An AI policy for law firms is a one-page set of working rules: which AI tools the firm approves, what client information never goes into them, who reviews AI output, and how use is logged. It gives every attorney, paralegal and staff member the same answer before they paste anything. It does not settle the ethics questions; your firm's attorneys own that review.
This post is for managing partners and office managers at small firms who want a written starting point. Our general AI policy for small business covers the basics for any company. Here we go further into what a law office needs, with a sample you can adapt. It is an operational template, not legal advice.
Why a law office needs its own version
A law office needs its own version because a general policy says "keep private information out," and in a law office almost everything is private. Client names, facts, strategy, drafts and even the fact that someone called can be confidential. So the rules need to be sharper.
Missouri's rules for lawyers (opens in a new tab) require reasonable efforts to prevent unauthorized access to, or accidental release of, client information. A law firm's policy also has more people to cover. Attorneys, paralegals, intake staff, contract help and outside vendors may all touch AI tools. Each needs to know the same limits. And the firm's duty to supervise does not stop at the edge of a software screen. Our broader guide to AI for Kansas City law firms shows where AI fits day to day. The policy is the fence around it.
What should never go into an AI tool?
Client confidences should never go into a public AI tool or a personal account. If the firm has not approved a tool for client work, nothing from a client file goes in. That includes privileged notes, sealed material, trust account details and prospective client facts.
Keep this list on the page, in plain words:
- Client names and facts in any public or personal AI tool.
- Privileged communications, strategy notes and work product.
- Anything sealed or covered by a protective order.
- Opposing party details and witness information.
- Logins, account numbers and trust account details.
- Prospective client facts from intake calls or forms.
The firm can approve a private tool for some client work, with the right controls. The FTC's guide to protecting personal information (opens in a new tab) advises keeping only the information you need and limiting access to the people who need it. Our post on private AI for small business explains how private and on-premise models differ from public AI tools. For the questions clients ask about data, see is AI safe for my business data.
A sample AI policy for law firms
Copy this law firm AI policy template, fill in the words in capitals, and have your attorneys review it before anyone signs. It covers approved tools, client information, attorney review, source checks, limits on AI judgment, client-facing disclosure, logging and training.
AI use policy for FIRM NAME
- Approved tools. Use only the AI tools on the firm's approved list, through firm accounts. POLICY OWNER keeps the list.
- Client information. Client and prospective client information goes only into tools the firm has approved for client work. Never into a public tool or a personal account.
- Attorney review. An attorney reviews every AI-assisted draft before it is filed, sent or relied on. Drafts are labeled DRAFT until then.
- Check every source. Every citation, quote and fact from an AI tool is checked against the original source by a person.
- No legal judgment by AI. AI does not decide whether to take a matter, give advice, calculate deadlines, set fees or speak for the firm.
- Client-facing AI. Any AI that talks with callers says it is an AI in a short, friendly line, and asking for a person always works.
- Logging. Use of approved tools on client work is logged. Report any mistake or misplaced information to POLICY OWNER at once.
- Training and review. Everyone is trained before first use. POLICY OWNER reviews this page on a set schedule and when a new tool is added.
Add a signature and date line. New hires sign it with their onboarding papers.
What is ABA Formal Opinion 512?
ABA Formal Opinion 512, "Generative Artificial Intelligence Tools," was issued on July 29, 2024 by the ABA Standing Committee on Ethics and Professional Responsibility. It is advisory guidance that looks at how existing duties apply to AI use. Your attorneys decide what it means for your firm.
Its topics include competence, confidentiality, communication with clients, supervision, candor and reasonable fees. It does not bind any state. We mention it so your attorneys know where to start reading. They decide what it means for your firm.
What about an AI policy for law firms in Kansas or Missouri?
State bars may publish their own guidance, and it can change. If you search for an AI policy for law firms in Kansas, check with the Kansas or Missouri bar, as applies, and your own attorneys first. A firm with attorneys licensed in both states needs someone watching the guidance in each one.
Many firms in the Kansas City metro have attorneys licensed on both sides of the state line. The policy should name who checks each state's guidance and how often. That one line keeps the job from falling through the cracks.
How do you keep the policy alive?
A law firm keeps its AI policy alive with short training, one named owner and a real log of tool use. A policy only works if people use it day to day, and those habits make it part of the routine. Reviews then become a quick lookup instead of a guess.
Three habits help:
- Short training. Walk through each rule with an example from your own practice areas, such as an intake summary or a routine letter.
- One owner. Questions go to one named person, not to whoever is nearby.
- A real log. The approved tools record what was done and when, so a review is a lookup, not a guess.
A policy also makes the next step easier. Our guide to AI for small business covers where AI helps an office first, once the rules are in place.
We build private AI setups for firms that want more than a policy on paper. On our Solutions page you can see the custom systems we build: software shaped around how a firm takes in, checks, onboards, drafts, calendars and bills matters, tied into the tools it already uses, with AI doing the repeat work and people deciding. Off-the-shelf AI tools make you work their way; a build fits yours. In those builds, client files stay on private and on-premise models, not public AI tools, and nothing from them is used to train AI models. Each part gets only the access its job needs, the principle NIST calls least privilege (opens in a new tab), and it is built so each action is logged in a record that shows any later edit. Our Security page has the details. Depending on the investment package you choose, you get either the right to use the software we build for you or full ownership of it. Your data and logins stay yours.
What stays with the attorneys
Ethics review, legal judgment, client acceptance and conflicts, fees and deadlines stay with the attorneys. The policy covers tools, but it does not move any judgment off an attorney's desk. Every filing, letter and client message about a matter is reviewed by an attorney before it goes out.
These stay with a person:
- Ethics review. Your firm's attorneys own the ethics and professional-responsibility review of the policy and of every tool.
- Legal judgment. Advice, strategy and what any rule allows.
- Acceptance and conflicts. Who the firm takes on, and who it does not.
- Fees and deadlines. People set fees. People set and check deadlines; software only reminds.
- Anything with legal weight. Every filing, letter and client message about a matter is reviewed by an attorney before it goes out.
Same team. Same jobs. More capacity.
A two-state firm adapts the sample
This is an illustration, not a customer story. A four-attorney firm in the Kansas City metro handles family law and estate planning. Two attorneys are licensed in Missouri, two in both states. The office manager fills in the sample and takes the policy owner role.
The partners add one line: a Kansas-licensed partner checks Kansas bar guidance and a Missouri-licensed partner checks Missouri guidance, each on a set schedule. They approve one private drafting tool for client work and ban all others for client files. At a staff lunch, everyone reads the page out loud and signs it. When a paralegal asks whether an intake summary can go into a free chat tool, the answer is already on the page: no.
Frequently asked questions
Can we just ban AI at the firm?
You can, but people may still use it on their own phones. A clear policy with approved tools usually gives the firm more control than a ban. Your attorneys decide which path fits.
Is this sample policy enough on its own?
It is a starting point, not legal advice. Your attorneys should review it against the guidance in each state where they practice. Adjust it to your practice areas and staff.
Who should own the policy?
Name one person, often the office manager or a partner. That person keeps the tool list, answers questions and schedules reviews. The attorneys still own the ethics review.
Next step
If you want a private AI setup to go with your policy, book a free workflow consult. We work from the Kansas City metro and are glad to sit down at your office or talk by video. We look at which tasks your staff would hand to AI first, what client information they touch, and what a private build on our Solutions page would look like for your firm.
About the ScaleAlphaAi team
We are a Kansas City company that designs and builds AI agents and custom software for small businesses, trades and growing firms. We write these guides from our work with owners and office teams: what AI handles well, what stays with your people, and how to start with one workflow.
Meet the team
