AI policy for law firms: what ABA Formal Opinion 512 expects, with sample clauses
By Dan Blomquist, Aegis AI Advisory · Published October 27, 2026
Short answer
A law firm AI policy is a written firm rule that says which generative AI tools lawyers and staff may use, what client information may go into each one, when the client has to be asked first, and who checks the output before it reaches a client or a court. ABA Formal Opinion 512 (July 29, 2024) says managerial lawyers “must establish clear policies regarding the law firm’s permissible use” of generative AI, so the policy is how a firm shows it is meeting its supervision duties.
Most firms already know the headline risk: a lawyer filing a brief with case citations an AI tool made up. That is one of six duties Opinion 512 walks through. A useful policy turns all six into rules a paralegal can follow at 4:45 on a Friday. This page covers what the opinion actually says, a client-information rule you can adopt, notes for Michigan firms, and sample wording. For the broader case for using AI in a small practice, see our article on where AI saves a law firm real time and where it gets you in trouble.
The six duties Opinion 512 applies to generative AI
The opinion does not create new rules. It applies existing ABA Model Rules to generative AI tools, whether general-purpose or built for legal work. Each row is a section your policy needs.
| Duty | Model Rule | What Opinion 512 says it means | What the policy should say |
|---|---|---|---|
| Competence | 1.1 and Comment [8] | Understand the benefits and risks of the tools you use. Relying on output without an appropriate degree of independent verification or review could violate the duty; the level of review depends on the tool and the task. | Who may use which tool for which task, and the minimum review for each. |
| Confidentiality | 1.6 | Evaluate disclosure risk before inputting information relating to the representation. Self-learning tools require the client’s informed consent first, and boilerplate engagement-letter language is not enough. Read each tool’s terms of use and privacy policy. | A data rule per tool (see the table below) and a consent procedure. |
| Communication | 1.4 | Disclose AI use if the client asks or the engagement terms or outside counsel guidelines require it. Consult the client when client information goes in, when AI affects the fee, or when output will influence a significant decision. | When to tell the client, and who decides. |
| Claims and candor | 3.1, 3.3, 8.4(c) | Review all output, including analysis and citations, before submitting anything to a court, and check the court’s local rules on AI use. | A filing check: every citation verified against the source, and the court’s AI rules checked. |
| Supervision | 5.1, 5.3 | Establish clear firm policies, train lawyers and nonlawyers on the tools they use, and apply outsourcing due diligence to AI vendors: confidentiality agreements, security policies, data retention and conflicts screening. | Training, acknowledgment, and a vendor review before any tool is approved. |
| Fees | 1.5 | Bill actual time, not the time the task would have taken without AI. Do not bill clients for learning a tool you will use regularly. Treat overhead-type tools as overhead absent advance disclosure. | Billing rules for AI-assisted work and AI tool costs. |
Summary of ABA Formal Opinion 512, Generative Artificial Intelligence Tools. The opinion is advisory; your state’s rules of professional conduct and ethics opinions govern.
The client-information rule
Most of the policy’s risk sits in one question: does information relating to the representation go into the tool? Opinion 512 separates three situations, and a fourth is a common firm choice.
| Situation | Rule we recommend | Basis |
|---|---|---|
| No client information: brainstorming, general legal questions, blank templates, marketing copy | Allowed on firm-approved tools. Output still gets reviewed before use. | Opinion 512: idea generation without inputting client information does not require informed consent. |
| Client information, tool that does not train on firm inputs, under firm-controlled terms | Allowed only on tools the firm has reviewed and approved for client data, after checking terms, retention, security and who can access inputs. | Opinion 512: the risk analysis is fact-driven and depends on the client, matter, task and tool; read the terms of use and privacy policy. |
| Client information, self-learning or consumer tool (including personal accounts) | Not allowed unless the client has given informed consent for that use. Most small firms simply prohibit it. | Opinion 512: informed consent required first; general boilerplate in an engagement letter is not sufficient. |
| Material under a protective order, sealed material, or behind an ethical wall | Not allowed in any AI tool without written partner approval for the specific matter. | Firm choice. Opinion 512 notes that self-learning tools can expose information even to lawyers inside the same firm. |
Notes for Michigan firms
Michigan lawyers follow the Michigan Rules of Professional Conduct (MRPC), not the ABA Model Rules, but the State Bar of Michigan’s guidance lines up closely with Opinion 512. Four points are worth building into a Michigan firm’s policy, whether the office is in Detroit or the Upper Peninsula:
- Technology competence is in the comments. The Michigan Supreme Court amended the comments to MRPC 1.1 and 1.6, effective January 1, 2020, to cover technological competence, as noted in Ethics Opinion RI-381.
- Written procedures are expected. RI-381 says a lawyer must formulate, adopt and follow policies and procedures on the use, transmission and storage of client electronically stored information, do due diligence on vendors that store it, train firm personnel, and timely notify clients of a material data breach. AI tools that receive client data fall within that.
- Consent before confidential input. The State Bar’s Artificial Intelligence FAQs say that if protected information must be put into an AI tool, the lawyer must first get the client’s consent under MRPC 1.6(c)(1), and then check that the provider’s security is adequate.
- Disclosure and billing. The same FAQs say the MRPC do not currently create a general duty to tell clients or courts that you use AI, unless the use implicates the rules or a court requires it through local rules or a case management order. On fees, they use the same 15-minute example as Opinion 512 and say lawyers should not charge clients for learning an AI tool.
The State Bar’s judicial ethics opinion JI-155 (October 27, 2023) applies the same competence expectation to judges. The FAQs state they are not legal advice or an ethics opinion.
What goes in a law firm AI policy
- Approved tools list, with the approver for new tools (often the managing partner) and the data each tool may receive.
- Client information rule from the table above, plus a matter-level consent procedure for any use that needs informed consent.
- Verification: every citation, quotation and holding checked against the primary source before work goes to a client, opposing counsel or a court.
- Court filings: check the court’s local rules and the judge’s standing orders for AI disclosure or certification requirements.
- Client communication: when to disclose AI use, including outside counsel guidelines that restrict or require it.
- Billing: actual time only; no charges for learning firm tools; how AI tool costs are treated.
- Supervision and training for associates, paralegals and staff, with signed acknowledgments.
- Vendor review before approval: confidentiality terms, training on inputs, retention after cancellation, breach notification and security.
- File labeling: mark AI-generated drafts in the matter file, a training suggestion from Opinion 512, so later readers know to check them.
- Incidents: how to report a mistaken upload or a wrong citation, and who decides whether the client must be told.
The general sections (purpose, scope, prohibited uses, annual review) follow the same pattern as any professional firm’s policy. See the free sample policy, our explainer on what an AI acceptable-use policy should contain, and the CPA firm version if you share clients with an accounting practice.
Sample clauses for a law firm
Excerpt for illustration only. Not legal advice. [Firm] and [Approver] are placeholders; adapt to your jurisdiction’s rules.
3. Client information
Personnel must not enter information relating to the representation of a client into any AI tool unless the tool is on [Firm]’s Approved AI Tools list for client information. Information may be entered into a tool that uses inputs to train or improve its models only after the responsible lawyer has obtained the client’s informed consent for that specific use and recorded it in the matter file. A general clause in an engagement letter does not satisfy this section.
5. Verification and filings
A lawyer must review AI-assisted work before it is relied on or sent outside the firm. Every case, statute, quotation and holding must be checked against the primary source. Before any filing, the responsible lawyer must confirm the court’s local rules and standing orders on AI use have been followed.
6. Billing
Time entries for AI-assisted work record the time actually spent, including prompting and review. [Firm] does not bill clients for time spent learning AI tools used across the practice. AI tool costs are treated as overhead unless the engagement agreement provides otherwise.
Start this week
- Ask every lawyer and staff member which AI tools they use for work, with no penalty for honest answers. Our guide to shadow AI explains why this comes first.
- Pull the terms of use and privacy policy for each tool and note whether inputs are used for training and how long they are kept.
- Fill in the approved-tools list and the client-information table, then circulate the policy for signed acknowledgment. Our 90-day AI governance plan shows one way to sequence the rest.
What isn’t settled
Opinion 512 says its conclusion on informed consent reflects the risks and capabilities of AI tools at the time it was published, and that the conclusion could change as the technology develops. State bars have issued their own guidance, and it does not all read the same, so check your jurisdiction. Whether a particular enterprise tool counts as “self-learning” depends on its contract and settings, which vendors change. And the ethics opinions address confidentiality duties; whether putting privileged material into a third-party tool affects privilege is a separate question of evidence law they don’t resolve. A policy makes these decisions explicit. It doesn’t replace your own professional judgment or ethics counsel.
Get a policy drafted for your firm
Answer 10 questions, choose Law firm, and the generator emails you an AI acceptable-use policy that addresses Model Rules 1.1, 1.6 and 5.1/5.3, Opinion 512, privilege, citation verification and client consent, using the tools and state you enter.
- $49 Policy: AI acceptable-use policy (Word + web version) and a one-page staff checklist.
- $149 Pro Pack: adds an AI vendor risk register and a staff training sign-off sheet.
Not ready? Read the free sample policy first.
Disclosure: Aegis AI Advisory sells this generator. It produces a template, not legal advice, and it is built on the ABA Model Rules, so a lawyer should check it against your state’s rules. It is not the right fit if ethics counsel has already drafted your AI policy, or if you need an opinion on a specific consent or privilege question. For a firm that needs an AI usage inventory, vendor review and training program, see the AI governance track or book a free AI Operations Briefing.
Frequently asked questions
Does a law firm need a written AI policy?
ABA Formal Opinion 512 says managerial lawyers must establish clear policies regarding the law firm's permissible use of generative AI, and supervisory lawyers must make reasonable efforts to ensure that lawyers and nonlawyers comply with their professional obligations when using it (Model Rules 5.1 and 5.3). The opinion does not prescribe a format, but a short written policy with an approved-tools list is the most practical way to show that duty is being met. In Michigan, Ethics Opinion RI-381 separately says a lawyer must formulate, adopt and follow policies and procedures on the use, transmission and storage of client electronic information.
Can lawyers put client information into ChatGPT?
Not into a self-learning tool without the client's informed consent. Opinion 512 concludes that because many self-learning generative AI tools can lead directly or indirectly to disclosure of information relating to the representation, informed consent is required before that information is input, and the consent has to explain the specific risks. Using a tool for idea generation without inputting client information does not require consent. For tools that do not train on inputs, the opinion calls for a fact-specific risk review, starting with reading the tool's terms of use and privacy policy.
Is an AI clause in our engagement letter enough for client consent?
Not on its own, according to Opinion 512: merely adding general, boilerplate provisions to engagement letters purporting to authorize the lawyer to use generative AI is not sufficient for informed consent. The opinion does say the engagement agreement is a logical place to describe how the firm uses AI and to record client instructions, so the letter is still useful for disclosure, just not as a substitute for matter-specific informed consent when consent is required.
Do we have to tell clients we use AI?
Sometimes. Under Opinion 512, a lawyer must disclose AI practices if the client asks, or if the engagement agreement or the client's outside counsel guidelines require it, and must consult the client when client information will go into the tool, when AI use affects the basis or reasonableness of the fee, or when AI output will influence a significant decision in the matter. Otherwise disclosure may be unnecessary. The State Bar of Michigan's AI FAQs say the Michigan rules do not currently create a general duty to tell clients a lawyer uses AI, except when the use implicates the rules, such as when confidential information may be exposed.
Can a firm bill for AI time or pass on AI subscription costs?
Opinion 512 says lawyers who bill hourly must bill actual time: if a draft takes 15 minutes to prompt, the lawyer may bill those 15 minutes plus the time to review the draft. A lawyer may not bill a client for learning a tool the lawyer will use regularly. Tools that work like general office equipment, such as AI grammar checking built into word processing software, are overhead, while a per-use charge for a third-party AI service used for one client's matter can ordinarily be billed as an expense. The State Bar of Michigan's AI FAQs take the same positions under MRPC 1.5.
Who is responsible if AI invents a case citation?
The lawyer who signs and files the document. Opinion 512 says lawyers must review AI output, including analysis and citations to authority, before submitting it to a court, under the duties of competence and candor (Model Rules 1.1, 3.1, 3.3 and 8.4(c)). The State Bar of Michigan's AI FAQs point to the signature certification in MCR 1.109(E)(5) and Fed. R. Civ. P. 11, and to Mata v. Avianca (S.D.N.Y. 2023), where lawyers were sanctioned $5,000 for a brief citing nonexistent opinions generated by an AI tool.
What does the Aegis AI policy generator produce for a law firm?
Choose Law firm as your industry and answer 10 questions. The $49 Policy is an AI acceptable-use policy in an editable Word file and a web version, plus a one-page staff checklist. For law firms it is written to address ABA Model Rules 1.1, 1.6 and 5.1/5.3, Formal Opinion 512, privilege, citation verification and client disclosure and consent, using the tools and state you enter. The $149 Pro Pack adds an AI vendor risk register and a staff training sign-off sheet. It is a template, not legal advice, and your state's rules may differ from the ABA Model Rules.
Sources
- ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024), and the ABA announcement
- ABA Model Rule 1.1, Comment [8] and Model Rule 1.6
- Michigan Rules of Professional Conduct
- State Bar of Michigan Ethics Opinion RI-381 (February 21, 2020)
- State Bar of Michigan, Artificial Intelligence for Attorneys: Frequently Asked Questions
- State Bar of Michigan Judicial Ethics Opinion JI-155 (October 27, 2023)
Also free: check whether ChatGPT and Google’s AI can find your firm → · More guides on the resources page.