---
title: "A one-page AI policy for a small law firm, aligned to ABA Opinion 512 and state guidance"
url: https://thematteros.com/blog/law-firm-ai-policy-template
updated: 2026-10-27
author: Raghav Handa
---

# A one-page AI policy for a small law firm, aligned to ABA Opinion 512 and state guidance

A small-firm AI policy fits on one page: scope, approved tools, a table of which data may go into which class of tool, a human verification step, supervision, client communication, and incident and training logs. It should reflect existing duties of competence, confidentiality and supervision described in ABA Formal Opinion 512 and your own bar's guidance.

## Key takeaways

- Most bar guidance applies existing duties to AI: competence, confidentiality, supervision, communication, fees.
- A data class by tool class table is the core of a usable policy.
- Verification before use of any AI output is the line courts and bars keep enforcing.
- Check your own jurisdiction; guidance differs and is changing.

## What should a law firm AI policy contain?

Many firms use AI without a written policy. The North Carolina Bar's May 2026 summary of surveys, citing Clio figures that we have not checked at source, reports that most solo and small firms use AI while more than half lack a policy. Treat the figures as indicative. The practical point stands: a short written policy is cheap, and a bar or insurer may ask for one.

A usable one-page policy has nine parts: purpose and scope; approved tools; the data table below; verification; supervision; client communication; billing; incident handling; and training and review. The sections below give wording prompts. They are not legal advice and must be adapted to your jurisdiction.


## Which data can go into which kind of tool?

Decide by data class and tool class. Tool class means: public consumer tool; business-tier tool with contractual confidentiality terms and no training on your data; firm-controlled tool (including a private deployment). Data class means: public information; firm-internal, no client detail; client-confidential; highly sensitive (for example health, children, criminal allegations).

| Data class | Public consumer tool | Business-tier tool with terms | Firm-controlled tool |
| --- | --- | --- | --- |
| Public information | Allowed | Allowed | Allowed |
| Firm-internal, no client detail | Allowed with care | Allowed | Allowed |
| Client-confidential (anonymised) | Not allowed | Allowed after review | Allowed |
| Client-confidential (identified) | Not allowed | Only with client consent where required | Allowed |
| Highly sensitive | Not allowed | Not allowed without partner approval | Case by case |

The grid is a starting position for you to tighten, not a statement of what the rules allow. 'Anonymised' needs a definition: strip names, dates and unusual facts, and test whether the matter could still be recognised.


## What is the verification step?

Every output used in client work is checked by a named person before use. For research, that means reading the authority itself and confirming it exists and says what the output claims. Courts have sanctioned filings containing fabricated citations; a running tally by a researcher (Charlotin's database) is cited by bar publications with different counts at different dates, so quote any number with its date and source. Our citation checklist covers the steps.

1. Record that AI was used (the AI use log).
2. Check every cited authority in a primary source.
3. Check every quotation against the source.
4. Read facts back against the file.
5. Initial and date the check.


## What does bar guidance say, and where are the gaps?

This table is a map for your own reading, not a restatement of rules. Primary texts should be read in full.

| Source | Date | Gist (as reported) | Status of our check |
| --- | --- | --- | --- |
| ABA Formal Opinion 512 | 29 July 2024 | Existing duties of competence, confidentiality, communication, supervision and fees apply to generative AI | Commentary read; read the opinion itself |
| California State Bar guidance on generative and agentic AI | 2026 | Reported by a law firm publication as updated guidance | Secondary source only |
| Alabama Formal Opinion 2026-01 | 2026 | Reported by a privacy publication as AI ethics guidance | Secondary source only |
| Court standing orders and certifications | Varies | Some courts require disclosure or certification of AI use | Verify locally per court |

Your own bar's opinion controls. If it has not spoken, ABA 512 and nearby states are persuasive, not binding.


## What logs does the policy need?

A policy without records is a statement of intent. Keep three logs: a matter-level AI use log (see our log template), an incident log for anything that went wrong (wrong data in the wrong tool, a fabricated citation caught), and a training log recording who was briefed and when.

Review the policy twice a year and whenever you add a tool. Record the review date at the top of the page.

- Matter-level AI use log: https://thematteros.com/blog/ai-use-log-for-legal-matters
- Citation verification checklist: https://thematteros.com/blog/ai-citation-verification-checklist-for-lawyers
- Legal AI ethics guide: https://thematteros.com/resources/legal-ai-ethics-guide


## Where MatterOS fits

Last reviewed: 30 October 2026. We make MatterOS, a Notion template for lawyers, so weigh our view accordingly. This page is organisational information, not legal advice.

MatterOS includes an AI prompt pack and Notion databases where you can record AI work against each matter; it does not make AI use compliant or enforce your policy. If you use Notion's own AI features, check the plan, the data-handling terms and Notion's current pricing before putting client material in them. MatterOS ($39 one-time) is a structure for records, not an AI governance product.

- Security and your data: https://thematteros.com/security
- Audit trail in Notion: https://thematteros.com/features/audit_log
- MatterOS: the Notion operating system for lawyers: https://thematteros.com/product
- What is included and what it does not do: https://thematteros.com/facts
- Pricing: one payment, no subscription: https://thematteros.com/pricing


## FAQ

### Do law firms need a written AI policy?

No universal rule requires one, but bar guidance applies existing duties to AI use, and a written policy is the clearest evidence you meet them. Insurers and clients increasingly ask. Check your own bar's guidance, which may be more specific than ABA Opinion 512.

### What is ABA Formal Opinion 512?

It is an American Bar Association ethics opinion issued on 29 July 2024 on lawyers' use of generative AI. It applies existing duties such as competence, confidentiality, communication, supervision and reasonable fees to the technology. It is persuasive, not binding, in most states.

### Can lawyers put client data into ChatGPT?

It depends on the tool's terms, the data and your jurisdiction. Consumer tools without confidentiality commitments are generally unsuitable for identifiable client information. Business tiers with contractual protections may be acceptable after review, sometimes with client consent. Check your bar's guidance.

### How long should a law firm AI policy be?

One to two pages is enough for a small firm. A longer document goes unread. Cover scope, approved tools, a data table, verification, supervision, client communication, billing, incidents and review, and keep logs separate.

### Who is responsible if an associate or assistant uses AI badly?

Under general supervision duties, the responsible lawyer remains accountable for work product. Your policy should say who may use which tools, who verifies outputs, and how supervisors check. Confirm the exact standard in your jurisdiction's rules.

## Sources

- [ABA Business Law Today: ethics opinion on generative AI](https://www.americanbar.org/groups/business_law/resources/business-law-today/2024-october/aba-ethics-opinion-generative-ai-offers-useful-framework/)
- [NC Bar: what surveys show about law firm AI adoption](https://www.ncbar.org/nc-lawyer/2026-05/by-the-numbers-what-surveys-show-about-law-firm-ai-adoption/)
- [Clio: state bar AI ethics rules roundup](https://www.clio.com/resources/ai-for-lawyers/state-bar-ai-ethics-rules/)
- [Wilson Elser: California State Bar 2026 AI guidance](https://www.wilsonelser.com/publications/california-state-bar-issues-2026-ethics-guidance-on-ai-use-in-legal-practice)
- [Workplace Privacy Report: Alabama AI ethics guidance](https://www.workplaceprivacyreport.com/2026/07/articles/uncategorized/alabama-state-bar-issues-ai-ethics-guidance-for-lawyers-key-questions-and-practical-answers/)