Law firms

AI governance for law firms

AI governance for a law firm is the set of policies, supervisory structures, and records through which the firm ensures that every use of AI by its lawyers and staff is consistent with the rules of professional conduct. In the United States the baseline is ABA Formal Opinion 512, and California has proposed amending six of its rules to address AI directly. In the UAE, the Ministry of Justice issued guiding principles for law firms in September 2026.

Last updated 21 October 2026

Advisory for law firms

The national baseline

What ABA Formal Opinion 512 requires

ABA Formal Opinion 512, issued on 29 July 2024, creates no new rules. It applies the existing Model Rules of Professional Conduct to generative AI, and in doing so converts general duties into specific expectations of firms. Read duty by duty, it is a specification for a governance program.

Competence Rule 1.1: A lawyer need not be an expert in AI, but must have a reasonable understanding of the capabilities and limitations of the tools in use, and must review output with the degree of independent verification the task requires.
Confidentiality Rule 1.6: Before client information enters a tool, the lawyer must assess the risk that it will be disclosed or accessed, within the firm or outside it. For self-learning tools the opinion calls for the client's informed consent, and boilerplate language in an engagement letter does not suffice.
Communication Rule 1.4: Whether the client must be told turns on the circumstances, including whether the client has asked, whether the use bears on the fee or on significant decisions in the representation, and what the engagement agreement provides.
Candor Rules 3.1, 3.3, 8.4(c): Submissions must be checked for fabricated authority and for misstatements of law or fact. Unverified output that reaches a tribunal is the lawyer's own statement.
Supervision Rules 5.1, 5.3: Managerial lawyers must establish clear policies on the firm's permissible use of generative AI, and supervisory lawyers must take reasonable steps to ensure that lawyers, nonlawyer staff, and third-party providers comply.
Fees Rule 1.5: Hourly billing must reflect time actually spent, so a firm may not bill for time the tool saved. General overhead ordinarily stays with the firm; the cost of a tool used on a specific matter may be charged where it is reasonable and disclosed.

Primary source: ABA Formal Opinion 512, Generative Artificial Intelligence Tools (PDF)

California

California's proposed AI amendments to the Rules of Professional Conduct

In 2026 the State Bar's Committee on Professional Responsibility and Conduct (COPRAC) proposed amendments to the comments of six California rules. After a first public comment period closed on 4 May 2026, COPRAC approved modified proposals on 12 June 2026 for a second 45-day comment period, which closed on 6 August 2026. No adoption date has been announced. Separately, the Board of Trustees approved updates to the State Bar's Practical Guidance for the Use of Generative AI in May 2026.

Rule 5.1: Managerial lawyers would be expected to make reasonable efforts to establish internal policies and procedures governing the use of AI.
Rule 5.3: Instruction and supervision of nonlawyer assistants would expressly extend to their use of technology, including AI.
Rule 1.1: Lawyers would exercise professional judgment over inputs and outputs, and would verify that authorities cited to clients or other parties exist and are accurate.
Rule 1.6: To reveal confidential information would include exposing it to a technological system, including an AI tool, where there is a substantial risk of use inconsistent with the duty of confidentiality. Relevant factors include data retention, use for model training, security, and third-party access.
Rule 1.4: The duty to keep clients reasonably informed would include evaluating what to communicate about the lawyer's use of AI, throughout the representation.
Rule 3.3: Candor to the tribunal would include verifying the accuracy and existence of cited authorities, including authorities generated or suggested by AI, before submission.

For a California firm, the consequence is that a written AI policy moves from prudent to expected, and the managing partner's role in it becomes a question of professional responsibility. The California endorsement of the Solari Institute's credential, AGL USA-CA, is examined against these rules and is a State Bar of California approved MCLE activity.

Primary sources: State Bar of California, proposed amendments related to artificial intelligence · State Bar of California, Ethics and Technology Resources

The policy

What a law firm AI policy covers

A template supplies the headings. What makes a policy defensible is the record beneath it: who approved each tool, on what diligence, for which uses, and how compliance is checked. A complete policy addresses the following.

Scope: the tools, people, and matters it reaches, including personal accounts used for firm work
Approved tools, and the process and diligence required to approve a new one
Permitted and prohibited uses, by task and by category of client information
Confidentiality controls tied to each vendor's retention, training, and access terms
Verification standards for research, drafting, and every citation placed before a tribunal
Client communication and consent, including engagement-letter terms
Billing rules for AI-assisted work
Supervision, training, and periodic attestation
Incident response when an error reaches a client or a court
Ownership and a fixed review cycle

Accountability

Who owns AI governance inside the firm

Because Rules 5.1 and 5.3 place the duty on managerial and supervisory lawyers, AI governance belongs to a named partner with authority to set policy and to answer for it, typically the managing partner or the firm's general counsel. A small committee drawing on knowledge management, information security, and risk supports that partner. Assigning the function to IT alone leaves the professional-responsibility questions without an owner.

Why verification is a governance problem

In Mata v. Avianca, Inc. (S.D.N.Y. 2023), lawyers were sanctioned for a brief that cited cases which did not exist, and courts in many jurisdictions have since sanctioned comparable filings. Each failure was a failure of process before it was a failure of judgment: no verification step stood between the tool and the court.

Insurers and clients now ask

Professional liability brokers report that carriers are reviewing law firms' AI governance at renewal, and corporate clients include AI questions in outside-counsel guidelines and audits. A firm that can produce its policy, its register of approved tools, and evidence of supervision answers both from the same record.

Source: Gallagher, AI governance is not an attorney decision (September 2026, PDF)

United Arab Emirates

AI governance for law firms in the UAE

On 29 September 2026, at the 15th United Nations Congress on Crime Prevention and Criminal Justice in Abu Dhabi, the UAE Minister of Justice launched the Guiding Principles for the Use of Artificial Intelligence Systems by Law Firms. The ten principles set a framework for responsible adoption, with particular emphasis on human review of AI output, the lawyer's responsibility for accuracy, and the protection of confidentiality. The Ministry has described them as both an incentive and a practical reference for firms.

In the DIFC, Practical Guidance Note No. 2 of 2023 sets the DIFC Courts' expectations for the use of large language models and generative AI in proceedings, including early disclosure of AI use and verification of material placed before the court. Firms that process personal data through AI systems in the DIFC must also account for Regulation 10 of the DIFC Data Protection Regulations, which governs processing through autonomous and semi-autonomous systems.

Firms practising in both jurisdictions

A single firm-wide policy can serve offices in the United States and the UAE, provided it is drafted to the stricter requirement on each point and carries jurisdiction-specific obligations as local annexes: court disclosure in the DIFC, client-communication duties in California, and data-protection terms in each. Left to individual judgment, those differences are where cross-border firms are most exposed.

For UAE practice, AGL-UAE is a Dubai Legal Affairs Department accredited CLPD course carrying 4 CLPD points.

Sources: Ministry of Justice press release (Zawya) · DIFC Courts Practical Guidance Note No. 2 of 2023

Common questions

AI governance for law firms, explained

Is it legal for a lawyer to use AI?

Yes. No US jurisdiction generally prohibits lawyers from using generative AI, though some individual judges restrict or bar its use in filings before them. The rules govern how it is used: competently, without compromising client confidences, with verification of output, under supervision, and with billing that reflects the work performed. ABA Formal Opinion 512 is the national statement of those expectations.

Do law firms need an AI use policy?

ABA Formal Opinion 512 states that managerial lawyers must establish clear policies on the permissible use of generative AI, and California's proposed comment to Rule 5.1 would make reasonable efforts to establish such policies an express expectation. A firm whose lawyers use AI without a policy carries supervisory exposure it has not assessed.

How can a law firm comply with ABA Formal Opinion 512?

By translating each duty into a control: approved tools and confidentiality assessments for Rule 1.6, verification standards for Rules 1.1 and 3.3, a client-communication standard for Rule 1.4, billing rules for Rule 1.5, and a policy with named supervisory owners for Rules 5.1 and 5.3. The documented record of those controls is what demonstrates compliance.

Can client confidential information be entered into generative AI tools?

Only after assessing how the tool handles it: whether inputs are retained, whether they train the model, who can access them, and on what contractual terms. Under Opinion 512, self-learning tools generally require the client's informed consent, and general language in an engagement letter does not suffice.

Must clients be told when AI is used on their matter?

Not in every case. Disclosure is required where the client asks, where the use affects the fee or significant decisions in the representation, where confidential information is exposed to a self-learning tool, or where the engagement agreement calls for it. California's proposed comment to Rule 1.4 would require the question to be evaluated throughout the representation.

Can a firm bill for AI-assisted work?

Yes, within Rule 1.5. Hourly billing must reflect time actually spent, so time saved by the tool cannot be billed. Flat and value-based fees remain subject to the same reasonableness test, including where AI shortens the work.

What is AGL?

AGL, AI Governance in Law, is the Solari Institute's credential for lawyers, examined against the rules of a named jurisdiction. It is offered as AGL-US; as the California endorsement AGL USA-CA, a State Bar of California approved MCLE activity; and as AGL-UAE, a Dubai Legal Affairs Department accredited CLPD course.

Does Solari advise firms in both the United States and the UAE?

Yes. Solari Advisory works with firms in both jurisdictions, including firms with offices in each that need a single governance program built to both sets of obligations.

Solari Institute · State Bar of California MCLE provider 21051 · Dubai Legal Affairs Department accredited provider TC-2026-825