Can Lawyers Use AI Ethically? A Confidentiality-First Guide

Can lawyers use AI ethically?

Yes, but only on conditions. Justia's 50-state survey of AI and attorney ethics rules sums up the general position: a lawyer can use generative AI only to the extent they can reasonably guarantee compliance with their ethical obligations. The tool is not the issue. Your ability to control it is.

The New York State Bar Association makes the same point from the confidentiality angle. Its article on AI tasks for lawyers warns that lawyers must be cautious with this technology, lest they break confidentiality or violate ethical standards.

A Georgia State Law Review article on the ethical risks of generative AI adds that a lawyer's use of these tools can implicate multiple dimensions of ethical concern. Confidentiality is one. It is not the only one. Supervision, accuracy and client communication all matter too.

Note: This article is general information, not legal advice. Attorneys must supervise AI output and verify every citation. Check your own jurisdiction's rules and opinions.

Where does client confidentiality actually get exposed?

Confidentiality gets exposed when client information leaves the firm's control. That usually happens through ordinary habits, not hacking. Look at these points first:

• Consumer accounts. A lawyer or paralegal pastes facts into a free or personal AI account the firm does not manage.
• Unclear data terms. The vendor's terms may allow retention, human review or use of inputs to improve its models. You need to read them.
• Uploads. Whole contracts, discovery sets or medical records go in when a few redacted paragraphs would do.
• Shared workspaces. Matters get mixed together, or people outside the matter team can see chat history.
• Add-ons and integrations. A plug-in or connected app sends data to a third party nobody reviewed.
• Outputs. Drafts containing client facts get saved or emailed outside the matter file.

Notice the pattern. Most of these are policy and configuration problems. You can fix them before anyone types a prompt.

Which AI uses are safer, and which need more care?

Start with tasks where a lawyer reviews the work and the data exposure is small. Thomson Reuters' guidance on ethical generative AI use lists research assistance, document review and initial drafting as allowed uses. It lists client communications among the limited uses.

Here is a practical way to sort your own use cases. This is our suggested handling, not a rule from any bar.

If you are deciding what to build first, our guide on which processes to automate first covers how to rank tasks by effort and risk.

How do you vet an AI vendor for confidentiality?

Ask the vendor for written answers, not sales calls. If they cannot answer clearly, treat that as your answer. Use this checklist before any tool touches client data:

1. Is our data used to train models? Get the answer in the contract or terms, not a webpage that can change.
2. How long is data retained, and can we delete it? Ask what happens to prompts, uploads and outputs.
3. Who at the vendor can see our content? Ask about staff access and human review.
4. Where is data stored and processed? Know the locations and any subprocessors.
5. What security controls exist? Ask about encryption, access controls, single sign-on and audit logs.
6. Can we separate matters and users? You want permissions that follow your matter structure.
7. What happens in a breach? Ask about notice timelines and your obligations.
8. Can we get a confidentiality commitment in writing? This should sit in the agreement, not marketing copy.

Have your IT lead and a supervising attorney review the answers together. Record the decision. If you ever need to explain why you chose a tool, a file with dated answers helps.

What should a law firm AI policy include?

A good policy is short enough that people read it. The National Center for State Courts notes that training in the ethical use of AI, and policies for lawyers in the firm, are necessary. The Pro Bono Institute adds that lawyers must supervise AI use within their firms so it meets ethical standards and does not compromise client data.

Build your policy around these parts:

• Approved tools list. Name what is allowed. Everything else is off limits for client work.
• Data rules. Say what may never go into a tool, what must be anonymized, and what is fine as is.
• Account rules. Firm-managed accounts only. No personal logins for client matters.
• Review requirement. A licensed attorney reviews all AI-assisted work product before it is used or sent.
• Verification. Every citation and quoted authority is checked against a primary source.
• Disclosure and billing. Decide how you will talk to clients about AI use, and how you bill for time saved.
• Incident reporting. Staff know who to tell, and how fast, if something sensitive goes into the wrong tool.
• Training and review. Onboard new hires. Revisit the policy on a set schedule as tools and rules change.

Supervision applies to non-lawyer staff too. Paralegals, assistants and contractors need the same training as attorneys.

How do you supervise AI output?

Treat AI output like work from a fast, confident junior with no accountability. The attorney owns the result. That means reading it, checking it and fixing it before it goes anywhere.

A simple review routine:

1. Check every authority. Pull each case, statute and quote from a primary source. Do not rely on the AI to confirm its own citations.
2. Check facts against the file. Compare names, dates and amounts to source documents.
3. Check for leaks. Make sure the draft does not include details from another matter or another client.
4. Check tone and advice. Make sure the draft says what the attorney actually means to tell the client.
5. Log it. Note which tool was used on which matter. This helps with audits, billing and client questions.

Never let AI send anything to a client or court without a lawyer's eyes on it. Automation is fine for routing and formatting. Judgment stays with the attorney.

Do you have to tell clients you use AI?

It depends on your state and the situation. There is no single national answer, so check your bar's guidance. Justia's 50-state survey is a useful starting point for seeing how jurisdictions are treating the issue, but confirm against your own bar's current opinions.

Even where disclosure is not clearly required, many firms choose to address it. Practical options:

• Add a short plain-English AI paragraph to the engagement letter.
• Explain which tasks AI may assist with and that attorneys review the work.
• Honor client requests to opt out of AI on their matter, and track those requests.
• Get specific consent before using a client's confidential information in any tool where the terms leave you unsure.

Clients in regulated industries, or with their own outside counsel guidelines, may already have AI terms. Read those before you start.

What are the practical next steps?

You can set up a defensible starting point in a few weeks. Do it in this order:

1. Find out what is already in use. Ask staff, anonymously if needed, which AI tools they use today. Shadow use is your biggest gap.
2. Pause client data in unapproved tools. Tell people plainly, and give them an approved alternative so they are not stuck.
3. Pick two or three low-risk use cases. Research support, first drafts and internal summaries are common starting points.
4. Vet one vendor with the checklist above. Get answers in writing and keep them on file.
5. Write the one-to-two page policy. Name an owner, usually a partner plus your IT or operations lead.
6. Train everyone. Use real examples from your own practice areas, including a citation-checking exercise.
7. Review after 60 to 90 days. Look at what worked, what leaked close to the line, and what to expand.

If you want help designing and running this, Apex Ops builds and manages AI systems for law firms with confidentiality controls and attorney review built into the workflow. Our founding team helped scale a DTC brand from $1M to over $300M and has launched more than 5,000 products on Amazon, so we know how to run operations at volume. We will not promise outcomes. We will help you build something your supervising attorneys can defend.

Frequently asked questions