# What Should a Law Firm AI Policy Include?

> Searches for a law firm AI policy template keep climbing. Here are the sections that ethics guidance, court rules and 2026 privilege rulings say a policy needs.

By The Circle Desk | Legal Ops | Published 2026-10-26
Source: https://legaltechcircle.com/insights/law-firm-ai-policy-checklist/

A workable law firm AI policy covers seven things: which tools are
approved, what information can go into them, who checks the output,
how clients are told, how AI time is billed, what courts require, and
who owns the policy. Google's autocomplete for "law firm AI policy"
fills in "template," "pdf" and "example," which tells you most firms
want a starting document. Templates are a fine start. The structure
below follows the duties in [ABA Formal Opinion
512](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf)
and what courts did in 2026, so a firm can check any template against
it.

This is a guide to what policies commonly address, not advice on what
your firm's policy should say. Rules vary by state and practice.

## Which Tools Are Approved, and for What?

Start with a list of approved tools and the tasks each one may be used
for. Many firms separate low-risk uses, such as summarizing public
material or polishing internal drafts, from higher-risk uses involving
client documents. Opinion 512 expects lawyers to have a reasonable
understanding of the capabilities and limits of the tools they use,
which is easier to meet when the firm has vetted a short list. Our
[vendor security
guide](https://legaltechcircle.com/insights/soc-2-report-lawyers-vendor-security/)
covers what to ask before a tool goes on that list.

## What Can Go Into the Tool?

This is the section that changed most in 2026. In [United States v.
Heppner](https://jlellis.net/wp-content/uploads/2026/02/USA-v-Heppner-Order-2026-02-17-AI-Not-Privileged.pdf),
a federal judge relied on a consumer AI provider's privacy policy in
finding that a client's AI chats were not confidential or privileged.
Other courts, collected in [Crowell & Moring's
tracker](https://www.crowell.com/en/insights/client-alerts/crowell-tracker-of-court-rulings-on-legal-privilege-and-artificial-intelligence-tools),
have been more protective, but the facts they weighed are consistent:
whether the provider trains on inputs, can disclose them, and allows
deletion.

A policy should say plainly whether client confidential information
may be entered into each approved tool and under what contract terms.
California has put a version of this rule into statute. Under SB 574,
effective January 1, 2027, California lawyers may not enter
confidential or personal identifying information into a generative AI
system unless access is restricted to the attorney and people
authorized under confidentiality obligations, as [Ropes & Gray's
alert](https://www.ropesgray.com/en/insights/alerts/2026/10/california-enacts-sb-574-nations-first-law-governing-attorneys-use-of-generative-artificial)
explains. Firms should also cover AI meeting notetakers here, since a
transcript of a client call raises the same issues.

## Who Checks the Output?

Templates and ethics guidance consistently require human review, and
the reason is on the record. Our [AI hallucination sanctions
tracker](https://legaltechcircle.com/insights/ai-hallucination-sanctions-tracker/)
logs courts sanctioning lawyers for filings with fake citations. A
strong policy names who verifies citations and facts before anything
is filed or sent, and makes supervising lawyers responsible for
AI-assisted work by associates and staff, in line with the supervision
duties Opinion 512 discusses. California's SB 574 will require the
attorney responsible for a filing to personally verify every citation.

## How Are Clients Told, and How Is AI Billed?

Opinion 512 discusses when lawyers must tell clients about AI use and
when informed consent is needed, especially before client information
goes into a self-learning tool. Many firms address this in the
engagement letter. Our guide on [telling clients about AI
use](https://legaltechcircle.com/insights/tell-clients-ai-use-disclosure/)
goes deeper. On billing, the opinion says lawyers billing hourly may
charge only for time actually spent, and should not bill clients for
time spent learning a general tool. The policy should say how the firm
handles both.

## What Do Courts Require, and Who Owns the Policy?

A policy should point lawyers to court and judge-specific AI orders,
which our [court AI disclosure
tracker](https://legaltechcircle.com/insights/court-ai-disclosure-orders-tracker/)
follows, and to state bar guidance, collected in our [state bar AI
ethics opinions](https://legaltechcircle.com/insights/state-bar-ai-ethics-opinions/)
roundup. Finally, name an owner, set a review date, require training
before access, and set a way to report mistakes. Tools and terms
change quickly, so a policy that is not reviewed at least yearly will
drift.

**Real.** A written policy is no longer optional for most firms. The
details differ, but these sections are the ones regulators and courts
keep returning to.

## Common Questions

**What should a law firm AI policy include?**

Approved tools and uses, rules on confidential information, output
verification, client disclosure, billing, court requirements, training
and a named owner.

**Is there a model law firm AI policy?**

Many templates circulate. Check any template against ABA Formal
Opinion 512 and your state bar's guidance before adopting it.

**Do policies need to cover client use of AI?**

Increasingly yes. After Heppner, some commentators suggest warning
clients that pasting legal advice into consumer AI tools may waive
privilege.

**How often should an AI policy be updated?**

At least yearly, and whenever a major tool, vendor term or court rule changes.

---
Legal Tech Circle (https://legaltechcircle.com/). News and analysis, not legal advice.