What should a law firm AI policy include?

At a minimum: which AI tools are approved, a rule against putting client-identifying information into unapproved tools, a requirement that a lawyer verify AI output before it is used or filed, when client disclosure or consent is required, how AI factors into billing, who supervises AI use, and how the firm keeps a record of it.

Does a law firm need an AI policy?

ABA Formal Opinion 512 places supervisory duties on managing lawyers to establish policies and training for how the firm uses generative AI. A written policy is the standard way to meet that duty and to show a carrier or regulator that AI use at the firm is governed.

← Guides

Guides · template included

How to write a law firm AI policy

A policy is how a firm turns "we should be careful with AI" into something an associate can follow and a carrier can read. Here is a practical, section-by-section template you can adapt. It is a starting point, not legal advice, and it should be reviewed by a lawyer at your firm before you adopt it.

1. Purpose and scope

State plainly what the policy governs (use of generative-AI tools for firm work) and who it applies to (every lawyer and staff member). One or two sentences. The point is that no one can later say they did not know it applied to them.

TemplateThis policy governs the use of generative artificial-intelligence tools by all attorneys and staff of [Firm] in connection with client work and firm operations. It exists to protect client confidentiality, meet our professional-responsibility obligations, and keep an accurate record of how AI is used at the firm.

2. Approved tools

List the AI tools the firm sanctions, and say that anything not on the list is not approved for client work. This is the single highest-leverage line in the policy, because it converts an open-ended risk into a short, reviewable list.

TemplateOnly the tools on the firm's approved-tools list may be used for client work. Using any other AI tool for client matters requires prior approval from [role]. The approved-tools list is maintained by [role] and reviewed [frequency].

3. Confidentiality and screening

The rule that prevents the most damage: no client-identifying information goes into a tool unless the firm has confirmed the tool handles it appropriately. Screening inputs before they are sent is the mechanism.

TemplateClient names, matter identifiers, and other confidential information must not be entered into a generative-AI tool unless that tool is approved for confidential data. Before sending any text to an AI tool, staff must screen it for confidential details and remove or redact them where the tool is not approved for such data.

4. Verification of output

Track ABA Opinion 512 and your state rule: the lawyer reviews AI output, and remains responsible for it. Tie the requirement to an explicit attestation for research and drafting, because that is where fabricated citations reach a filing.

TemplateA lawyer must independently verify all citations and factual assertions in any AI-assisted work product before it is filed, sent, or relied upon. For research and drafting, the reviewing lawyer must confirm this verification on the record.

5. Client disclosure and consent

Point to the judgment call rather than pretending there is a single answer: disclosure or consent is required in some circumstances, and the firm decides deliberately, per its jurisdiction's guidance.

TemplateWhere the use of AI would involve disclosing a client's confidential information to a third-party tool, or where disclosure to the client is otherwise required under applicable rules, the responsible lawyer must obtain informed consent or make the required disclosure before proceeding.

6. Billing

TemplateTime saved by AI may not be billed as though it were worked. Fees must be reasonable and reflect time actually spent, and any AI-related costs charged to a client must be disclosed to that client.

7. Supervision and training

Template[Role] is responsible for supervising AI use across the firm, maintaining this policy, and providing training. New staff acknowledge this policy on joining, and all staff re-acknowledge it when it is materially updated.

8. Record-keeping

The section that makes the rest provable. The firm keeps a record of AI use per matter so that, if a client, court, or carrier asks, the answer is a document rather than a memory.

TemplateThe firm maintains a per-matter record of AI use, including the tool used, the task, who ran it, the verification performed, and the attorney sign-off. Records are kept in a tamper-evident system and retained for [period].

Policy, then proof

Candor turns each of these sections into a live record.

The approved-tools list, the confidentiality screen, the verification attestation, the client-disclosure prompt, the supervision log, and the per-matter record are the product, not a document in a drawer. Adopt the policy, then let Candor show you followed it.

See how it works The duties behind the policy →

This template is a starting point, not legal advice, and it does not account for your jurisdiction's specific rules or your firm's circumstances. Have a lawyer at your firm review and adapt it before adopting it. Candor is software, not a law firm.