What Should a Law Firm AI Policy Include?

A workable law firm AI policy covers seven things: which tools are approved, what information can go into them, who checks the output, how clients are told, how AI time is billed, what courts require, and who owns the policy. Google’s autocomplete for “law firm AI policy” fills in “template,” “pdf” and “example,” which tells you most firms want a starting document. Templates are a fine start. The structure below follows the duties in ABA Formal Opinion 512 and what courts did in 2026, so a firm can check any template against it.

This is a guide to what policies commonly address, not advice on what your firm’s policy should say. Rules vary by state and practice.

Which Tools Are Approved, and for What?

Start with a list of approved tools and the tasks each one may be used for. Many firms separate low-risk uses, such as summarizing public material or polishing internal drafts, from higher-risk uses involving client documents. Opinion 512 expects lawyers to have a reasonable understanding of the capabilities and limits of the tools they use, which is easier to meet when the firm has vetted a short list. Our vendor security guide covers what to ask before a tool goes on that list.

What Can Go Into the Tool?

This is the section that changed most in 2026. In United States v. Heppner, a federal judge relied on a consumer AI provider’s privacy policy in finding that a client’s AI chats were not confidential or privileged. Other courts, collected in Crowell & Moring’s tracker, have been more protective, but the facts they weighed are consistent: whether the provider trains on inputs, can disclose them, and allows deletion.

A policy should say plainly whether client confidential information may be entered into each approved tool and under what contract terms. California has put a version of this rule into statute. Under SB 574, effective January 1, 2027, California lawyers may not enter confidential or personal identifying information into a generative AI system unless access is restricted to the attorney and people authorized under confidentiality obligations, as Ropes & Gray’s alert explains. Firms should also cover AI meeting notetakers here, since a transcript of a client call raises the same issues.

Who Checks the Output?

Templates and ethics guidance consistently require human review, and the reason is on the record. Our AI hallucination sanctions tracker logs courts sanctioning lawyers for filings with fake citations. A strong policy names who verifies citations and facts before anything is filed or sent, and makes supervising lawyers responsible for AI-assisted work by associates and staff, in line with the supervision duties Opinion 512 discusses. California’s SB 574 will require the attorney responsible for a filing to personally verify every citation.

How Are Clients Told, and How Is AI Billed?

Opinion 512 discusses when lawyers must tell clients about AI use and when informed consent is needed, especially before client information goes into a self-learning tool. Many firms address this in the engagement letter. Our guide on telling clients about AI use goes deeper. On billing, the opinion says lawyers billing hourly may charge only for time actually spent, and should not bill clients for time spent learning a general tool. The policy should say how the firm handles both.

What Do Courts Require, and Who Owns the Policy?

A policy should point lawyers to court and judge-specific AI orders, which our court AI disclosure tracker follows, and to state bar guidance, collected in our state bar AI ethics opinions roundup. Finally, name an owner, set a review date, require training before access, and set a way to report mistakes. Tools and terms change quickly, so a policy that is not reviewed at least yearly will drift.

Real. A written policy is no longer optional for most firms. The details differ, but these sections are the ones regulators and courts keep returning to.

Common Questions

What should a law firm AI policy include?

Approved tools and uses, rules on confidential information, output verification, client disclosure, billing, court requirements, training and a named owner.

Is there a model law firm AI policy?

Many templates circulate. Check any template against ABA Formal Opinion 512 and your state bar’s guidance before adopting it.

Do policies need to cover client use of AI?

Increasingly yes. After Heppner, some commentators suggest warning clients that pasting legal advice into consumer AI tools may waive privilege.

How often should an AI policy be updated?

At least yearly, and whenever a major tool, vendor term or court rule changes.