Firm Level Policy, Supervision and Training Records
Every law firm using AI should have a documented policy governing use. This policy should be approved by firm leadership, communicated to all staff and kept current.
The policy should start with principles. Principle 1: all AI use must comply with professional conduct rules. Principle 2: verification is mandatory for all AI output used in client work. Principle 3: client consent must be obtained and documented before using AI on client matters. Principle 4: confidentiality and privilege must be protected.
The policy should list the AI tools the firm permits. Do not permit all tools. Permit only tools that have been evaluated and approved. Maintain a list of approved tools and update it regularly. If a tool is approved by IT but has high confidentiality risk, do not approve it for client work. Segregate approval by risk. A tool might be approved for internal administration but not for client work.
The policy should set out restrictions on use. Never use AI for time-sensitive matters where verification is not possible. Never use AI for high-risk matters such as evidence in active litigation without very careful verification. Never send privileged client information to public cloud AI tools without documented client consent. Never use AI to generate false citations or misleading statements.
The policy should address supervision. Who supervises AI use? In a small firm, this might be the managing partner. In a large firm, this might be a designated AI governance committee. Whoever supervises should have authority to audit AI use, to withdraw approval for a tool if problems emerge, and to require training for staff.
Training is essential. Every lawyer and paralegal who uses AI should receive training on the firm’s policy and on the risks of AI. Training should cover: how the AI tools work and their limitations, what can and cannot be done with each tool, how to verify output, how to document AI use, what to do if an error is discovered. Training should be mandatory and documented.
The training record should include the date, the topics covered, the staff member’s name and initials, and a summary of key learning points. Keep these records. If a question later arises about whether a staff member understood the risks, the training record is evidence that they did.
Supervision should include spot checks. Periodically, the supervisor should review a sample of work to which AI was applied. Check that verification was done properly. Check that client consent was obtained. Check that confidentiality was protected. If problems are found, provide corrective training to the individual and update the policy if needed.
The policy should address incident reporting. If a staff member discovers that AI generated a fabricated citation that was used in advice to a client, what should they do? The policy should require reporting to the supervisor or designated committee immediately. The committee should then assess whether the client needs to be notified and whether the matter should be reported to the regulator.
The policy should also address AI used by clients. If a client tells you they used AI to prepare documentation they are now relying on, your firm’s policy should address whether you can rely on it or whether you need to verify it independently. The safe approach is to treat client AI work the same as client work generally: verify important facts and claims.
Document the policy in writing. The policy should be signed by the person approving it (usually the managing partner or partners). It should be dated and versioned. Keep records of when it was communicated to staff and when updates were made.
The policy should be reviewed annually. If new AI tools are adopted, if new risks are identified, or if case law changes, update the policy. Communicate updates to staff and provide refresher training if significant changes are made.
Ultimately, the policy exists to protect the firm and its clients. It codifies standards that should already be followed but makes them explicit and enforceable. A firm with a clear AI policy and good compliance with it is less likely to face complaints about AI use.