Briefing
ABA Model Rule 1.6 asks lawyers to make reasonable efforts to prevent unauthorized access to or disclosure of client information. Most firms adopt their state's version of the rule, so confirm local wording.
Formal Opinion 512, issued July 29, 2024, is the ABA's first formal guidance on generative AI. It ties AI use to existing duties: competence, confidentiality, communication with clients, and reasonable fees. It notes lawyers generally should not bill clients for learning a tool.
Separately, the routine risks remain: email compromise targeting trust account transfers, shared file stores without access records, and unencrypted personal devices.
What to do
- Approve specific AI tools and accounts. Use business tiers with training on customer data disabled.
- Prohibit client identifiers in unapproved tools.
- Require human review of every citation and factual statement.
- Document the policy on one page and train everyone on it.
- Enforce MFA, device encryption and remote wipe for anyone handling client files.
How to verify
- Keep a register of approved AI tools with their data retention settings.
- Audit mailbox rules and external forwarding monthly.
- Test the wire verification procedure with a mock request.
Sources
- American Bar Association, Model Rule 1.6: Confidentiality of Information
- American Bar Association, ABA issues first ethics guidance on a lawyer's use of AI tools (Formal Opinion 512), Jul 29, 2024
- CISA, Require Multifactor Authentication
Want help putting this in place? Contact Computer Plus.