The ABA Model Rules applied to cloud tools and AI: what each rule asks of a lawyer

No ABA Model Rule names Notion, Clio or ChatGPT. What they do is set duties that follow the lawyer into whatever tool they use. Six rules do most of the work for cloud and AI: competence, communication, confidentiality, fees, supervision and candour to the tribunal. States adopt their own versions, so your state's rules and opinions are what bind you. This page describes the Model Rules in general terms and is practical information, not legal advice. Read the current text of each rule and opinion. It goes rule by rule, summarises the formal opinions, applies them to scenarios and ends with a reasonable approach you can adopt.

The six rules and what they ask

Rule by rule, applied

Competence (Rule 1.1)

The rule requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation. The comment on maintaining competence says a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology. For cloud and AI tools, competence means you can explain what the tool does, what data it holds, how it fails, and what the safeguards are, or that you have access to someone who can. It does not require you to be a technologist; it requires you not to use a tool you do not understand on client matters.

Communication (Rule 1.4)

Clients must be kept reasonably informed and told enough to make informed decisions about the representation. Where a tool materially affects the work (for example, AI is used to draft substantial parts of advice) or where client information is entered into a service in a way that creates risk, communication may require telling the client and, in some circumstances, obtaining informed consent. See the client AI consent template.

Confidentiality (Rule 1.6)

A lawyer may not reveal information relating to the representation without consent or an exception, and must make reasonable efforts to prevent the inadvertent or unauthorised disclosure of, or access to, such information. The commentary lists the factors bearing on reasonableness: the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of additional safeguards, the difficulty of implementing them, and the extent to which they adversely affect the lawyer's ability to represent clients. Applied to tools: a more sensitive matter justifies more safeguards; a cheap, effective safeguard (multi-factor authentication, turning off public sharing) is hard to justify omitting.

Fees (Rule 1.5)

Fees must be reasonable, and billing for time not spent is improper. Technology that makes work faster raises a pricing question: hourly billing should reflect time actually spent; fixed or value-based fees can reflect the value of the outcome. Overhead such as software subscriptions is generally not separately billable unless the client agrees.

Supervision (Rules 5.1 and 5.3)

Partners and supervising lawyers must make reasonable efforts to ensure that lawyers and non-lawyer assistants comply with the rules. The commentary to Rule 5.3 addresses non-lawyers outside the firm, such as an outside service provider handling client information, and indicates that the lawyer should make reasonable efforts to ensure the services are provided in a manner compatible with the lawyer's professional obligations. That is the foundation of vendor due diligence (see the vendor checklist), and it extends naturally to supervising AI output as you would a junior's work.

Candour to the tribunal (Rule 3.3)

A lawyer must not knowingly make a false statement of law or fact to a tribunal, and must take reasonable remedial measures on learning of material falsity in material offered. AI-generated submissions containing invented authorities have led courts to sanction lawyers. The safeguard is the same as ever: read the authority, in a primary source.

The formal opinions to read

Opinions are persuasive guidance rather than law, and your state bar may have its own opinions on cloud computing and AI (the ABA publishes a survey of state cloud opinions). Check the current text and your state's position at the ABA Center for Professional Responsibility and your own bar.

Generative AI: the questions Opinion 512 raises

• Competence: understand the tool's capabilities and limits, and review output; there is no safe harbour for blind reliance.
• Confidentiality: entering client information into a tool that may retain or reuse it creates risk; assess the tool's terms, and in some circumstances obtain informed consent before inputting confidential information.
• Communication: consider whether to tell clients, particularly where AI use is significant or the client asks.
• Supervision: firms should have policies and training; supervisors are responsible for others' AI use.
• Candour: verify citations and facts before filing; correct errors.
• Fees: bill for time actually spent, and be transparent about how AI affects fees.

Seven scenarios

A reasonable approach: six verbs

1. Understand the tool: what data it receives, where it goes, how long it is kept.
2. Configure it: access control, multi-factor authentication, sharing off by default.
3. Restrict what goes in: tier your data and write down what never goes in.
4. Verify outputs before they reach a client or court.
5. Tell clients where the rules or the matter require it.
6. Record the decision, and review it at least yearly.

State variation: what to check

• Whether your state has adopted the technology-competence comment to Rule 1.1.
• Whether your bar has issued cloud-computing and AI opinions.
• Any state rules on data breach notification (separate from ethics rules).
• Rules on trust accounting records and the use of third-party systems for them.

More: can lawyers use Notion for client data?, do lawyers need bar-approved software?, is Notion AI safe for confidential legal work? and the ethics of using AI in legal practice.

Frequently asked questions