AI Policy Template for Small Law Firms (Free, Based on 2026 Ethics Guidance)

By The Professions Cloud Editors Updated October 2026 · 5 sources · 7 min read

Prices and facts checked October 17, 2026. We don't accept payment for rankings.

Why you need one: ethics guidance now expects firms to have a written AI policy. ABA Formal Opinion 512 says firms must give lawyers and staff clear policies on generative AI (National Law Review). California's 2026 guidance says supervisory lawyers "should establish clear policies," including for agentic AI, and train staff periodically (State Bar of California).

Below is a template a small firm can adapt in an afternoon, followed by the authority behind each section.

What the guidance requires a policy to cover

Sources: National Law Review on ABA 512; State Bar of California; North Carolina State Bar; Wilson Elser.

The template

[Firm name] Policy on the Use of Artificial Intelligence

Effective date: [date] · Policy owner: [name, role] · Next review: [date, no more than 12 months away]

1. Purpose and scope. This policy covers every use of artificial intelligence (AI) tools, including generative AI and agentic AI, by all lawyers, paralegals, staff and contractors working on firm or client matters, on firm or personal devices.

2. Approved tools. Only tools on the firm's approved list may be used for client work. The current list is: [tool name, plan/tier, approved uses]. To request a new tool, ask [policy owner], who will review it under section 4 before approval.

3. Prohibited uses.

• No client names, facts, documents or other confidential information in any tool that is not on the approved list, including free or personal AI accounts.
• No AI tool may file documents, communicate with a court, send advice to a client, or transmit client information outside the firm without a lawyer's review and approval.
• No AI-generated citation, quotation or statement of law may be used without being checked against the original source.

4. Vetting a tool. Before approval, the policy owner will confirm in writing:

• whether the vendor uses our inputs to train its models (approved tools must not);
• how long the vendor keeps prompts, uploads and outputs, and how they are deleted;
• who at the vendor can access our data, and where it is stored;
• the vendor's security measures, including any independent certification;
• what happens to our data if we stop using the service.

5. Client communication and consent. Lawyers will tell clients when AI materially affects how their matter is handled or billed. Before confidential client information is used in a tool that presents material confidentiality risks, the responsible lawyer will obtain the client's informed consent after explaining the risks. A general clause in an engagement letter is not enough on its own. Lawyers will follow any client instructions or outside counsel guidelines that restrict AI use.

6. Review and verification. The lawyer responsible for a work product is responsible for everything in it, whoever or whatever drafted it. All AI output must be reviewed for accuracy, completeness and bias before use. Every citation in a court filing must be read in the original by a lawyer.

7. Court rules. Before filing, check the court's rules and standing orders for AI disclosure or certification requirements and comply with them.

8. Billing. Hourly bills reflect time actually spent, including time spent prompting and reviewing AI output. We do not bill for time saved or for learning a tool. Subscriptions for general-purpose AI tools are overhead. Matter-specific AI costs may be billed only if the fee agreement says so, at actual cost, with no markup unless the client gives informed written consent.

9. Records and retention. AI prompts and outputs used on a matter are part of the firm's records. They are kept under our retention schedule and included in litigation holds. [Name the systems where AI interactions are stored, e.g. Microsoft 365 Copilot.]

10. Training. Everyone covered by this policy completes AI training when they join and at least [annually], covering this policy, approved tools, hallucinations and confidentiality.

11. Incidents. If confidential information goes into an unapproved tool, or an AI error reaches a client, court or opposing party, report it to [policy owner] immediately. The firm will assess its notification and correction duties.

12. Review. The policy owner reviews this policy and the approved tool list at least every [12] months, and whenever we adopt a tool with new capabilities such as agentic features.

Acknowledged by: ______________________ Date: __________

Why each section is there

Approved tools and vetting (sections 2 and 4). North Carolina's 2024 FEO 1 tells lawyers to evaluate a vendor's security, reputation, data handling terms, and how data is retrieved or destroyed when the service ends. It also says lawyers should avoid putting client-specific information into publicly available AI tools (North Carolina State Bar). California adds that reasonable efforts require "more than reliance on generalized marketing assurances" (State Bar of California). Courts are moving the same way: a Colorado protective order in Morgan v. V2X barred putting confidential material into AI tools unless the provider is contractually barred from training on it and from disclosing it (ComplexDiscovery).

Prohibited agentic actions (section 3). California's 2026 guidance is the first major guidance to address agentic AI directly. Lawyers must not let agents autonomously file documents, communicate with the court, or transmit client information without safeguards and human review (State Bar of California). This matters as AI agents arrive in everyday software, such as Microsoft Copilot for Legal.

Consent (section 5). ABA 512 says general, boilerplate engagement-letter provisions aren't sufficient for informed consent (National Law Review). North Carolina says routine uses such as research don't usually need disclosure, but AI doing substantive work is like outsourcing and needs advance informed consent (North Carolina State Bar). Our ABA Opinion 512 guide covers this in detail.

Verification (sections 6 and 7). California says the duty of candor "cannot be delegated" to AI (State Bar of California). A March 2025 Stanford study cited by Wilson Elser found legal research tools hallucinating 17% to 33% of the time (Wilson Elser). See the cases in our AI hallucination sanctions tracker.

Billing (section 8). North Carolina says you can't bill for the time a task would have taken without AI (North Carolina State Bar). California treats general AI subscriptions as overhead and allows matter-specific AI costs only at actual cost, with no markup without informed written consent (State Bar of California). Some firms now give lawyers billable credit for AI training time, which is an internal policy, not something clients pay for (our guide).

Records (section 9). AI interactions can be discoverable. Microsoft 365 Copilot, for example, stores prompts and responses in a hidden mailbox folder that eDiscovery tools can search (ComplexDiscovery). Privilege isn't guaranteed either (our Heppner guide).

How to roll it out

1. List what people already use. Ask everyone, including staff, which AI tools they use for work today.
2. Vet and approve 1–3 tools. Start with what you already pay for. Our best AI tools for small firms and legal AI vs ChatGPT guides can help.
3. Update your engagement letter. Add a short AI disclosure, and remember it doesn't replace informed consent for risky uses.
4. Train, then get signatures. A one-hour session plus a signed acknowledgment is a practical baseline.
5. Diary the review. Tools change quickly, so review the policy every year at minimum.

FAQ

Do small law firms need a written AI policy?

Ethics guidance strongly points that way. ABA Formal Opinion 512 says firms must give lawyers and staff clear policies on generative AI, and California's 2026 guidance says supervisory lawyers should set policies and train staff.

Can lawyers put client information into ChatGPT?

Not into public or consumer AI tools without safeguards. North Carolina says lawyers should avoid putting client-specific information into publicly available AI, and California requires informed consent before confidential information goes into tools with material confidentiality risks.

Can a law firm bill clients for AI subscriptions?

General AI subscriptions are usually overhead. California allows matter-specific AI costs to be billed at actual cost if the fee agreement discloses it, with no markup unless the client gives informed written consent.

Changelog: Oct 17, 2026: first published.