Before you start
General information, not legal advice. Check your own bar or regulator's guidance and your client engagement terms before putting any client information into an AI tool.
ABA Formal Opinion 512 (July 2024) discusses lawyers' use of generative AI, including competence, confidentiality, supervision and fees. Other regulators have issued their own guidance. Read what applies to you, then use the outline below as a starting draft.
Starter policy outline
| Section | Questions to answer |
|---|---|
| Scope | Who and which tools does it cover? |
| Data classes | What may never be entered? What may be entered after anonymising? |
| Approved tools | Which tools and plans are approved? Who decides? |
| Approved uses | Drafting outlines, summaries of public text, internal admin |
| Prohibited uses | Unverified research, filing unchecked output, entering privileged material in unapproved tools |
| Review | Who checks output and against what? |
| Client communication | When do you tell clients, and how is it covered in engagement terms? |
| Records | What do you note on the matter file? |
| Training and review | How often do you update the policy? |
Vendor questions
- Is our content used to train models? Can we opt out?
- How long is data retained and can we delete it?
- What contractual confidentiality and security commitments exist for our plan?
- Where is data processed and stored?
- Who at the vendor can access our content?
- What admin controls and logging exist?
Answer these from the vendor's current documents, not from memory or marketing pages.
Put it in Notion
Create a page called AI policy, a database called Approved tools (Tool, Plan, Data allowed, Approver, Date reviewed) and the prompt library from our AI section. This is a structure you build yourself; LawyerOS Pro gives you the databases and Custom AI Agents page to extend.
Frequently asked questions
- Is this a ready-made policy?
- No. It is an outline to adapt to your jurisdiction, firm size and tools.
- Is there a download?
- No. Everything is on this page.
- Do small firms need an AI policy?
- A short written policy is useful even for a solo practitioner, because it forces you to decide what never goes into a tool.
- Who should approve tools?
- A named partner or the person responsible for risk, ideally with IT advice.
About the author
Raghav Handa trained as a lawyer, then spent years building legal technology, from enterprise legal products to custom systems for law firms.
Keep reading
- AIAI prompts for lawyers: 14 copy-and-paste prompts with placeholdersA library of 14 AI prompts for lawyers with [placeholders]: summaries, issue lists, email drafts, checklists and review prompts. Use them on non-confidential text.4 min read · 17 October 2026
- AIAI workflows for lawyers: five repeatable, reviewable processesFive practical AI workflows for a law practice, from intake triage to weekly reviews, each with a human checkpoint, a data rule and a place to record the result.3 min read · 17 October 2026
- AIUsing ChatGPT for legal work: safe uses, settings and limitsHow lawyers can use ChatGPT cautiously: low-risk tasks, data-control settings to check, verification habits and the mistakes that get lawyers sanctioned.3 min read · 17 October 2026
- LibraryHow to write AI prompts as a lawyer: the five-part formulaA simple five-part formula for writing AI prompts in legal work, with before-and-after examples, common mistakes and a checklist for reviewing what comes back.3 min read · 17 October 2026