and agreed to the arrangement in advance.

Paralegals, associates, and nonlawyer staff

Opinion 512's supervision requirement, under Rules 5.1 and 5.3, doesn't stop at the attorneys who use AI directly. Paralegals drafting summaries, legal assistants doing first-pass research, and administrative staff drafting client correspondence all fall under the same supervisory umbrella — meaning the firm's AI policy needs to reach every person who touches client matters, not only the attorneys of record. A common gap shows up here: firms write a careful AI policy for attorneys and never formally extend it to support staff, even though support staff are often the ones doing the actual drafting and summarizing work day to day.

A short, role-specific training session for nonlawyer staff — covering which tools are approved, what client information can and can't go into them, and who reviews their output before it reaches an attorney — closes this gap without requiring a full rewrite of the firm's ethics training.

A reasonable starting point for a small or mid-sized firm

None of this requires a firm-wide AI committee or months of preparation before a single lawyer can use a drafting tool responsibly. A workable starting point looks like: pick one approved AI tool with acceptable confidentiality terms, write a short policy addressing the seven areas above in plain language, brief every lawyer and staff member on it directly, and name one partner or administrator to field questions and update it as the firm's use of AI grows. That's enough to move from an informal, ungoverned use of AI to something a bar association reviewing the firm's practices would recognize as a genuine, good-faith effort at compliance.

Common mistakes

• Relying on generic engagement-letter language. Opinion 512 points toward specific, informed consent for AI use in matters where it's material — not a one-line disclaimer buried in the fine print.
• Skipping citation checks because the draft "reads well." Fluent, confident AI output is exactly what makes fabricated citations easy to miss without a deliberate verification step.
• Leaving nonlawyer staff out of the policy. Rule 5.3's supervisory duty covers paralegals and administrative staff using AI tools, not just attorneys.
• Billing clients for basic AI literacy. That crosses into the kind of general-competence cost Opinion 512 says shouldn't be passed on to the client.

This guide is general information, not legal advice. Have a qualified attorney review any policy before you adopt it.