General guidance, not legal advice
This guide explains published ethics guidance and offers sample policy language. It is not legal advice and does not create any professional relationship. Rules differ by state and change often.
Have your own counsel review the policy and every form before you adopt it.
This guide is independent. It is not published, endorsed, or reviewed by the ABA, the State Bar of Arizona, or any court.
About this guide
This guide has two parts:
The Staff Rule Sheet. One page. Post it, hand it out, and train on it.
The AI Use Policy. A fill-in-the-blank policy plus three short forms: a staff acknowledgment, an approved tools list, and an incident log.
Fill in every [BRACKETED] blank before you adopt it. Delete any option you don't use.
You may copy and adapt this policy and its forms for use inside your own firm. Quotes from ABA Formal Opinion 512 and the State Bar of Arizona are exact, with citations. All other wording is original.
How to read the template text
Text in [highlighted brackets] is for you to fill in or choose. Delete any option you don't use.
Counsel check boxes mark places where the right answer depends on your state. Have your counsel look at these first.
About the author
Rocco Colasacco is a U.S. Army veteran with a Bachelor of Science in Electronic Engineering Technology. He has worked for some of the country's top automotive, defense, and aerospace companies. In that world, systems have to work the first time, and nothing ships until someone has checked it.
Today he brings that same discipline to small law firms. He builds AI legal assistants and medical chronology software that run under your firm's own AI account, so he never sees your files, and that trace every answer back to its source. This policy is the same approach in writing: approved tools, clear data rules, and a check before anything leaves the building. Learn more at roccocolasacco.com.
Part 1. Staff Rule Sheet
[FIRM NAME] — AI Rules for Everyone | Questions? Ask [AI LEAD NAME].
Do
Use only tools on the Approved Tools List. If a tool isn't on the list, ask before you use it.
Check every fact AI gives you against the source. That means dates of treatment, diagnoses, providers, bill amounts, policy limits, and quotes. Open the actual page.
Check every case and statute yourself. Pull it up and read it. AI invents cases that look real.
Tell the lawyer when AI helped. Before a lawyer signs or sends your work, say which parts AI touched.
Label AI drafts in the file. Put "AI-assisted draft" in the file name or the first line.
Report mistakes right away. If client information went somewhere it shouldn't, or an AI error got out the door, tell [AI LEAD NAME] the same day.
Ask first if you're unsure. A two-minute question beats a bad filing.
Don't
Don't put client information into a personal or free AI account. That includes names, accident facts, claim numbers, photos, and anything from a medical record. The rule holds even if you pay for the account yourself.
Don't upload medical records, bills, or Social Security numbers to any tool unless it's approved for that use and the client has signed the consent form.
Don't let AI talk to clients or callers unless the lawyer approves it and it tells people they're talking to AI.
Don't record or transcribe a client call with an AI tool unless the client knows and agrees first.
Don't send AI output to a client, insurer, opposing counsel, or court until a lawyer has reviewed it.
Don't treat AI as the final answer. AI drafts. People decide.
I have read these rules. Name: ______________________ Date: ____________
Part 2. AI Use Policy
[FIRM NAME] AI Use Policy
Version [1.0] | Adopted [DATE] | Owner: [AI LEAD NAME] | Next review: [DATE, NO MORE THAN 6 MONTHS OUT]
1. Purpose and scope
This policy sets the rules for using artificial intelligence (AI) at [FIRM NAME]. It protects our clients, our cases, and our licenses.
It applies to every attorney, paralegal, case manager, intake specialist, assistant, contractor, and temp at the firm. It covers:
standalone AI tools, such as chat assistants;
AI features built into software we already use, such as case management, document, email, research, and phone systems;
AI notetakers and call transcription;
any AI that talks to clients or callers, such as an intake chatbot or an AI receptionist;
personal AI accounts used for any firm work.
Why we have this policy: ABA Formal Opinion 512 says:
Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI, and supervisory lawyers must make reasonable efforts to ensure that the firm's lawyers and nonlawyers comply with their professional obligations when using GAI tools.
ABA Formal Op. 512, Part II.E, p. 10.
The State Bar of Arizona's guidance says the same:
Law firms, legal service organizations, in-house legal departments, and government legal professionals should establish clear AI policies, conduct training, and monitor generative AI usage among attorneys and support staff.
State Bar of Arizona, "Best Practices for Using Artificial Intelligence," the section beginning "Duty to Supervise."
Having this policy does not by itself satisfy anyone's ethical duties. Following it does.
2. Who is in charge
AI Lead: [NAME]. Keeps the Approved Tools List and the Incident Log, runs training, and answers questions.
Approving attorney: [NAME]. Approves new tools and changes to this policy.
In a firm our size, one person may hold both roles.
3. Approved tools
3.1 The list. We use only the tools on the Approved Tools List (Form B). The list says what each tool may be used for and what information may go into it.
3.2 Two kinds of tools.
Consumer tools are free or personal accounts, such as personal ChatGPT, Claude, Gemini, or Copilot accounts. These are for general questions only. They get no client information, ever.
Business tools are tools the firm has a signed agreement for. Before approval, the agreement must say the vendor does not train on our data, limits who can see it, protects it, and deletes it when we ask.
3.3 Before we approve a tool. The AI Lead reads the vendor's terms and privacy policy, or has someone qualified read them. ABA 512 says:
As a baseline, all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool or consult with a colleague or external expert who has read and analyzed those terms and policies.
ABA Formal Op. 512, Part II.B, p. 7.
The AI Lead also asks the vendor:
Do you train your AI on our data?
Who can see our data, and where is it stored?
Will you tell us if there is a breach, or if someone subpoenas our data?
Can we delete our data, and do you keep any copies after we leave?
Will you sign the health-privacy agreement our counsel says we need for medical records?
Get the answers in writing. A vendor's marketing page is not an answer.
3.4 New tools. To request a new tool, email the AI Lead with the tool's name, what you want to use it for, and what information would go into it. Don't use it until it's on the list.
4. Client information: what may go where
ABA 512 says:
Before lawyers input information relating to the representation of a client into a GAI tool, they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm.
ABA Formal Op. 512, Part II.B, p. 6.
In a PI case, almost everything is client information. We use four levels:
| Level | What it includes | Where it may go |
|---|---|---|
| 1. Public | Published cases and statutes, public court rules, general questions with no case facts | Any approved tool |
| 2. Firm internal | Firm templates, marketing drafts, internal procedures with no client details | Approved business tools |
| 3. Client information | Client names, accident facts, police reports, photos, claim numbers, insurer letters, case strategy | Approved business tools listed for Level 3 |
| 4. Sensitive | Medical records and bills, diagnoses, mental health and substance treatment records, Social Security and Medicare numbers, information about minors, settlement figures | Only approved business tools listed for Level 4, and only after the client signs written consent (Section 5) |
Rules that apply at every level:
Removing names is not enough. A date of loss, an intersection, and an injury can identify a client.
Use the smallest amount of information the task needs.
If you aren't sure which level something is, treat it as Level 4.
5. Telling clients and getting consent
5.1 Engagement letter notice. Our engagement letter tells every client that the firm uses AI tools under this policy. [Insert the firm's notice paragraph, or attach it.] The notice tells clients how we work. It is not consent.
5.2 Written consent before sensitive uses. We get the client's written, matter-specific consent before we put Level 4 information into any AI tool. That includes uploading medical records for a chronology or summary.
ABA 512 explains why a line in the engagement letter isn't enough:
To obtain informed consent when using a GAI tool, merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient.
ABA Formal Op. 512, Part II.B, p. 7.
ABA 512 also says what the client must be told:
For the consent to be informed, the client must have the lawyer's best judgment about why the GAI tool is being used, the extent of and specific information about the risk, including particulars about the kinds of client information that will be disclosed, the ways in which others might use the information against the client's interests, and a clear explanation of the GAI tool's benefits to the representation.
ABA Formal Op. 512, Part II.B, p. 7.
The consent form must say, in plain words:
which tool we will use and why;
what information will go into it;
the risks, and how we limit them;
that the client can say no, and that saying no won't hurt their case;
that the client can withdraw consent later.
5.3 Arizona guidance. The State Bar of Arizona says:
Clients should at a minimum be informed about, and preferably provide consent, to generative AI usage whenever it impacts their representation.
State Bar of Arizona, "Best Practices for Using Artificial Intelligence," section "Communication Regarding Generative AI Use."
5.4 Recording and notetakers. We never use AI to record or transcribe a client meeting or call without telling the client first and getting their consent. The State Bar of Arizona says:
If utilizing generative AI to record a client interaction, a legal professional must clearly inform and obtain consent from clients whenever the meeting will be recorded and how generative AI will process the recording.
State Bar of Arizona, "Best Practices for Using Artificial Intelligence," section "Communication Regarding Generative AI Use."
5.5 AI that talks to callers. Any AI that answers calls, texts, or web chats must say it is AI at the start. It may collect intake facts and book appointments. It may not give legal advice, predict case value, or say the firm accepts a case.
5.6 If a client asks. If a client asks whether we used AI on their case, we answer truthfully.
6. Checking AI work
6.1 The rule. AI output is a first draft. A person checks it against the source before anyone relies on it.
ABA 512 says:
a lawyer's reliance on, or submission of, a GAI tool's output—without an appropriate degree of independent verification or review of its output—could violate the duty to provide competent representation as required by Model Rule 1.1.
ABA Formal Op. 512, Part II.A, pp. 3-4.
6.2 What to check in PI work.
Medical chronologies and summaries: every date, provider, diagnosis, and treatment, checked against the page it came from. Watch for visits that were missed or made up.
Medical specials and liens: every bill amount and total, checked against the bills and lien letters.
Demand letters: every fact, injury, and dollar figure. Read the whole letter as if you were the adjuster.
Court filings: every case, statute, and quote. Read each one. Confirm it says what we say it says.
Letters and emails to clients: facts, dates, and tone. No promises about results.
6.3 Mark it. Note "AI-assisted" in the file name or the document. ABA 512 offers this "training suggestion":
all materials produced by GAI tools be marked as such when stored in any client or firm file so future users understand potential fallibility of the work.
ABA Formal Op. 512, Part II.E, n. 52.
7. Court filings
Before any filing, the signing attorney checks the current AI rules for that court and that judge. ABA 512 says:
Lawyers should consult with the applicable court's local rules to ensure that they comply with those rules with respect to AI use.
ABA Formal Op. 512, n. 47.
If a rule requires a disclosure or certification, we include it.
We note the check in the case file: court, judge, date checked, and what the rule requires.
Rules change. Check each time. Don't rely on what was true last month.
8. Supervision and signatures
The signing attorney owns the work. ABA 512 says:
regardless of the level of review the lawyer selects, the lawyer is fully responsible for the work on behalf of the client.
ABA Formal Op. 512, Part II.A, p. 4.
Staff tell the attorney. Anyone who used AI on a document tells the signing attorney before it is signed or sent.
AI doesn't make judgment calls. Case value, settlement advice, whether to take a case, and litigation strategy are decided by attorneys.
9. Costs and fees
We don't charge clients for time spent learning AI tools.
We don't charge for time spent fixing AI mistakes.
AI tools as case costs. We don't pass AI tool costs to a client as a case expense unless the client agreed in writing in advance. ABA 512 says:
To the extent a particular tool or service functions similarly to equipping and maintaining a legal practice, a lawyer should consider its cost to be overhead and not charge the client for its cost absent a contrary disclosure to the client in advance.
ABA Formal Op. 512, Part II.F, p. 13.
If we ever bill a matter hourly, we bill actual time only.
Counsel check
Confirm how these rules apply to our contingency fee agreements and closing statements in our state.
10. Training and acknowledgment
Everyone completes AI training before using any approved tool, and again each year.
Training covers this policy, the Approved Tools List, the data levels, how to check AI work, and how to report a problem.
Everyone signs the Staff Acknowledgment (Form A) before using AI for firm work, and again whenever this policy changes.
11. When something goes wrong
11.1 What counts. Client information went into a tool it shouldn't have. An AI error reached a client, insurer, opposing counsel, or court. A tool did something unexpected with our data.
11.2 Report it within 24 hours. Tell the AI Lead and the approving attorney. Don't try to fix it quietly. Speed matters more than blame.
11.3 What we do next.
Contain it. Stop using the tool for that matter. Delete what we can. Contact the vendor if needed.
Assess it. What information or error was involved? Who saw it? Which clients and cases are affected?
Correct it. If an error reached a court, the signing attorney promptly corrects the record and tells opposing counsel. If an error reached a client or insurer, we correct it in writing.
Tell who needs to know. The approving attorney decides, with counsel if needed, whether to notify the client, our malpractice carrier, or anyone else.
Log it. Record it in the Incident Log (Form C) and fix the cause.
12. Insurance
When we apply for or renew malpractice coverage, our answers about AI must match this policy and what we actually do. The approving attorney reviews those answers.
13. Review
The AI Lead reviews this policy and the Approved Tools List at least every six months, and whenever a tool, a vendor's terms, or a rule changes. Every change gets a new version number and date.
14. Breaking the policy
Breaking this policy may lead to discipline, up to and including termination. Reporting your own mistake quickly, in good faith, will be taken into account.
Counsel check
Confirm this wording under our state's employment law.
Part 3. Forms
Form A. Staff Acknowledgment
I have received, read, and understand the [FIRM NAME] AI Use Policy, version [__], dated [DATE], and the Staff Rule Sheet.
I agree to:
use only tools on the Approved Tools List, and only for their approved uses;
keep client information out of personal and unapproved AI tools;
check AI work against the source before anyone relies on it;
tell the signing attorney when AI helped with a document;
report problems to the AI Lead within 24 hours.
I understand that breaking the policy may lead to discipline.
Name: __________________________________________________
Role: __________________________________________________
Signature: __________________________________________________
Date: __________________________________________________
Training completed on: __________________________________________________
Form B. Approved Tools List
Last updated: [DATE] | Updated by: [AI LEAD NAME]
| Tool and plan | Approved uses | Highest data level allowed (1-4) | Who may use it | Signed agreement on file? | Approved by / date | Next review |
|---|---|---|---|---|---|---|
| [Example: firm research tool] | [Legal research; check every citation] | [1] | [Attorneys, paralegals] | [Yes / No] | [Name / date] | [Date] |
| [Example: records summary tool] | [Medical chronologies, with client consent] | [4] | [Paralegals, attorneys] | [Yes] | [Name / date] | [Date] |
| [Example: built-in AI in case management] | [Drafting routine letters] | [3] | [All staff] | [Yes] | [Name / date] | [Date] |
Not approved for any client information: personal or free AI accounts, browser extensions, and any tool not listed above.
Form C. Incident Log
Fill in one record per incident. Copy this page as needed and keep every record together.
Incident #: ____________
Date found: _______________________________________________________
Reported by: _______________________________________________________
What happened: _______________________________________________________
Tool: _______________________________________________________
Client / matter: _______________________________________________________
Data level involved: _______________________________________________________
Steps taken (contain, assess, correct): _______________________________________________________
Who was notified, and when: _______________________________________________________
Cause and fix: _______________________________________________________
Closed (date / initials): _______________________________________________________
Sources quoted
ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512 (July 29, 2024). https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
State Bar of Arizona, "Best Practices for Using Artificial Intelligence" (Practice 2.0, Choosing and Using Technology). https://www.azbar.org/for-legal-professionals/practice-tools-management/practice-2-0/choosing-and-using-technology/best-practices-for-using-artificial-intelligence/
This guide is not published, endorsed, or reviewed by the ABA, the State Bar of Arizona, or any court. Rules differ by state and change often. General guidance, not legal advice. Have your own counsel review before adopting.