Guide
What a small firm AI policy usually covers
If your firm has five to twenty attorneys, there's a good chance nothing is written down about AI use. That's understandable. The technology showed up inside software you already owned, so nobody ever sat down and decided on it.
This isn't a template, and it isn't legal advice. It's a list of the questions a written position normally has to answer, so you can see which ones yours doesn't.
The questions
- Which tools are approved? Name the products. "AI tools" isn't a policy.
- On whose account? Firm accounts or personal ones. If it's firm accounts, somebody has to actually buy them.
- What information may go in? This one matters most, so don't leave it vague.
- Who reviews output, and before what? Before it goes to a client, before it goes on a file, before it goes to a court. These are different thresholds.
- Is AI-assisted work marked as such anywhere? Internally, on the file, or not at all. Any of those can work. Leaving it undecided doesn't.
- What do you tell clients? Some firms disclose, some address it in the engagement letter, some say nothing. Again, any of those works, as long as you pick one.
- Which vendor AI features are switched on? Your practice management system may have enabled something. Did anyone approve that?
- Who owns this? Name one person. If nobody owns it, nobody keeps it current.
- When does it get looked at again? These products change every few months.
Two things worth knowing before you write one
A short, true policy beats a long, aspirational one. A paragraph describing what your firm actually does is more useful than four pages about what it ought to do. The long version gets contradicted by the first person who opens a laptop.
Write down the current state first. Don't write the rule before you know what's happening. Find out who's using what, on which account, with what information. Once you have that, the policy nearly writes itself, and you may find something you want to stop right away.
Where we stop
We aren't lawyers, and we don't tell you what your obligations are. There's published guidance in this area, and many state bars have taken a position. Those are the authorities.
We do the fact-finding underneath: what's actually happening in your firm today, which settings are on, and what isn't written down. That's the raw material for a policy. We don't write the policy itself.
Want the current state written down?
The audit records it as part of looking at your firm's technology: which AI tools people use, with what information, and whether anything is written down. It isn't legal advice, and it doesn't replace your own judgment.