Policies are written for partners. Habits are formed by staff. If your firm wants safe AI use, the rules need to fit on a card, make sense to a paralegal on deadline, and survive the temptation of a quick shortcut.
Here is a set of plain-language rules you can adapt for training. They draw on the themes in ABA Formal Opinion 512, issued in July 2024, which addresses competence, confidentiality, communication, supervision and fees when lawyers use generative AI. Confirm any additional requirements with your state bar.
The Core Principle
Client information belongs in tools the firm has vetted and approved, under agreements that protect it. Public, consumer-grade AI tools are not that, unless the firm says otherwise.
Seven Rules for Staff
1. If it is not on the approved list, don't use it for client work
The approved list is short and maintained by one person. If a tool you want is missing, ask. Requests are welcome, and you will get an answer.
2. Never paste identifying client information into a public tool
That includes names, addresses, case numbers, financial details, medical information and anything that could identify a client or matter. "I removed the name" is not always enough, since context can identify a matter.
3. Never upload documents you do not own the right to share
Contracts, discovery materials, protective-order documents and client files are off limits for unapproved tools.
4. Treat every output as a draft
AI may be wrong, incomplete or invent facts and citations. A person must read and verify the output before it is used. Pay special attention to legal citations, numbers and quotations.
5. Do not install AI browser extensions, plugins or note-taking bots on firm accounts
They may read everything on your screen or in your inbox. Ask IT first.
6. Do not use personal accounts for firm work
Personal accounts lack the firm's controls and contracts. They also complicate retention and discovery.
7. When in doubt, ask, and report mistakes right away
If you pasted something you should not have, say so immediately. Quick reports let the firm limit the damage. Nobody will be punished for honesty, and a quick report is better than a long cover-up.
Examples to Use in Training
Use plain examples from the firm's practice areas.
- Acceptable: asking an approved tool to rewrite a generic paragraph that contains no client information to make it clearer
- Acceptable with care: using an approved enterprise tool to summarize a deposition transcript, followed by attorney review
- Not acceptable: pasting a client's medical records into a free chatbot to get a summary
- Not acceptable: uploading a draft settlement agreement to a consumer AI app to improve the wording
Why These Rules Exist
Free and consumer tools may retain inputs, allow human review of conversations or use content to improve their models, depending on their terms. Rule 1.6 protects information relating to the representation, and ABA Formal Opinion 512 discusses the need to evaluate the risk of disclosure, and in some cases to obtain informed consent before inputting client information into certain tools. Staff do not need to memorize rule numbers, but they do need to understand that the stakes are professional as well as technical.
Technical Backstops
Rules alone are fragile. Add controls:
- Block unapproved AI sites on firm devices where practical
- Restrict browser extensions and app installs
- Use data loss prevention to flag sensitive content leaving the firm
- Review connected apps and OAuth permissions in Microsoft 365
- Offer a good approved alternative, so people do not feel they must work around the policy
Make It Stick
- Deliver a short live training with examples
- Hand out the one-page rules card
- Have each person acknowledge the policy
- Repeat every six months, since tools change fast
- Share anonymized lessons learned when mistakes occur
Don't Forget the Lawyers
Attorneys need the same training, and more. Supervising lawyers are accountable for the work product of teams under Rules 5.1 and 5.3.
Work With Us
Counsel Cyber helps firms turn AI policies into training, technical controls and approved-tool programs. If you want a staff training session on safe AI use, we can provide one.