How to Write a Law Firm AI Use Policy: What to Include, With a Sample Policy

Who the Policy Covers

Everyone who touches client work: partners, associates, paralegals, assistants, interns, contract lawyers, and outsourced providers such as legal process outsourcing teams. Vendors should agree to follow your policy, or show you that theirs is at least as strict, before they see any client file.

1. Approved Tools

Name the tools people may use for client work, and the accounts they must use. Personal and free consumer accounts should be off limits for anything involving client information. Before approving a tool, confirm its terms: whether your data is used for training, how long it is retained, who at the provider can access it, where it is stored, and whether you can delete it.

2. What Information May Go Into Which Tool

A simple classification makes the rules easy to follow:

• Public information, such as statutes, published cases and public filings: any approved tool.
• Firm information with no client data, such as templates and marketing: any approved tool.
• Client confidential information: only tools on business plans whose terms exclude training, and only where the client has been told or has consented as required.
• Highly sensitive information, such as medical records, financial account details, trade secrets, sealed material and anything under a protective order: only tools specifically approved for it, or not at all.

3. Telling Clients and Getting Consent

State when the firm tells clients about AI use and when it obtains informed consent. Opinion 512 says informed consent is required before entering client information into self-learning tools, and that boilerplate engagement-letter language is not enough. Many firms describe their AI use specifically in the engagement letter and follow any client instructions, including outside counsel guidelines that restrict or forbid AI.

4. Verification

This is the most important clause. Every AI output used in client work must be reviewed by a person qualified to judge it. Every citation must be pulled and read, every quotation checked against its source, and every factual statement checked against the record. The person who signs or sends the work is responsible for it, however it was drafted.

5. Courts and Disclosure

Require lawyers to check the local rules, standing orders and judges' individual practices for any requirement to disclose or certify AI use, and to comply with them. Make one person responsible for keeping a list for the courts the firm appears in most.

6. Billing

Record actual time, including prompting and review, and never bill time saved. Decide which kinds of work the firm prices at a flat fee, and state that general AI subscriptions are overhead, with any matter-specific tool costs passed on only at actual cost and with prior disclosure.

7. Training, Accountability and Incidents

Train everyone before they use AI on client work, and again when the tools or the policy change. Name a person who approves tools, answers questions and keeps the policy current. Say what to do if something goes wrong, such as client information entered into an unapproved tool or an error found after filing: report it at once, so the firm can assess its notification and correction duties.

Sample Policy Clauses

Adapt these to your firm; they are a starting point, not a substitute for advice on your jurisdiction's rules.

• "Firm personnel may use generative AI for client work only in tools listed in Appendix A, and only through firm-managed accounts."
• "Client confidential information may not be entered into any AI tool unless the tool is approved for that category of information and the client has been informed or has consented as required by the engagement letter."
• "No AI output may be filed, served or sent to a client or third party until a lawyer has reviewed it. All citations must be independently located, read and verified."
• "Lawyers must comply with all court rules and orders on the disclosure or certification of AI use."
• "Time entries must reflect time actually spent. Time saved through the use of AI may not be billed."
• "Contractors and outsourced providers must agree in writing to comply with this policy before receiving client information."
• "Any suspected misuse of an AI tool or disclosure of client information must be reported immediately to [name]."
• "This policy will be reviewed at least every twelve months."

Working With Prodigy LPO Under Your Policy

We follow your firm's AI policy on every matter: we use only the tools you approve, keep your files in your systems where we can, sign your NDA before we see anything, and have a lawyer verify every citation and fact before work comes back to you. If you do not have a policy yet, we can help you draft one as part of our legal AI systems work.