Generative AI governance for law firms

Scope

Professional duties that shape AI governance

The ABA and many state bars have issued guidance on generative AI. While the details vary, most guidance returns to the same duties:

• Competence — understanding the benefits and risks of the technology used, including its tendency to produce plausible but incorrect output.
• Confidentiality — making reasonable efforts to prevent unauthorized disclosure of client information, which includes evaluating how an AI vendor handles input.
• Communication — considering whether and when clients should be informed about, or consent to, AI use in their matters.
• Supervision — lawyers with managerial authority must have measures ensuring lawyers and staff use AI consistently with professional obligations.
• Candor and meritorious claims — verifying citations and factual assertions before filing; courts have sanctioned filings containing AI-fabricated citations.
• Fees — billing reflects actual time and value; firms should decide how AI efficiency and AI tool costs are billed.

Confidentiality and privilege in practice

• Only firm-administered tools with commercial terms reviewed by the firm may be used with client information.
• Confirm in writing whether the vendor uses inputs for training, how long it retains them, and whether humans review them.
• Personal AI accounts are prohibited for any client or firm-confidential work.
• Matter-level access: AI workspaces, projects, and connectors respect ethical walls and matter teams.
• Document-management connectors are enabled only after verifying they enforce matter security.
• Outside counsel guidelines from clients are checked; many now include AI clauses.

Supervision and verification

Every AI-assisted work product needs attorney review proportional to its stakes. Filings, opinions, and client advice require full verification of authorities and facts against primary sources. Establish that AI output is a draft, never a final product, and train staff — including paralegals and assistants — on the same rules.

Client communication and billing

Decide as a firm when client disclosure or consent is required or advisable — for example, when client confidential information will be input into a third-party tool, when AI use materially affects the representation, or when a client's guidelines require it. Update engagement letters as appropriate. Set a billing policy for AI-assisted work and any pass-through of AI tool costs.

AI agents with email and document access

AI assistants that read and draft email, or agents that file documents, raise distinct risks: misdirected communications, inadvertent disclosure across matters, and prompt injection through inbound email from opposing parties. Require human review before anything is sent externally, and restrict agents to specific matters.

Law firm AI governance checklist

• Name a partner or committee accountable for AI governance.
• Adopt a firm AI policy covering approved tools, prohibited data, verification, and disclosure.
• Complete vendor reviews for every AI tool used with client information.
• Maintain an inventory of AI tools, including AI features in practice-management, research, and document tools.
• Enforce SSO and MFA on AI tools.
• Train all timekeepers and staff; record completion.
• Log AI use on client matters where tools support it.
• Add AI scenarios (misdirected AI email, confidential upload to unapproved tool) to incident response.
• Review the program at least annually and after significant ethics guidance.

FlashTower helps firms inventory AI tools, assess them against deterministic rules, and produce a report partners and clients can review. See FlashTower for legal.

Tiering use cases by risk

Some courts have adopted standing orders or local rules requiring disclosure or certification of AI use in filings. Maintain a list for the courts where the firm practices.

Training that works for lawyers

Generic AI training rarely changes behavior in a law firm. Effective programs are short, practice-specific, and grounded in real failure modes: fabricated citations in filings, confidential documents uploaded to personal accounts, and AI-drafted emails sent to the wrong party. Show approved tools in action on realistic tasks, walk through the firm's verification standard, and explain exactly what may and may not be uploaded. Repeat annually and whenever approved tools change, and track completion for every timekeeper and staff member — the record matters for supervision obligations.

Partners should also be trained on reviewing AI-assisted work from associates: what to ask, which outputs require independent verification, and how to spot common errors.