Most solo attorneys use AI without a written policy. They have assessed the tools informally, developed habits around verification, and have a sense of what client information they are and are not comfortable sharing. That informal understanding works until it doesn't — until a client asks how their information is being handled, until an associate or contract attorney joins the practice and uses AI differently than you intended, or until a disciplinary complaint raises questions about how AI was used in a specific matter.

A written AI use policy is not bureaucracy. It is the document that makes your informal understanding explicit, protects you from the questions that arise in the absence of clarity, and meets the supervisory duty that ABA Formal Opinion 512 places on supervising attorneys. For a solo, it is a one-page practice standard. For a small firm, it is the shared framework that governs everyone who touches a matter.

This guide covers what a law firm AI use policy needs to address and why each element matters.

Why a written policy, even as a solo

ABA Formal Opinion 512 addresses the supervisory duties under Rules 5.1 and 5.3: supervising attorneys must ensure that AI is used in compliance with the Rules of Professional Conduct. For a solo, you are your own supervisor — but the obligation is still to have a framework, not just habits.

A written policy does four things for a solo practice:

Creates a clear standard. When your policy says "no client information on a consumer-tier account," that standard is applied consistently whether you write the brief on a Tuesday or a Saturday at midnight when you're moving fast. Explicit standards survive the moments when judgment is under pressure.
Demonstrates compliance. If a question ever arises about how AI was used in a matter — in a bar complaint, a malpractice claim, or a client inquiry — a written policy with dates is evidence of a deliberate compliance framework, not just a claim that you handled it right.
Scales when you add people. Even solos bring in contract attorneys, law clerks, or paralegals. Your AI policy governs everyone who works on your matters, from day one. That requires the policy to be documented, not held in your head.
Forces you to think it through once. The exercise of writing the policy — deciding which tools are approved, at which tier, under which DPA — is the compliance exercise. The document is the output.

What the policy needs to cover

1. Approved tools and account tiers

The policy should specify which AI tools your practice uses and at which account tier — consumer, professional, business, or enterprise. For each approved tool, document:

The tool name and vendor
The account tier (and what confidentiality commitments that tier provides)
Whether a data processing agreement is in place (and where to find it)
What the tool is approved for (research, drafting, billing narratives, client intake — be specific)

Why this matters: Knowing which tools are approved prevents a contractor or new associate from using a consumer-tier account that your firm doesn't have a DPA for. The approved tool list is the decision your policy operationalizes.

2. Confidentiality requirements

Specify when client information may and may not be entered into an AI tool:

Client information — names, matter details, documents — may be entered only into tools on the approved list, at the approved tier, with the DPA in place
Information should be anonymized or abstracted where the task permits it (the minimum-necessary principle)
No client information on unapproved tools or unapproved account tiers, regardless of time pressure

Why this matters: This is the Rule 1.6 obligation made operational. For a detailed analysis of the confidentiality question and the tier framework, see client confidentiality and AI tools.

Warning

A gap in your policy's confidentiality requirements is typically where problems start — usually because someone used a convenient free-tier account when the approved enterprise account wasn't immediately available. Make the friction of using an unapproved tool explicit, and name it in your policy.

3. Verification requirements

Specify what review is required before AI-generated content is used in a client matter or filed with a court:

All AI-generated legal citations must be verified in Westlaw, Lexis, or another authoritative citator before filing or relying on them
AI-generated factual summaries or descriptions of documents must be checked against the underlying source
AI-generated drafts are first drafts requiring attorney review, revision, and professional judgment before use
AI output must never be submitted to a court, opposing counsel, or a client without attorney review

Why this matters: The judicial sanctions since 2023 all involved a failure to verify. This section of your policy is what makes the competence and supervision duties concrete — and what protects you if a question ever arises about a specific piece of AI-assisted work.

4. Client communication and disclosure

Specify your practice's approach to informing clients about AI use:

Address AI use proactively in your engagement letter — a brief, plain-English statement of what AI is used for and what confidentiality protections apply
Follow any client instructions about AI use, and confirm compliance in writing when the client has asked for restrictions
Monitor your state bar's guidance on disclosure requirements, which may require more than your engagement letter covers

Why this matters: ABA Formal Opinion 512 addresses when disclosure may be required; some state bars have gone further and imposed affirmative requirements. Your policy should reflect your current obligations and be updated as guidance evolves.

5. Billing guidelines

Specify how AI use affects how matters are billed:

Bill AI-assisted tasks for the time they actually take, not the time they would have taken without AI
AI tool subscription costs are overhead and are not billed to individual clients as a matter expense unless the fee agreement specifically provides otherwise
Do not adjust flat fees upward to capture time the AI effectively eliminated

Why this matters: Rule 1.5's reasonableness requirement and ABA Formal Opinion 512's specific fee analysis make this an active compliance area. See billing ethics of AI-assisted legal work for the full analysis.

6. Responsibility and supervision

Specify that AI use does not reduce anyone's professional responsibility for work product:

The attorney whose name is on any document reviewed, signed, or submitted is responsible for its contents, regardless of how AI was used in preparing it
AI tool output is treated as work product of a non-lawyer assistant, requiring attorney review and verification before use
Any use of AI in a matter is documented in the matter file in a manner consistent with your billing and file practices

Why this matters: The supervisory duty under Rules 5.1 and 5.3, and the bar complaints that have arisen since 2023, both confirm that professional responsibility follows the attorney, not the tool.

A sample policy structure

The following is a framework. Adapt it to your practice; get your own counsel if you need a policy reviewed before relying on it.

[Your Firm Name] AI Use Policy — Effective [Date]

Purpose: This policy governs the use of generative AI tools by all attorneys, staff, and contractors working on matters of [Firm Name] (the Firm). It is intended to ensure compliance with applicable Rules of Professional Conduct, including the professional responsibility framework set out in ABA Formal Opinion 512.

Approved tools: The Firm currently uses [list tools, tiers, and DPA status]. This list is maintained by [name/role] and is updated when tools or terms change.

Confidentiality: Client information — names, matter details, and documents — may be entered only into approved tools at approved account tiers for which a data processing agreement is in place. Where a task can be accomplished without sharing identifying client information, information must be abstracted or anonymized.

Verification: All AI-generated legal citations must be verified in [Westlaw/Lexis/other] before filing or relying on them. AI-generated drafts require attorney review before use in any client matter.

Billing: AI-assisted tasks are billed for actual time spent, not pre-AI time. AI tool costs are not billed as matter expenses. Flat fees are not adjusted upward to account for time AI eliminated.

Disclosure: The Firm addresses AI use in engagement letters. Client instructions regarding AI use are honored and documented.

Responsibility: The supervising attorney on any matter is responsible for the use of AI on that matter and for the accuracy of any AI-assisted work product.

Updates: This policy is reviewed when ABA or state bar guidance is updated or when the Firm adds or changes AI tools.

Tip

If you use the firm's AI policy in your engagement letter — "our AI use policy, available on request, governs how we use AI tools in your representation" — you create a durable link between your client communication and your compliance framework, without needing to reproduce the whole policy in every letter.

Keeping the policy current

Vendor terms change. Bar guidance evolves. New tools emerge. A policy written in early 2025 may not reflect current vendor commitments or current state bar positions in late 2026.

Build a review cycle into the policy itself — annual at minimum, and immediately when any approved vendor changes its terms or your state bar issues new guidance. The moment a vendor updates its data handling terms, the question of whether that tier still meets your confidentiality commitments is back on the table.

For the current state of state bar guidance, see state bar AI guidance by state. For the full ABA ethics analysis, see ABA Formal Opinion 512 explained.

Writing Your Law Firm's AI Use Policy: What to Include and Why It Matters