AI use policy template: Legal edition

1. Purpose

This policy says what artificial intelligence (AI) tools may and may not be used for at [Company name]. It exists so that everyone on the team makes the same call, and so that a client, insurer or regulator who asks gets one clear answer.

The policy is organized around the duties in ABA Formal Opinion 512: competence, confidentiality, communication, candor to the tribunal, supervision and fees. Each section names the duty it serves.

2. Scope

• This policy applies to every lawyer, paralegal, clerk, intern and staff member at [Firm name], and every contractor who works on a client matter.
• It covers every AI tool: chat assistants such as ChatGPT, Claude, Copilot and Gemini, AI features inside software we already use, and any tool with AI in it that a team member signs up for.
• It covers work done on company devices and on personal devices when the work is for [Company name].
• It covers research, drafting, document review, client communications, billing and marketing.

3. Confidentiality (Rule 1.6)

• Client confidential information goes only into tools approved for it, where the vendor's terms confirm that inputs are not used to train models and are not reviewed by vendor staff. Approved tools are listed at [Location].
• Before a client's information enters any AI tool, the responsible lawyer confirms the tool is approved for that use. Where the tool is self-learning or the vendor's terms are unclear, informed client consent is obtained first and recorded in the file.
• Consumer accounts on general-purpose assistants are never used for client work.

4. What AI may touch

• First drafts of routine documents, correspondence and internal memos, with the human review below.
• Summaries and outlines of documents the firm already holds, inside an approved tool.
• Legal research as a starting point, never as the end point: every authority is verified under the citation protocol below.
• Firm administration, marketing text and public-facing content that contains no client information.
• [Add or remove lines to fit the practice]

5. What AI may never touch

• Client confidential information in any tool that is not approved for it.
• Privileged material in a tool whose terms allow vendor access or training.
• A filing, an opinion or advice that no lawyer has read in full.
• Billing: the firm bills the time actually spent, not the time the tool saved (Rule 1.5). Tool costs are passed on only as disclosed in the engagement letter.
• Decisions about a client's matter made by the tool alone.
• [Add any category a court order, client guideline or bar rule in your jurisdiction restricts]

6. Citation verification protocol (Rule 3.3)

• Every authority in a document that AI helped draft is opened in [Westlaw, Lexis or the court's own site] and read by the responsible lawyer before filing. The check confirms the case exists, says what the draft says it says, and is still good law.
• The person who verified each citation initials the verification sheet at [Location], which is kept with the matter.
• Before filing in any court, the responsible lawyer checks that court's standing order on AI use and disclosure and complies with it.
• A citation that cannot be verified is removed, never left in.

7. Approval of new tools

• [Managing partner or named lawyer] approves every new AI tool before anyone uses it for company work. Trying a tool with company or customer data counts as using it.
• Before approval, we check: where the tool stores what we type; whether our inputs train the vendor's models; who at the vendor can see our data; how we delete it; what it costs per month and per seat.
• For any tool that will see client information: written confirmation from the vendor's terms that inputs do not train models and that vendor staff do not review them.
• The list of approved tools, and what each one is approved for, lives at [Location of the approved tools list].

8. Human review

• A person checks every AI-written document before it goes to a client, customer, regulator or the public. The person who sends it is responsible for it, not the tool.
• AI output is a draft. We do not send an answer we have not read from start to finish.
• Facts, figures, names, dates and quotations in AI output are checked against the source before they go out.
• A lawyer reviews every document, filing and piece of advice that AI helped produce, applying the same judgment as if an associate had drafted it.

9. Supervision (Rules 5.1 and 5.3)

• [Name of supervising lawyer] is responsible for AI use by lawyers under Rule 5.1 and by non-lawyer staff under Rule 5.3, including contractors.
• Staff may use only the approved tools, for the approved uses, and raise any uncertainty with the supervising lawyer before proceeding.
• Supervision is recorded in the review and verification sheets, not assumed.

10. Records

• When AI helped write something we sent out, we note which tool was used, what we gave it, and who checked the result. The record lives at [Location of the AI use log].
• Records are kept for [12] months, or longer if a contract or regulator requires it.
• The matter file notes which AI tool assisted with which document, and holds the citation verification sheet.

11. Vendor terms

• Before a tool is approved, [Name or role] reads its terms for four things: whether our inputs train the vendor's models; how long the vendor keeps our data; where that data is stored; and who owns the output.
• Where a vendor offers a setting that stops training on our inputs, it is switched on before the tool is used, and the setting is checked every [3] months.
• Terms are re-read every [12] months and whenever the vendor announces a change.
• For each approved tool, the firm keeps a copy of the terms relied on for confidentiality, with the date, at [Location].

12. Engagement letter line

Our engagement letter includes a line such as the following, adjusted to the firm's practice:

• "[Firm name] uses artificial intelligence tools to assist with drafting, research and document review. A lawyer reviews all work before it is relied on or sent. We do not enter your confidential information into tools that use it for training or that allow outside access. [Any tool charges passed on to you are listed in the fee section.] Ask us at any time which tools we use on your matter."

13. Training

• Every team member reads this policy when they join and again once a year, and confirms in writing that they have.
• [Name or role] runs a short session on safe AI use at least once a year: what the tools do with what we type, how to check an answer, and what never goes into a chat window.
• Training covers Formal Opinion 512, the firm's approved tools, the citation protocol, and the standing orders of the courts the firm appears before.

14. Review date

• This policy is reviewed on [Review date], and sooner after any incident, any new tool, or any change in the law or in a client's requirements.
• The review checks that the approved tools list is current, that the records are being kept, and that the training has happened.

15. Sign-off

• Owner of this policy: [Name, role]
• Approved by: [Name, role]
• Date approved: [Date]
• Version: [1.0]
• Next review: [Review date]