Law Firm AI Use Policy

A working template for adopting generative AI in a US law firm without a Bar complaint, a sanctions order, or a malpractice letter. Comprehensive. Customizable. Free.

SEC_01Definitions

For purposes of this Policy:

• "AI" or "Generative AI" means any software system that produces novel text, images, code, or other content in response to user prompts, including (but not limited to) large language models (LLMs), retrieval-augmented generation (RAG) systems, multimodal models, and AI agents. This Policy applies regardless of whether the AI is presented as "AI," "automation," "smart assistant," or any other label.
• "Public AI" means a Generative AI tool offered to the general public on standard consumer terms, where inputs may be (i) retained by the vendor, (ii) used to train or improve the vendor's models, or (iii) accessible to the vendor's personnel. Examples: free-tier ChatGPT, free-tier Claude, free-tier Gemini, Microsoft Copilot personal.
• "Enterprise AI" means a Generative AI tool offered under a contractual agreement that (i) prohibits the vendor from training on customer data, (ii) imposes a defined data retention period, (iii) provides for data deletion on demand, and (iv) is supported by a Data Processing Agreement (DPA) and security addendum. Examples: ChatGPT Enterprise, Claude for Enterprise, Microsoft 365 Copilot under enterprise license, Google Workspace AI under EDU/Enterprise license.
• "Legal-Specialized AI" means an Enterprise AI tool designed and marketed primarily for legal practice, with features such as integrated citation verification, jurisdiction awareness, and matter-aware retrieval. Examples: Harvey, Thomson Reuters CoCounsel, LexisNexis Protégé / Lexis+ AI, Spellbook, Casetext.
• "Local-First AI" means a Generative AI tool that processes data primarily on hardware controlled by the Firm or by the responsible attorney, where outbound transmission to a third party is limited to model inference calls under a no-retention contract. The case file itself never leaves the Firm's perimeter.
• "Client Confidential Information" has the meaning given in Rule 1.6 of the applicable Rules of Professional Conduct and includes all information relating to the representation of a client, regardless of source, whether or not labeled as confidential and whether or not the client has expressly designated it as such.
• "Output" means any content generated by a Generative AI tool, whether text, citation, summary, draft, table, image, or otherwise.

SEC_02Scope & Applicability

This Policy applies to:

1. All attorneys, of counsel, contract attorneys, paralegals, secretaries, IT staff, marketing personnel, and any other personnel of [FIRM].
2. All independent contractors, vendors, and outsourced service providers performing work for the Firm or its clients.
3. All Firm-issued devices and any personally-owned device used to access Firm systems or Client Confidential Information ("BYOD").
4. All work performed on behalf of any client of the Firm, regardless of practice area, jurisdiction, or matter.
5. All non-client work performed using AI in connection with Firm operations (marketing, business development, knowledge management, internal communications, hiring, etc.).

This Policy applies to AI use that occurs on Firm-licensed tools and AI use that occurs on personal accounts ("Shadow AI"). The fact that an attorney uses a personal ChatGPT account or a personal Claude account does not exempt that use from this Policy.

SEC_03Foundational Principles

This Policy is grounded in six principles. Every other section of this Policy is an operationalization of one or more of these principles:

1. The attorney is the final checkpoint. AI does not practice law. AI does not sign briefs. The attorney who signs is responsible for every assertion under Rule 11, Rule 1.1, and inherent judicial authority. "I relied on AI" is not a defense; it is an aggravating factor. See ABA Formal Op. 512, at 10-11; Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023).
2. Confidentiality is the default; AI use is the exception. Under Rule 1.6, the duty to preserve confidentiality applies to all information relating to the representation, whether or not the client has marked it confidential. ABA Op. 512 confirms this duty extends to information input into a GAI tool. The lawful use of AI requires affirmative analysis of where data goes — not silence.
3. Tool category determines what data may be used. A tool that retains and trains on inputs is architecturally unsuited for privileged data. A tool that does neither, under contract, may be used for privileged data with informed consent. The decision is technical, not aspirational.
4. Verification is non-delegable. Every citation, every quotation, every assertion of fact derived from AI must be independently verified against a primary source. The verification protocol is set forth in Section 8.
5. Disclosure is owed to clients and to courts. ABA Op. 512 §§ 36-44 require informed consent for material AI use. Federal courts in 90+ districts have standing orders requiring disclosure. The default presumption is: disclose.
6. The Firm bears institutional responsibility under Rule 5.3. Vendor AI is non-lawyer assistance. Under Rule 5.3, the Firm must take reasonable measures to ensure that the conduct of any non-lawyer (including AI vendors) is compatible with the lawyer's professional obligations. See ABA Op. 512 §§ 50-58.

SEC_04Data Classification

Before any AI tool is used on any data, the user must classify the data. The classification controls which tool category may be used.

When in doubt, classify upward. A user who is unsure whether information is D-2 or D-3 must treat it as D-3.

SEC_05Tool Classification & Approved Vendors

The Firm classifies all AI tools into one of four tiers. Each tier corresponds to the maximum data classification with which the tool may be used.

Approved Vendor Register

The IT department maintains the Firm's authoritative Approved Vendor Register at [INTERNAL_URL]. Use of any AI tool not listed in the Register is prohibited. The Register is reviewed quarterly by the AI Steering Committee (Section 16).

Adding a tool to the Register requires:

1. A written request from a partner identifying the proposed use case.
2. IT review of the vendor's current TOS, DPA, and security addendum (use the Knight CTO Vendor Evaluation Checklist or equivalent).
3. Formal Tier classification by the AI Steering Committee.
4. Execution of the required contractual controls.
5. Documentation in the Register of: vendor, tool name, version, Tier, max data class, contract effective dates, and IT contact.

SEC_06Approved Use Cases by Data Class

The following matrix governs whether a given combination of data class and tool tier is permitted. Where the cell reads "Permitted with Conditions," the conditions in Section 8 (Verification) and, where applicable, Section 10 (Client Disclosure) apply in full.

Conditions for D-3 / D-4 use

1. Informed client consent. Per ABA Op. 512 § 35: "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient." Use Section 10 language.
2. Pseudonymization where feasible. Where the AI use does not require client identifiers (e.g., a doctrinal research query, a stylistic edit), the user must replace party names, witness names, account numbers, addresses, and other direct identifiers with neutral placeholders before submission.
3. Verification per Section 8. Every assertion derived from the Output must be independently verified.
4. Audit log entry per Section 14.
5. For D-4: documented written approval of the responsible Partner before the use, attached to the matter file.

SEC_07Prohibited Uses

The following are prohibited at all tiers, on all data, by all personnel, with no exception:

1. Submitting a brief, motion, declaration, or other court filing without independent verification of every citation against a primary source (Westlaw, Lexis, Bloomberg Law, the court's own docket, or the official reporter).
2. Representing AI-generated text as the original work of a lawyer or as the lawyer's own thinking, in any context where the audience would reasonably expect lawyer-original content (court filings, expert reports, sworn declarations).
3. Inputting Client Confidential Information (D-3 or D-4) into any tool classified T-X (free consumer AI).
4. Inputting D-4 information into any tool not classified T-3 without prior written Partner approval.
5. Using AI to draft, review, or analyze a matter for which the user has not been formally assigned, even where the user has technical access to the file.
6. Using AI to generate fabricated communications attributed to identifiable third parties (witnesses, opposing counsel, judges, clients), including for "training" or "demo" purposes.
7. Using AI to circumvent any restriction in a protective order, sealing order, NDA, or court-imposed limitation.
8. Using AI for any task subject to a client-specific AI restriction in the engagement letter or separate written instruction from the client. The Firm maintains a per-client AI restriction register at [INTERNAL_URL]; check it before any AI use on a client matter.
9. Using AI to evaluate, score, or screen candidates for hiring (lawyers or staff) without prior approval of the hiring partner and the General Counsel of the Firm. EEOC enforcement guidance treats automated employment decision tools as a regulated category.
10. Bypassing the verification protocol (Section 8) in the interest of speed.

SEC_08Verification & Citation Protocol

For any AI Output that will be (i) included in a court filing, (ii) included in a written legal opinion to a client, (iii) included in a transactional document, or (iv) relied upon for any legal advice given to a client, the responsible attorney must complete the four-step verification protocol below:

STEP 01 · Source verification

For every citation in the Output, retrieve the cited authority from a primary source — Westlaw, LexisNexis, Bloomberg Law, the court's own opinion (PACER, Westlaw, Lexis, the court's website), or the official reporter. Do not verify a citation by asking the same AI tool to confirm it. Schwartz did this in Mata; ChatGPT confirmed the cases existed; the cases did not exist; sanctions issued. See Appendix C, row 1.

STEP 02 · Pinpoint verification

For every quotation in the Output, retrieve the actual text from the cited source and confirm it matches verbatim. AI tools paraphrase liberally and present paraphrases as direct quotations. The 2026 Cassata v. Macrina sanctions order in NY explicitly addressed paraphrase-presented-as-quotation as a Rule 11 violation. See Appendix C.

STEP 03 · Holding verification

For every proposition for which a case is cited, read the cited portion of the case and confirm that the case actually stands for the proposition asserted. AI tools regularly cite real cases for propositions the cases reject. The standard is the same standard applied to junior associate work: would a competent attorney be willing to defend this characterization in front of the cited court?

STEP 04 · Documentation

Document the verification in the matter file. At minimum: (i) tool used, (ii) date and time, (iii) user, (iv) general description of the prompt (do not reproduce confidential prompt text in unsecured logs), (v) for each cited authority, the verification source consulted. Use the audit log template in Section 14.

SEC_09Court Disclosure

As of April 2026, more than 300 federal judges and dozens of state-court judges have issued standing orders or local rules requiring disclosure of AI use in court filings. The orders vary materially. The user is responsible for determining the rule of the specific judge and court before any filing.

The Firm's IT department maintains an internal cross-reference at [INTERNAL_URL]. The cross-reference is best-effort; the canonical source is the judge's chambers and the court's local rules.

Default disclosure language

Where a court requires disclosure but does not prescribe the form, the following language is acceptable to most US courts that have addressed the issue (modeled on Judge Nina Y. Wang, D. Colo., effective Dec. 1, 2025):

Where disclosure is not required

Even where a court has no standing order, default to disclosure when (i) the AI use was material to the substantive content of the filing, (ii) the filing contains a representation of original analysis, or (iii) the lawyer would consider disclosure if asked.

SEC_10Client Disclosure & Engagement Letter Language

ABA Op. 512 distinguishes between AI uses that are routine and require no client-specific disclosure (e.g., grammar-check on internal emails, AI-assisted document indexing) and AI uses that require informed consent under Rules 1.4 and 1.6.

Informed consent is required where the AI use will involve (a) input of D-3 or D-4 data, (b) AI-generated work product delivered to the client as the lawyer's original work, or (c) AI use that would materially affect the client's evaluation of the lawyer's work. Boilerplate consent in the engagement letter is insufficient. ABA Op. 512 § 35.

Recommended engagement letter language (2026)

Insert the following as a standalone section of the engagement letter. Client must initial the section. The Firm maintains a separate, matter-specific written consent for any AI use that exceeds the scope of the general consent.

For matters with elevated risk

For matters involving D-4 data, regulated industries (healthcare, finance, defense, public sector), or sophisticated clients with their own AI procurement standards, use a separate written AI-use addendum that specifies the tools, the categories of data, the verification protocol, and the data-retention terms.

SEC_11Supervisory Responsibility (Rule 5.3)

Under Rule 5.3, partners and supervisory attorneys are responsible for ensuring that the conduct of any non-lawyer assistant — including a generative AI tool used by an associate, paralegal, or contract attorney — is compatible with the lawyer's professional obligations.

This means:

1. The supervising partner is personally exposed to discipline for AI errors in work product the partner signs. See ABA Op. 512 §§ 50-58; Smith v. Farwell, 2024 WL 668533 (Mass. Super. Feb. 12, 2024) (supervising lawyer fined $2,000 for associate's AI hallucinations); Lacey v. State Farm, No. 2:22-cv-09438 (C.D. Cal. May 6, 2025) ($31,100 against firms jointly).
2. "I did not know my associate used AI" is generally not a defense. The Fletcher v. Experian opinion (5th Cir. Feb. 2026) explicitly rejected this argument.
3. Each supervising partner must (i) confirm in writing each quarter that the associates and staff under their supervision have completed required AI training (Section 12), (ii) review at least one AI-assisted work product per quarter for compliance with this Policy, and (iii) report any non-compliance to the AI Steering Committee within 7 days.

SEC_12Training Requirements

The Firm requires three tiers of mandatory AI training. No personnel may use any AI tool on Firm work until the applicable training has been completed and certified by [ROLE: e.g., the Director of Legal Operations].

SEC_13Incident Reporting

An "AI Incident" includes any of the following:

• Inadvertent input of Client Confidential Information into a prohibited tool.
• Discovery, in a filed document or document delivered to a client, of a fabricated citation, fabricated quotation, or factual assertion derived from AI without verification.
• Discovery that an associate, paralegal, or staff member has been using AI in violation of this Policy.
• Vendor notification of a security incident, data breach, or unauthorized access affecting an approved AI tool.
• Notification from a court, opposing counsel, or a client of suspected AI-generated material in Firm work product.

Any AI Incident must be reported to the Firm's General Counsel and to the AI Steering Committee within 24 hours of discovery, regardless of whether the user believes the incident is material. Failure to report promptly is itself a violation of this Policy.

Containment protocol (first hour)

1. Stop the offending use immediately.
2. Preserve all evidence: the prompt, the Output, the file as it stood at time of submission, browser history, account logs.
3. Do not delete, edit, or "clean up" any artifact. Spoliation aggravates every kind of sanctions analysis.
4. Notify General Counsel by phone (not email).
5. If a court filing is implicated, draft a Rule 11 corrective notice for review by General Counsel within 24 hours.
6. If a client may have been delivered AI-generated material in violation of this Policy, do not communicate further with the client about the matter until General Counsel has approved a disclosure plan.

SEC_14Audit Trail & Record-keeping

For every AI use on a client matter (D-3 or D-4), the user must create an entry in the Firm's AI audit log. Use the matter management system field labeled [FIELD_NAME] or, if unavailable, the standalone audit-log template at [INTERNAL_URL].

Each entry must include:

1. Date and time (ISO 8601, including time zone).
2. User (timekeeper ID).
3. Matter ID.
4. AI tool name and Tier classification.
5. Data class submitted (D-1 / D-2 / D-3 / D-4).
6. Whether identifying information was pseudonymized (Y/N).
7. General description of the task (one line — not the prompt text).
8. Verification steps completed (Step 01 / 02 / 03 / 04 of Section 8).
9. Whether Output was used in a client deliverable, court filing, or internal-only.

The audit log is retained for the longer of (i) seven years from the date of the entry, (ii) the period of any applicable client document-retention obligation, or (iii) the limitations period for any cause of action arising out of the matter.

SEC_15Billing & Fees (Rule 1.5)

Per ABA Op. 512 §§ 65-79 and the State Bar of California Practical Guidance (Nov. 2024):

1. Lawyers may not bill a client for time saved by AI use. If a task that would have taken 4 hours takes 30 minutes due to AI assistance, the bill reflects 30 minutes plus reasonable verification time.
2. Lawyers may not bill a client for time spent learning how to use an AI tool, except where the learning is matter-specific.
3. Lawyers may charge the actual, documented cost of a matter-specific AI service as a disbursement, after disclosure to the client. The cost of general-purpose AI tools used across many matters is overhead.
4. Where the Firm uses a flat fee or contingent fee, AI efficiency does not reduce the fee, but the lawyer must be able to demonstrate that the fee remains reasonable in light of the actual time and effort expended.

SEC_16Policy Review & Revision

AI Steering Committee

The Firm's AI Steering Committee comprises: [NAMES OR ROLES] — at minimum, one Managing Partner, the Director of IT (or equivalent), the Firm's General Counsel (or ethics counsel), and one practice-group leader. The Committee meets quarterly.

Quarterly review

• Q1: Review and update the Approved Vendor Register. Survey staff on Shadow AI use.
• Q2: Review new state-bar opinions and federal court standing orders. Update Sections 9 and 10 as needed.
• Q3: Sample 3% of AI-assisted work product. Audit verification documentation. Report findings to all partners.
• Q4: Annual policy refresh. Incorporate the year's lessons. Roll out updated training.

Emergency revision triggers

The Policy is revised between quarterly cycles upon: (i) issuance of a new ABA Formal Opinion on AI; (ii) issuance of an AI ethics opinion by the Firm's primary state bar(s); (iii) a new federal court standing order in a court the Firm regularly practices in; (iv) any AI Incident at the Firm; (v) any reported sanction in this Circuit involving AI; (vi) any material change in the TOS or DPA of an Approved Vendor.

SEC_17Acknowledgment Form

APX_AAppendix A — ABA Op. 512 Quick Reference

The American Bar Association Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512 on July 29, 2024 — its first ethics opinion specifically addressing generative AI in legal practice. Key holdings:

APX_BAppendix B — State Opinion Crosswalk

Selected state-bar guidance current as of April 2026. This crosswalk is informational only — verify against the current guidance of your state bar before relying on it.

APX_CAppendix C — 2025–2026 Sanctions Ledger (Selected)

Selected sanctions and discipline involving AI hallucinations in court filings. Drawn from the Damien Charlotin AI Hallucination Cases Database (1,294+ cases as of March 2026), Bloomberg Law, ABA Journal, and direct review of the cited orders. This list is illustrative — not exhaustive.

APX_DAppendix D — Vendor TOS Decoded

This appendix decodes selected clauses from the current public Terms of Service of three major vendors, accessed in April 2026. Vendor terms change frequently — verify against the current TOS before relying on this analysis. Direct quotations are in italics; the Firm's interpretation follows each.

Harvey (Platform Agreement, Last Updated Jan. 9, 2026)

What Harvey says it does with your data

Harvey's Platform Agreement provides: "You retain all right, title and interest (including any and all intellectual property rights) in and to the Customer Data. You grant to Harvey and its Affiliates a non-exclusive, worldwide, royalty-free right to process the Customer Data and Your Input to the extent necessary to provide the Service to You or Your Affiliates, to prevent or address service or technical problems with the Service, or as may be required by applicable law."

Knight CTO interpretation: The license is broad on its face but narrowly tied to "providing the Service." This is appropriate. Combined with Harvey's separately-stated "no training on customer data" commitment in their public materials and DPA, the contractual posture is acceptable for D-3 use. Confirm the no-training language is in your executed DPA, not just the public marketing page.

Liability cap that nobody reads

Harvey's Platform Agreement caps data-breach liability at "the greater of (x) two times the amount actually paid or payable to Harvey by You in the prior 12 months relating to Your use of the Service or (y) $500,000" — described as the "Data Breach Cap."

Knight CTO interpretation: $500,000 is materially less than the typical insurance recovery floor for a privileged-data breach affecting a meaningful matter. For a 50-attorney firm paying ~$700K/year, the cap is $1.4M. For a small firm paying ~$15K/year, the cap is $500K. Consider negotiating the Data Breach Cap upward, or confirming your malpractice carrier covers the gap.

Retention

Per Harvey's "Understanding Retention Policies" support article: "Workspace retention can be customized anywhere from 3 hours after the data is processed by Harvey to 30 days after your agreement with Harvey ends." Defaults to 30-day-after-termination deletion. Vault retention, custom workflows, and matter numbers are retained independently of workspace retention.

Knight CTO interpretation: The Vault and custom-workflow retention exceptions are easily overlooked and survive workspace deletion. Audit which features are in use. Set the workspace retention to the minimum compatible with the Firm's working style — 7 days is usually adequate.

Update mechanism

Harvey reserves the right to update the Terms unilaterally, but only with the following protection: "in no event may Harvey update such Terms in a way that detracts from its obligations as agreed to in this Agreement with respect to Confidential Information, Customer Data, Customer Content, or security, without express written authorization from You."

Knight CTO interpretation: Best-in-class. The lock-in on data and security terms is unusual and protective. Make sure your executed agreement does not waive this.

Thomson Reuters CoCounsel

Thomson Reuters publishes a "CoCounsel Drafting security and privacy" video and a separate Security Addendum but does not publish a single canonical TOS-decoded statement equivalent to Harvey's. Material terms are in the executed Master Service Agreement.

Required diligence before using CoCounsel for D-3:

1. Confirm the executed agreement contains a "no training on customer data" clause.
2. Confirm SOC 2 Type 2 certification is current (request the current report; do not rely on a logo).
3. Confirm the data residency clause if your client matter has jurisdictional restrictions.
4. Confirm the data-breach notification timeline.
5. Confirm what Thomson Reuters does with prompts and outputs after the session ends — and after termination.
6. Confirm whether CoCounsel's underlying model providers (which include OpenAI in the legacy Casetext-derived stack) inherit your no-training protection.

The Lacey v. State Farm precedent (C.D. Cal. May 2025): A team using CoCounsel + Westlaw Precision + Gemini received $31,100 in sanctions. The court did not hold that the tools were defective; it held that the lawyers' verification protocol was inadequate. Use of a Tier-2 tool does not eliminate verification responsibility under Section 8.

OpenAI ChatGPT (Consumer Free Tier)

OpenAI's consumer Terms of Service govern use of the free and Plus tiers of ChatGPT. The relevant clauses for legal practice:

• OpenAI may use inputs and outputs to train its models unless the user opts out. The opt-out is accessible in user settings; it is not the default.
• OpenAI personnel may access prompts for safety review.
• Liability is capped at the greater of $100 or the amount paid to OpenAI in the 12 months preceding the claim — i.e., effectively $100 for free users, $240 for Plus users.
• No DPA, no Business Associate Agreement, no SOC 2 commitment in the consumer terms.

Knight CTO interpretation: The consumer ChatGPT tier is architecturally and contractually unsuited for any data above D-1. ChatGPT Enterprise is a different product with materially different terms (no training, DPA, SOC 2, BAA available). Do not conflate the two.

The recurring "model improvement" trap

Multiple legal-AI vendors include language that sounds protective but is not:

• "We do not use your data to train our foundation models" — does not preclude use to train fine-tuned models, retrieval indexes, or "service improvement" models.
• "Your data is encrypted in transit and at rest" — addresses transport security but not access controls within the vendor.
• "We are SOC 2 compliant" — refers to a specific audit scope; the audited controls may not include the AI model serving infrastructure.
• "Your data stays in [region]" — may apply only to storage, not to inference compute.

Read the executed agreement, not the marketing page. The Knight CTO Vendor Evaluation Checklist (RES_02) provides a structured 60-question framework for this analysis.