Editorial guide
Law-Firm Generative AI Policy: A Practical Control Framework
A policy framework for approved uses, prohibited data, vendor review, supervision, verification, client communication, fees, and incident handling.
By Jake Bauman. Updated August 12, 2026. Educational framework only; adopt through current jurisdiction-specific counsel review. No named legal review is claimed unless identified here.
Short answer
A law-firm AI policy should define approved tools and uses, prohibited data and actions, vendor-review requirements, human supervision, source verification, client-communication decisions, billing treatment, retention, incident reporting, training, and periodic review. It should not be copied without jurisdiction-specific legal analysis.
Key takeaways
- Tie permissions to the tool, data, matter, and task rather than approving ‘AI’ generally.
- Require source verification and named responsibility for consequential work.
- Review the policy when tools, model providers, rules, client terms, or court requirements change.
Editorial methods are identified as such. Numbered links beside a paragraph or section point to the authority or framework relevant to that claim; a source does not certify Under Seal or replace current jurisdiction-specific review.
Policy scope and approvals
Basis: external sources listed below
List approved products, configurations, user roles, data classes, and use cases. State who may approve a new tool and which security, confidentiality, client, court, and contract checks must occur first. Consumer accounts and unreviewed browser extensions should not inherit approval from an enterprise or local deployment.
Sources for this section: [1] Formal Opinion 512: Generative Artificial Intelligence Tools (opens in a new tab), [2] Model Rule 1.1 and Comment 8: Competence (opens in a new tab), [5] Model Rule 1.6: Confidentiality of Information (opens in a new tab), [7] Model Rule 5.1: Supervisory Lawyers (opens in a new tab), [8] Model Rule 5.3: Nonlawyer Assistance (opens in a new tab)
Required operating rules
Basis: external sources listed below
- Do not enter client or matter information into an unapproved service
- Do not treat generated citations, quotations, dates, calculations, or legal propositions as verified
- Keep a human reviewer accountable for the final work
- Escalate suspected disclosure, fabricated authority, or harmful output
- Preserve records required by firm, client, insurer, tribunal, and law
- Communicate with clients when the governing analysis requires it
- Bill reasonably and describe AI-related charges as required
Sources for this section: [1] Formal Opinion 512: Generative Artificial Intelligence Tools (opens in a new tab), [2] Model Rule 1.1 and Comment 8: Competence (opens in a new tab), [3] Model Rule 1.4: Communications (opens in a new tab), [4] Model Rule 1.5: Fees (opens in a new tab), [5] Model Rule 1.6: Confidentiality of Information (opens in a new tab), [6] Model Rule 3.3: Candor Toward the Tribunal (opens in a new tab), [7] Model Rule 5.1: Supervisory Lawyers (opens in a new tab), [8] Model Rule 5.3: Nonlawyer Assistance (opens in a new tab)
Jurisdiction-adaptable policy specimen
Basis: editorial method
Owner: [named lawyer or committee]. Effective date: [date]. Review cadence: [interval and triggering events]. Approved tools and configurations: [register]. Approved roles, data classes, matters, and uses: [matrix]. Prohibited uses and data: [list]. Required verification and final approver: [controls]. Client, tribunal, insurer, and contract checks: [decision record]. Incident channel and stop-work authority: [procedure]. Exceptions: [named approver, reason, scope, expiry, and record].
This specimen is an editorial starting point, not a ready-to-adopt policy. Replace every bracketed field through current jurisdiction-specific, client-specific, court-specific, security, employment, records, and insurance review.
Training and review
Basis: external sources listed below
Training should use realistic failure examples: fabricated citations, wrong-page support, prompt injection inside a document, privacy leakage through support logs, and a restore that has never been tested. Record policy acceptance and refresh the program when the technology or governing authority changes.
Sources for this section: [1] Formal Opinion 512: Generative Artificial Intelligence Tools (opens in a new tab), [9] AI Risk Management Framework (opens in a new tab), [2] Model Rule 1.1 and Comment 8: Competence (opens in a new tab), [7] Model Rule 5.1: Supervisory Lawyers (opens in a new tab), [8] Model Rule 5.3: Nonlawyer Assistance (opens in a new tab)
Authorities and frameworks
Each source is classified below. It may govern a specific legal point, offer professional or government guidance, or provide a voluntary framework. The collection does not validate every editorial method in this guide and does not resolve a firm-specific question.
- [1]Formal Opinion 512: Generative Artificial Intelligence Tools Opens in a new tab. — American Bar Association · Ethics guidance
- [2]Model Rule 1.1 and Comment 8: Competence Opens in a new tab. — American Bar Association · Model rule
- [3]Model Rule 1.4: Communications Opens in a new tab. — American Bar Association · Model rule
- [4]Model Rule 1.5: Fees Opens in a new tab. — American Bar Association · Model rule
- [5]Model Rule 1.6: Confidentiality of Information Opens in a new tab. — American Bar Association · Model rule
- [6]Model Rule 3.3: Candor Toward the Tribunal Opens in a new tab. — American Bar Association · Model rule
- [7]Model Rule 5.1: Supervisory Lawyers Opens in a new tab. — American Bar Association · Model rule
- [8]Model Rule 5.3: Nonlawyer Assistance Opens in a new tab. — American Bar Association · Model rule
- [9]AI Risk Management Framework Opens in a new tab. — National Institute of Standards and Technology · Risk framework
Connect the general guidance to the product record
Continue the review
Under Seal is pre-release software, not a law firm. Do not submit matter details or client documents through this website.
Request a no-client-data readiness review