The ABA's Model Rules and formal opinions are influential, but they are not binding on any lawyer by themselves. What governs your practice is your state's rules of professional conduct and the ethics opinions issued by your state bar or court. For a firm that practices in Texas, Arkansas, Louisiana, Oklahoma or Kansas, or in more than one state, that means checking several sources.
This post is a how-to for finding and tracking state guidance on technology issues, without turning anyone into a full-time researcher. It is not legal advice and does not summarize any specific state's position, because those change. Verify current rules directly with your bar.
Start With the Rules
Look first at your state's version of the Model Rules. Several provisions matter for technology:
- Rule 1.1 (competence): whether your state adopted Comment 8 on the benefits and risks of relevant technology
- Rule 1.4 (communication): what must be shared with clients, including about incidents
- Rule 1.6 (confidentiality): whether your state has language like Model Rule 1.6(c) on reasonable efforts to prevent unauthorized disclosure
- Rules 5.1 and 5.3 (supervision): how your state treats supervision of lawyers and nonlawyers, including vendors
Bar association websites typically publish current rules, and the official text matters more than any summary.
Then Find the Ethics Opinions
Most state bars publish formal ethics opinions, and some also run ethics hotlines. Topics worth searching:
- Cloud storage and software-as-a-service
- Email and communicating with clients electronically
- Metadata
- Remote work and virtual practice
- Data breaches and incident response
- Social media
- Generative AI
- Outsourcing and use of third-party vendors
- Use of client information in vendor-provided tools
Search the bar's opinion database using these terms, and note the dates. Opinions on cloud computing from a decade ago may reflect different technology and assumptions than a recent one on AI.
Beyond Ethics Opinions
Other sources also shape your obligations:
- State data breach notification laws, which may apply to the personal information you hold
- State privacy statutes that may apply depending on your clients and data
- Court rules and standing orders, including those on e-filing security, redaction and AI disclosure
- Client contracts and outside counsel guidelines, which often impose stricter security requirements than any ethics rule
- Federal rules and industry regulations that flow down through clients, such as those in healthcare or finance
Build a Simple Tracking Document
A one-page reference makes the work reusable.
- List each state where your lawyers are licensed or practice.
- For each, record the relevant rules and opinions, with links and dates reviewed.
- Add a column for local practice implications, such as "adopt client-portal policy" or "AI disclosure in engagement letters."
- Assign someone to recheck every six to twelve months.
- Note questions to raise with the bar's ethics counsel.
When Practices Cross State Lines
Multi-state firms and virtual practices can raise questions about which rules apply. ABA Formal Opinion 498 discusses virtual practice, including technology and supervision issues, but jurisdictional questions are state-specific. Ask your bar if it is unclear.
Use Bar Resources
Many bars provide practice-management advisors, ethics hotlines and CLE programs on technology. These are valuable, often free for members, and demonstrate a good-faith effort to stay current.
Translating Guidance Into Controls
Once you know the guidance, translate it into action:
- Cloud use: vet vendors, require encryption and MFA, review contracts
- Email: use encrypted channels for sensitive content where appropriate and discuss preferences with clients
- Remote work: manage devices, secure home networks and restrict public Wi-Fi use
- AI: adopt a written policy and verification process
- Breaches: maintain an incident response plan and notification process
Where Counsel Cyber Helps
We cannot interpret your state's ethics rules, and you should consult ethics counsel for that. What we can do is implement and document the technical safeguards that your firm decides are appropriate. If you need help turning a policy into working controls, contact us.