A firm does not have to decide to adopt AI for AI to show up in its work. Staff use drafting assistants, summarizers, and chatbots on their own, often with good intentions and without anyone having said whether it is allowed. The question for a managing partner or office administrator is usually not whether the firm uses AI, but whether it has said anything about how.

A written AI use policy is how a firm answers that question once, in plain terms, instead of leaving it to each person's judgment.

Why a Policy Matters Even If the Firm Has Not "Adopted" AI

Attorneys have a duty of competence and a duty to protect client confidences, and both apply to every tool used on a matter. When a paralegal pastes a client's facts into a free chatbot, that duty is engaged whether or not anyone approved the tool.

Outside pressure is also growing. Some courts have issued standing orders on AI use in filings, clients increasingly ask how their information is handled, and insurers may ask about AI practices on applications and renewals. A firm that can hand over a short written policy is in a much better position than one that has to improvise an answer.

What a Useful Policy Covers

A good policy is specific enough to follow and short enough to be read. The topics that matter most:

  • Approved tools: which AI tools the firm permits, who decides, and how a new tool gets approved
  • Prohibited information: what may never be entered into a tool, such as client-identifying details, privileged communications, or anything under a protective order, unless the tool has been specifically approved for that use
  • Accounts: that approved tools are used through firm-managed accounts with multi-factor authentication, not personal logins
  • Human review: that every AI-assisted output is checked by an attorney before it is relied on or filed, with particular attention to citations and quotations
  • Disclosure: when the firm tells clients or courts that AI was used, following court rules and the terms of the engagement
  • Training: that everyone who may use these tools understands the rules before they do
  • Incident reporting: what a person should do, and who they should tell, if they realize they put something into a tool they should not have
  • Review: how often the policy is revisited, since the tools change quickly

Keep It Short and Enforceable

Policies fail when they are long, abstract, or written for a firm that does not exist. Two pages in plain language will do more than a twenty-page document no one opens. Each rule should be something a staff member can actually follow on a busy Tuesday, such as "use only the approved tools" and "never enter client names or case facts into a tool that is not on the approved list."

It also helps to give people somewhere to go with questions. A policy that only says no tends to be worked around. A policy that explains how to get a tool approved tends to be used.

Where the Technology Comes In

A policy states the rules. Technology is what helps them hold. Firm-managed accounts, multi-factor authentication, restrictions on which applications can be installed or reached from firm devices, and access logs are what turn "we do not allow this" into something the firm can actually verify.

Vetting the tools themselves is part of the same job. Before a tool goes on the approved list, someone should read its data terms: whether it keeps or trains on what is entered, how long it retains data, and who at the vendor can see it. That review is as much an IT question as a legal one, and it is best done before the tool is in daily use.

Getting Started

The simplest path is to find out what is already in use, draft a short policy around the tools the firm is willing to allow, have the partners sign off, and walk the whole firm through it. Setting a date to review it in six months keeps it from going stale. The firm's own counsel, and where appropriate its malpractice carrier, should have a chance to weigh in on the wording.

Frequently Asked Questions

Do we need an AI policy if our firm does not use AI?

Probably yes. AI features are being built into software firms already use, and staff may be using consumer tools on their own. A short policy establishes what is allowed and protects client information even if the firm has not formally adopted anything.

How long should a law firm AI policy be?

Short enough that people read it. Two pages in plain language is a reasonable target. The goal is clear rules about approved tools, prohibited information, review, and who to ask, not an exhaustive treatise.

Should the policy ban AI tools entirely?

Some firms choose to, but a blanket ban is hard to enforce and often leads to unapproved use. Many firms find it more effective to approve a small set of vetted tools and set firm rules for how they are used.

Who should own the AI policy at the firm?

Typically the managing partner or office administrator, with input from the firm's counsel and whoever manages its IT. Someone needs to be responsible for approving tools and keeping the policy current.

How often should the policy be updated?

At least once or twice a year, and whenever the firm adds a tool or a court or bar authority issues new guidance. The tools and the rules around them are still changing quickly.

Next Step

If your firm is working out which AI tools are already in use and how to keep client information protected, we offer a 15-minute call to see if we're a fit. No pitch, no obligation.

Managing partners and office administrators can reach us at 325-643-8184 or through the contact form at apollocomputers.com.