An AI Use Policy for Law Firms: What It Must Cover, with a Ready-to-Use Checklist

Most firms already use generative AI, whether or not management knows it. A trainee summarises a bundle in a chatbot. An assistant rewrites a client email. A partner asks for a first draft of a clause. Without a policy, each person makes their own rules about confidentiality and checking. That is how firms end up explaining themselves to a regulator, an insurer or a judge.

A good AI policy does not ban useful work. It sets the conditions that make useful work safe. Below are the sections every firm policy should contain, followed by a checklist you can print and use.

Why a policy, and why now

Regulators have made supervision explicit. ABA Formal Opinion 512 says managerial lawyers should establish clear policies on the permissible use of generative AI and ensure lawyers and non-lawyers are trained. The Law Society’s guidance for solicitors and the Bar Council’s updated considerations for barristers make similar points about risk assessment, confidentiality and verification. In the EU, the AI Act requires organisations deploying AI systems to take measures supporting AI literacy among staff. And courts have shown, case after case, that the absence of firm-level rules does not protect individual lawyers. See the AI hallucination sanctions cases.

The ten sections every policy needs

1. Purpose and scope

State why the policy exists and who it covers: partners, associates, trainees, paralegals, support staff, contractors and anyone else working on firm matters, on firm devices or personal ones. Define “generative AI tool” broadly enough to include assistants built into word processors, email and research platforms.

2. Approved tools and accounts

List by name the tools approved for client work, the account type to use (for example, the firm’s enterprise workspace), and required settings such as training on firm data switched off. Separate tools approved for client data from tools approved only for non-confidential tasks. Prohibit personal accounts for firm work. Provide a route to request new tools, with a review that covers data terms, security and retention. The free AI Vendor Terms Red-Flag Scanner speeds up the first pass on a vendor’s terms.

3. Confidential and client information

Set clear rules: no client-identifying or confidential information in any tool not approved for it; anonymise where possible; never input privileged material, special category personal data or information subject to a court order or confidentiality agreement unless the tool is approved for it and the use is permitted. State when client consent is needed, in line with your regulator’s guidance.

4. Verification of output

This is the clause that prevents the headlines. Require that every citation, quotation, fact, figure and legal proposition in AI-assisted work is verified against a primary source by a named person before it is sent to a client, filed or relied on. Make clear that the person signing or sending the work is responsible for its accuracy, whatever tool was used.

5. Supervision

Partners and supervisors must review AI-assisted work by juniors with the same or greater care as other work, and must ensure the people they supervise are trained. On team filings, record who verified each authority.

6. Client communication and consent

Explain how the firm tells clients about AI use, through engagement letters, matter-specific conversations, or both. Address what happens when a client restricts or prohibits AI use on their matters, and how that instruction is recorded and passed to the team.

7. Billing

Set rules consistent with your regulator and your fee arrangements: bill only for time actually spent on hourly matters, do not bill clients for general learning of tools, and consider how efficiency is reflected in fixed or value-based fees. ABA Formal Opinion 512 addresses these points directly for US lawyers.

8. Court and tribunal rules

Require lawyers to check, before filing, whether the court or judge requires disclosure or certification of AI use, and to comply fully. Maintain a short internal note of the rules in the courts the firm appears in most.

9. Records and incidents

Keep proportionate records of AI use on significant matters. Create a simple, no-blame route to report incidents, such as confidential data entered into the wrong tool or an unverified citation discovered after filing, so they can be contained and corrected quickly. Candour with courts and clients after an error consistently limits the damage.

10. Training and review

Require initial training for everyone and refresher training at least annually, using real examples. Name the person responsible for the policy and set a review date. Update it when the firm adopts new tools, when guidance changes and when courts change their rules.

What not to put in the policy

• A blanket ban. It pushes use onto personal accounts, where you have no control over data.
• A tool list with no owner. Tools change monthly; someone must maintain the list.
• Rules nobody can follow. If verification requires a process that takes longer than the work, people will skip it. Make the safe path the easy path.
• Promises to clients you cannot keep. Do not tell clients AI is never used if you cannot guarantee it.

The checklist

Use this to build or audit your policy:

• Scope covers all staff, contractors and built-in AI features.
• Approved tools listed by name, with account type and required settings.
• Personal accounts prohibited for firm work.
• Process for requesting and reviewing new tools, including data terms.
• Clear rules on confidential, privileged and special category data.
• Client consent requirements stated.
• Mandatory verification of citations, quotations, facts and figures by a named person.
• Supervisors’ review and training duties defined.
• Client communication and client restrictions on AI use addressed.
• Billing rules for AI-assisted work.
• Court disclosure and certification checks before filing.
• Incident reporting route, with no-blame reporting.
• Initial and annual training.
• Policy owner and review date.

The bottom line

An AI policy is not paperwork for its own sake. It is how a firm gets the efficiency of AI without trading away client confidentiality or its reputation with the courts. Approve good tools, protect client information, verify everything and train your people. Write those four commitments down, review them every year, and you will be ahead of most of the profession.