Few questions generate more nervous emails to firm administrators right now than this one: can I put this into ChatGPT, or a similar tool? The honest answer is that it depends on the tool, the plan, the data and the client. This Q&A gives practical rules of thumb and points to what the ABA has said. It is not legal advice, and your state bar may have its own guidance.
Q: What duty is at stake?
Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized or inadvertent disclosure of client information. ABA Formal Opinion 512, issued in July 2024, applies that duty to generative AI. It notes that some tools may retain or reuse inputs, and discusses the need to evaluate how a tool handles information and, in some circumstances, to obtain informed client consent before inputting confidential information.
Q: Is every AI tool the same?
No, and this matters more than almost anything else. Two products from the same company can have different terms depending on whether you use a free consumer account or a business plan. Differences can include whether inputs are used for training, how long data is kept and who can review conversations. Do not rely on a vendor's marketing page. Read the actual terms, and have the firm approve specific tools and plans.
Q: What about the free tools staff already use?
Treat free consumer tools as unapproved for client information unless your review shows otherwise. Staff do not typically have a negotiated agreement, and the firm cannot control retention. Offer an approved alternative so people are not tempted to use the free version.
Q: What if I remove the client's name?
Removing names reduces risk but does not eliminate it. Facts can identify a person or matter even without a name: a rare injury, a small town, a unique transaction. Consider whether someone who knew the matter could recognize it. When in doubt, generalize further or use an approved tool.
Q: What types of information should never go in?
Unless a tool has been specifically approved for it, avoid entering:
- Privileged communications and attorney work product.
- Personal identifiers such as Social Security numbers and account numbers.
- Health, financial or immigration details.
- Sealed or protected material.
- Another party's confidential business information subject to a protective order.
- Passwords, keys or credentials.
Q: What can staff safely use AI for?
Tasks that involve no confidential information are typically lower risk: brainstorming marketing topics, drafting a generic template, explaining a general legal concept in plain language or formatting a document with placeholder text. Even then, output needs review, because tools can be wrong.
Q: Do we have to tell clients?
Opinion 512 discusses client communication, including that disclosure may be needed in some circumstances, and notes that boilerplate language in an engagement letter may not suffice for informed consent about specific uses. The firm should decide its position, review engagement letters and confirm your state's requirements. Some clients and outside counsel guidelines prohibit AI use, so check those documents.
Q: What about AI built into software we already use?
Features added to email, document platforms and note-taking apps may send content to AI services. Check admin settings and vendor documentation. Where possible, enable such features only after review, and tell staff what is switched on.
Q: What about meeting recorders and transcription bots?
They capture sensitive conversations and store them with a third party. Get approval before using one on any client call, address recording consent rules in your state and check where recordings and transcripts are kept.
Q: What if someone already pasted something sensitive?
Report it right away without blame. IT can review the tool's terms, request deletion if available and assess whether notification obligations might apply, with counsel's help. Speed and honesty are the priorities.
Q: What should a simple rule say?
"Do not enter client information into any AI tool unless the firm has approved that tool and plan for that purpose. When unsure, ask before you paste."
Q: Where can we get help?
Counsel Cyber helps law firms select, configure and write policies for AI tools, including approved tool lists and staff training. Reach out if you want a short briefing for your team.