A one-page AI policy for a small law firm, aligned to ABA Opinion 512 and state guidance

What should a law firm AI policy contain?

Many firms use AI without a written policy. The North Carolina Bar's May 2026 summary of surveys, citing Clio figures that we have not checked at source, reports that most solo and small firms use AI while more than half lack a policy. Treat the figures as indicative. The practical point stands: a short written policy is cheap, and a bar or insurer may ask for one.

A usable one-page policy has nine parts: purpose and scope; approved tools; the data table below; verification; supervision; client communication; billing; incident handling; and training and review. The sections below give wording prompts. They are not legal advice and must be adapted to your jurisdiction.

Which data can go into which kind of tool?

Decide by data class and tool class. Tool class means: public consumer tool; business-tier tool with contractual confidentiality terms and no training on your data; firm-controlled tool (including a private deployment). Data class means: public information; firm-internal, no client detail; client-confidential; highly sensitive (for example health, children, criminal allegations).

The grid is a starting position for you to tighten, not a statement of what the rules allow. 'Anonymised' needs a definition: strip names, dates and unusual facts, and test whether the matter could still be recognised.

What is the verification step?

Every output used in client work is checked by a named person before use. For research, that means reading the authority itself and confirming it exists and says what the output claims. Courts have sanctioned filings containing fabricated citations; a running tally by a researcher (Charlotin's database) is cited by bar publications with different counts at different dates, so quote any number with its date and source. Our citation checklist covers the steps.

1. Record that AI was used (the AI use log).
2. Check every cited authority in a primary source.
3. Check every quotation against the source.
4. Read facts back against the file.
5. Initial and date the check.

What does bar guidance say, and where are the gaps?

This table is a map for your own reading, not a restatement of rules. Primary texts should be read in full.

Your own bar's opinion controls. If it has not spoken, ABA 512 and nearby states are persuasive, not binding.

What logs does the policy need?

A policy without records is a statement of intent. Keep three logs: a matter-level AI use log (see our log template), an incident log for anything that went wrong (wrong data in the wrong tool, a fabricated citation caught), and a training log recording who was briefed and when.

Review the policy twice a year and whenever you add a tool. Record the review date at the top of the page.

• Matter-level AI use log
• Citation verification checklist
• Legal AI ethics guide

Where MatterOS fits

Last reviewed: 30 October 2026. We make MatterOS, a Notion template for lawyers, so weigh our view accordingly. This page is organisational information, not legal advice.

MatterOS includes an AI prompt pack and Notion databases where you can record AI work against each matter; it does not make AI use compliant or enforce your policy. If you use Notion's own AI features, check the plan, the data-handling terms and Notion's current pricing before putting client material in them. MatterOS ($39 one-time) is a structure for records, not an AI governance product.

• Security and your data
• Audit trail in Notion
• MatterOS: the Notion operating system for lawyers
• What is included and what it does not do
• Pricing: one payment, no subscription

Frequently asked questions

Do law firms need a written AI policy?

No universal rule requires one, but bar guidance applies existing duties to AI use, and a written policy is the clearest evidence you meet them. Insurers and clients increasingly ask. Check your own bar's guidance, which may be more specific than ABA Opinion 512.

What is ABA Formal Opinion 512?

It is an American Bar Association ethics opinion issued on 29 July 2024 on lawyers' use of generative AI. It applies existing duties such as competence, confidentiality, communication, supervision and reasonable fees to the technology. It is persuasive, not binding, in most states.

Can lawyers put client data into ChatGPT?

It depends on the tool's terms, the data and your jurisdiction. Consumer tools without confidentiality commitments are generally unsuitable for identifiable client information. Business tiers with contractual protections may be acceptable after review, sometimes with client consent. Check your bar's guidance.

How long should a law firm AI policy be?

One to two pages is enough for a small firm. A longer document goes unread. Cover scope, approved tools, a data table, verification, supervision, client communication, billing, incidents and review, and keep logs separate.

Who is responsible if an associate or assistant uses AI badly?

Under general supervision duties, the responsible lawyer remains accountable for work product. Your policy should say who may use which tools, who verifies outputs, and how supervisors check. Confirm the exact standard in your jurisdiction's rules.