Generative AI tools have moved quickly from novelty to daily use in many law offices - drafting correspondence, summarizing documents, and speeding up first-pass research. The technology is genuinely useful. It's also easy to use in ways that create real exposure for a firm, often without anyone realizing it until after the fact.
Where These Tools Are Actually Helping
- Drafting routine correspondence and first drafts of standard documents
- Summarizing long depositions, discovery documents, or case files
- Speeding up preliminary research before an attorney verifies the results
- Cleaning up and organizing internal notes and meeting summaries
In each case, the tool is doing preparatory work - not producing a finished, reliable work product on its own. That distinction matters more than it might seem.
The Confidentiality Question Firms Often Skip
The most consequential risk isn't the AI producing a wrong answer - it's what happens to the information typed into the tool in the first place. Many consumer-grade AI tools retain and may use submitted text to improve their models. Pasting client facts, case details, or privileged material into a general-purpose AI tool can mean that information leaves the firm's control entirely, in ways that are difficult to reverse.
This is a question every firm should be able to answer clearly: which AI tools are staff actually using, and what happens to the information entered into them? Many firms haven't asked, and fewer have a policy that addresses it directly.
Accuracy Still Requires a Human Reviewer
Generative AI tools produce confident-sounding output even when the underlying content is wrong - including fabricated citations that look entirely legitimate. Courts have already sanctioned attorneys for filing AI-generated content that included citations to cases that don't exist. The tool didn't fail loudly; it failed quietly, and the human review step was the one that was skipped.
Treating AI output as a first draft that requires the same scrutiny as a first-year associate's work - never as a finished product - is the difference between a useful tool and a professional responsibility problem.
A Reasonable Starting Point for Firms
Firms don't need to ban these tools to manage the risk, and for most firms an outright ban isn't realistic - staff will use them regardless. A more workable approach is a short written policy: which tools are approved, what categories of information may never be entered into them, and a requirement that any AI-assisted work product is reviewed by an attorney before it leaves the building. Pairing that policy with IT controls - so client data doesn't end up in tools the firm hasn't vetted - closes the gap between the policy on paper and what actually happens on staff computers.
Frequently Asked Questions
Is it ever safe to use ChatGPT or a similar tool with client information?
It depends on the specific tool, its data-handling terms, and whether the firm has a business or enterprise agreement with stronger confidentiality protections than the free consumer version. As a general rule, client-identifying facts and privileged material shouldn't go into a general-purpose consumer AI tool without that review having been done first.
Can AI tools really invent fake case citations?
Yes. This is a well-documented failure mode of generative AI, and it has already resulted in court sanctions against attorneys who filed AI-generated briefs without independently verifying the citations.
Do we need a written AI use policy if we're a small firm?
Firm size doesn't reduce the exposure - a small firm handling confidential client matters has the same confidentiality obligations as a large one. A short, clear policy is usually enough to close the largest gaps.
How does IT fit into managing AI risk, versus this being a legal ethics question?
It's both. The ethical obligation belongs to the attorneys and the firm's policies; the technical side - controlling which tools are accessible on firm devices and how data moves in and out of them - is where IT support comes in.
Next Step
IT problems tend to surface at the worst possible moment - the week before trial, the day a filing is due, the afternoon a partner needs a document that isn't where it should be. If you'd like a second opinion on how your firm's systems would hold up under pressure, we offer a 15-minute call to see if we're a fit. No pitch, no obligation.
Managing partners and office administrators can reach us at 325-643-8184 or through the contact form at apollocomputers.com.
