A practical overview of the ethical duties lawyers should evaluate when using generative AI.
The duties most often implicated
- Competence: understand enough about the tool’s benefits and risks to use it responsibly.
- Confidentiality: evaluate what information is entered, how the vendor handles it, and whether consent is needed.
- Communication: tell clients when AI use is material to the representation or required by applicable rules.
- Candor and accuracy: verify outputs before presenting them to courts, clients, or third parties.
- Supervision: lawyers remain responsible for staff and nonlawyer assistance, including AI-enabled workflows.
- Fees: billing must remain reasonable and accurately reflect the work performed.
What ABA Formal Opinion 512 says
The ABA’s 2024 opinion explains that lawyers using generative AI must consider competence, confidentiality, client communication, candor, supervision, and fees under existing Model Rules. It doesn't create a universal checklist for every jurisdiction; lawyers should also review state-specific authority.
Build ethics into the workflow
- Before useApprove the tool, account, data category, and task.
- During useLimit inputs, document sources, and keep a human responsible.
- Before releaseVerify law, facts, citations, confidentiality, advertising claims, and client impact.
- After useMonitor incidents, vendor changes, and policy gaps.
AI marketing has ethics too
Website copy, newsletters, chatbots, ads, and intake automations can implicate advertising, confidentiality, supervision, and misleading-communication rules. “It was generated by AI” isn't a defense for a false claim.
This article is general marketing and technology information, not legal advice. Rules, products, and platform practices change; confirm current requirements for your firm and jurisdiction.
Confidential information and AI tools
Lawyers shouldn't place confidential information into an unapproved AI tool merely because it's convenient. The analysis depends on the information, the product and plan, security and retention terms, access controls, vendor diligence, client expectations, and applicable professional obligations.
Ask these questions first
- Is client information necessary for the task?
- Can it be removed, generalized, or replaced?
- Which exact account and settings are being used?
- How is data stored, retained, accessed, and used?
- Has the firm approved the vendor and workflow?
- Is client communication or consent required?
- Who verifies the output?
Use a data-minimization ladder
Prefer public information, then invented examples, then sanitized internal text. Use identifiable client information only when the firm has completed the appropriate legal, security, and vendor review.
Marketing teams need the policy too
Intake notes, testimonials, case outcomes, photos, and draft client stories may all contain sensitive information. The AI policy must cover nonlawyer staff and outside vendors, not only attorneys.