An online professional reference on the use of generative artificial intelligence in legal practice.

This module covers the professional rules governing the use of AI in legal practice.

The ABA’s Formal Opinion 512, issued July 29, 2024, provides guidance on what competence means in the context of generative AI:

To competently use a GAI tool in a client representation, lawyers need not become GAI experts. Rather, lawyers must have a reasonable understanding of the capabilities and limitations of the specific GAI technology that the lawyer might use. This means that lawyers should either acquire a reasonable understanding of the benefits and risks of the GAI tools that they employ in their practices or draw on the expertise of others who can provide guidance about the relevant GAI tool’s capabilities and limitations.

This module focuses on competence, confidentiality, supervision, and candor.

Competence

In 2012, the ABA amended Comment 8 to Model Rule 1.1 to require lawyers to stay competent with current technology. As of early 2026, forty states, the District of Columbia, and Puerto Rico have formally adopted this duty.

The good news is you’ve already taken the first steps toward competence in the last module. You should already be able to perform (1) and (2). (3) is an ongoing responsibility that you take on every time you employ an AI tool in your work.

Further, as AI tools become standard in the profession, lawyers may develop an obligation to use them when doing so provides more competent representation. The precedent already exists in eDiscovery, where courts have accepted technology-assisted review and commentators have shown that it can achieve higher recall and precision than exhaustive manual review. When AI-augmented research and drafting become the norm, refusing to use available tools may itself create competence issues.

In fact, adopting AI may become relevant for competency standards even before it becomes industry standard. Consider “The TJ Hooper”, a famous negligence case where Judge L. Hand held that tugboat operators were negligent for failing to carry working radio receivers (even though radios were not yet customary in the industry) because the radios would have warned them of the storm that sank their barges.

As Hand put it,

When new technology can meaningfully improve the work of an entire industry, that industry should be obligated to adopt that technology, whether or not it is already common to do so.

Confidentiality

Rule 1.6 prohibits revealing information relating to the representation of a client without informed consent. It also requires lawyers to make reasonable efforts to prevent inadvertent or unauthorized disclosure. When you input client information into an AI tool, both provisions apply.

Different AI platforms handle data differently. Some use inputs to train future models, so anything you submit could become part of their training data. Other platforms retain data for varying periods. And some provide enterprise-level protections that keep your data out of training and restrict access by the provider’s employees.

The terms change frequently. What was true six months ago may not be true today. A platform’s privacy policy at the consumer tier is often very different from its policy at the enterprise tier. This is why you need a framework for evaluating tools, rather than a memorized list of policies.

The list below is a list of common AI tools used for legal practice. We focused on their data retention and training policies because those are the ones that may destroy confidentiality, privilege, and work product protection.

Privacy Terms of Popular AI Tools

The TAR Check

A good way to ensure your AI tool is secure is to perform the TAR Check: Before entering any client information into an AI tool, answer three questions.

Gray Areas in AI Use and Security

Some lawyers argue that using consumer AI tools is no different from using email, cloud storage, or any other third-party service that processes client data. There is some truth to this. Lawyers routinely send confidential information through Gmail, store documents on Dropbox, and use cloud-based practice management software. These all involve third-party access to client data.

The difference is that most email and cloud storage providers do not use your data to train models that respond to other people. That distinction matters under Rule 1.6, which requires reasonable efforts to safeguard client information.

The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure. Factors to be considered in determining the reasonableness of the lawyer’s efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

The safest path for confidential work is to use tools with clear data processing agreements. For work without client-identifying information—such as general research on public legal questions—consumer tools may be appropriate.

Checking that an AI tool has contractual protections, no-training clauses, and configurable retention settings may constitute reasonable efforts.

Supervision

Rules 5.1 and 5.3 impose supervision duties at multiple levels. Partners and lawyers with managerial authority should ensure that lawyers and nonlawyers under their supervision act in accordance with professional obligations. When any user in the firm generates work product, that user must supervise that output with the same rigor they would apply to work from a junior team member.

Draft Zero

A first draft implies that human thinking shaped its creation—that a person identified the issues, chose a structure, selected authorities, and made judgment calls about emphasis and strategy. AI output has none of that. It is raw material generated by statistical prediction. This manual calls it Draft Zero.

This is true AI lawyering.

Treat AI output like work from a first-week associate who is confident, fast, and occasionally wrong in ways that are hard to catch because the writing sounds polished.

Firm-Level Obligations

For firm leaders, the supervisory duty extends beyond individual review to the creation of infrastructure. This means:

The specifics will vary by firm. But every practice that uses AI needs a clear answer to the question: Who is responsible for verifying AI output before it goes to a client or a court? If the answer is unclear, the supervision duty is probably not met.

Candor

Rule 3.3 requires candor toward the tribunal, meaning that a lawyer shall not knowingly make a false statement of fact or law to a court. Filing citations to nonexistent cases is a false statement of law, and filing quotations that appear nowhere in the cited source is a false statement of fact. If AI generated those fabrications and you filed them without checking, the professional responsibility is yours.

AI will generate:

If you ask AI whether a citation it just generated is real, the statistically likely response is yes.

Verification should happen through independent sources (e.g., by checking citations in Westlaw or Lexis). Pull the actual opinion and compare quotations and page numbers against the original text.

The Consequences Are Real

Since mid-2023, numerous lawyers and pro se litigants have been sanctioned for filing court documents containing fabricated AI-generated citations. The outcomes have ranged from fines and reprimands to license suspensions.

NOTE: Lawyers who acknowledged the mistake and took responsibility received lighter consequences. Those who tried to hide it or blamed subordinates fared worse. Those who lied to the court about it fared worst of all.

Disclosure Requirements

Courts are responding to this problem by requiring affirmative disclosure. A growing number of federal judges have issued standing orders requiring parties to state whether AI was used in preparing filings. Some even require certification that AI-generated citations have been independently verified.

What This Means for Practice

The four duties—competence, confidentiality, supervision, and candor—form a framework for every AI interaction in legal practice.