AI usage policy template for law firms
A plain-language starting point, built from the outline I use with firms.
Most firms I meet already have lawyers using AI. What they don't have is a written standard everyone can point to. This template is that standard in draft: fourteen sections, each with starter language you can adapt. It is short on purpose. A policy nobody reads protects nobody.
How to use it. Copy the sections you need, replace the bracketed text, and cut what doesn't fit your firm. Then have your ethics counsel or general counsel review it against ABA Formal Opinion 512 and your state bar's guidance on generative AI before you adopt it. I'm not an attorney, and this template is not legal advice.
The four questions every policy has to answer
Everything below elaborates on four questions. If your policy answers them clearly, it is most of the way there.
- Which tools are approved? By name and by account type, because a free personal account and a business account of the same product are governed by different terms.
- What information can go into them? Spelled out by category, so nobody has to guess whether a client's documents are allowed.
- Who reviews the output? A named attorney, every time, before anything is filed, sent, or relied on.
- Which uses are off-limits? The short list of things nobody does, whatever the tool.
The template
Fourteen sections, in the order a reader needs them. The starter language is written for a firm of 10 to 100 attorneys; larger firms usually add committee approvals, and smaller firms often fold sections together.
1. Purpose and scope
This policy sets the rules for how [Firm Name] attorneys, staff, contractors, and anyone else working on firm matters use artificial intelligence tools. It applies to every AI tool used for firm work, on firm or personal devices, including AI features built into software the firm already uses.
2. Definitions
AI tool: software that generates, summarizes, analyzes, or transforms text, images, audio, or data using artificial intelligence. This includes chat assistants such as ChatGPT, Claude, Gemini, and Microsoft Copilot, and AI features inside other products.
Approved tool: an AI tool listed in Appendix A, used through a firm account under the firm's agreement with the vendor.
Client information: any information relating to the representation of a client, whether or not it is privileged.
Consumer account: a free or personal account that is not covered by a firm agreement.
3. Guiding principles
Human judgment stays accountable. A lawyer is responsible for all final work product, including anything AI helped create.
Confidentiality and privilege come first. Client information goes only into approved tools configured so that firm prompts and documents stay isolated from other customers and out of model training.
Be honest about AI assistance. Anyone who used AI on a piece of work should be able to explain how, if a client, a court, or a regulator asks.
Verification is not optional. Every factual statement, citation, quotation, and legal conclusion that matters is checked against a trusted source before it leaves the firm.
Match the tool to the task. Consumer tools are for low-risk work that contains no client information. Approved tools are for anything that touches a real matter.
4. Approved tools
Only the tools listed in Appendix A may be used for firm work, and only through firm accounts. [Name, title] maintains the list. For each tool, Appendix A records the account type, the categories of information it may receive (Section 7), any features the firm has turned off, and the date it was approved.
For the settings I recommend turning on and off, see my setup guides for Claude Team and ChatGPT Business.
5. Permitted uses
With an approved tool, attorneys and staff may use AI to:
- draft and edit documents for attorney review;
- summarize documents, transcripts, and correspondence;
- organize and analyze records and data;
- research and brainstorm, with every authority verified independently;
- prepare internal materials, checklists, and training; and
- [add firm-specific uses].
6. Prohibited uses
No one may:
- enter client information into a consumer account or an unapproved tool;
- file, send, or rely on AI output without the review required by Section 8;
- cite any authority without reading it in a trusted source;
- use AI to make a final decision about a client's legal position or strategy;
- enter information restricted by a protective order, NDA, client instruction, or outside counsel guidelines into any AI tool unless the restriction allows it; or
- [add firm-specific restrictions].
7. Client information and data handling
Information is handled according to the category it falls in:
| Category | Examples | Where it may go |
|---|---|---|
| Public | Published opinions, statutes, marketing copy, public filings | Any approved tool |
| Firm internal | Templates, training materials, operations, non-client data | Approved tools, firm accounts |
| Client information | Anything relating to a representation, privileged or not | Approved tools, firm accounts, inside the matter’s project or workspace where the tool supports one |
| Restricted | Material under a protective order or NDA, health information, anything a client has said stays out of AI | No AI tool unless [Name] approves in writing |
Settings that send firm content to a vendor for model training or product feedback stay off. No one connects a personal account or an unapproved app to a firm workspace.
8. Human review and accountability
The responsible attorney reviews every AI-assisted work product before it is filed, sent to a client, or relied on. Review means checking facts, citations, quotations, and calculations against the source material, not rereading what the AI produced. Supervising attorneys are responsible for the AI use of the people they supervise.
9. Vendor evaluation and approval
Before a tool is added to Appendix A, [Name, title] confirms: whether the vendor uses firm data to train its models; how long data is kept and how it is deleted; where data is stored and who at the vendor can see it; the vendor's security certifications and data processing terms; and which settings the firm will turn off. New AI features in software the firm already uses are reviewed the same way before anyone relies on them.
10. Training
No one uses an approved tool on client work until they have completed the firm's AI training, which covers this policy, the approved tools, and how to verify output. Training is refreshed when the tools or this policy change.
11. Incident reporting
Anyone who believes client information went into an unapproved tool, or that unverified AI output was filed or sent, reports it to [Name] the same day. The firm assesses the exposure, corrects the error, and decides with the responsible partner whether a client or a court needs to be told. [Optional: Prompt self-reporting is not, by itself, grounds for discipline.]
12. Billing for AI-assisted work
Attorneys bill for time actually spent, including time spent reviewing and verifying AI output, and never for time not worked. The cost of AI tools is [treated as firm overhead / passed through only with the client's written agreement]. Engagement letters and outside counsel guidelines control where they say otherwise.
13. Telling clients
[Firm Name] uses carefully selected AI tools to improve the quality and efficiency of its work. These tools are used only through firm accounts with contractual confidentiality protections, never through consumer tools. A lawyer remains responsible for all work product and verifies every important fact and legal conclusion. Questions about how AI is used on your matter are always welcome.
Adjust the notice to match what your firm actually does. Some clients, courts, and outside counsel guidelines require disclosure or consent before AI is used, and ABA Formal Opinion 512 discusses when informed consent is needed. Check them matter by matter.
14. Ownership and review
[Name, title] owns this policy. It is reviewed every [six] months, and sooner whenever an approved tool changes what it can do or how it handles data. Questions go to [Name].
Effective date: [date]. Last reviewed: [date].
Rolling it out
The policy is the easy part. Three steps decide whether anyone follows it.
- Map how people use AI today, before you finalize it. Ask what tools people use, sanctioned or not. A policy written around imagined use gets ignored.
- Set the tools up to match it. Turn off what the policy says is off, and put client work in projects or workspaces. The setup guides above walk through every setting.
- Train everyone on it, then keep it current. Walk people through the approved tools and the review step on real work. Revisit the policy when a major tool changes, because a policy written in spring can be out of date by fall.
Want help with it? I write AI usage policies with firms, starting from how their people actually use AI, and I review them when the tools change. I also train attorneys and staff on the policy and the tools it approves.