Legal AI Ethics: The Rules That Actually Apply in 2026

The five duties, in plain terms

• Competence (Rule 1.1, Comment 8). You must understand the benefits and risks of the technology you use - not the engineering, but what the tool does with client data, where it can be wrong, and how you'd catch it. Buying blind is the violation; informed reliance is fine.
• Confidentiality (Rule 1.6). Client information must be protected when it enters a tool: no training of vendor models on your data, encryption in transit and at rest, access controls, terms you have actually read. Consumer chatbots with default data retention fail this test; purpose-built platforms with written commitments pass it.
• Supervision (Rules 5.1/5.3). AI output gets reviewed like a junior associate's work. Every sanction headline about AI in court - invented citations, fabricated quotes - is at bottom a supervision failure: the lawyer signed what they didn't check.
• Candor (Rules 3.3, 8.4). You are responsible for every representation to a tribunal regardless of what drafted it. Verify citations against sources, not against the AI's confidence. Cited-to-your-own-record output makes this fast; uncited output makes it your evening.
• Reasonable fees (Rule 1.5). You cannot bill hours the technology eliminated. If AI compresses four drafting hours into thirty review minutes, hourly bills reflect the thirty - which is the quiet ethics case for flat fees, where efficiency is honestly yours to keep.

Disclosure: when do clients need to know?

The consensus position: routine use of vetted AI tools for internal work - document review, research, drafting for attorney review - generally requires no specific client consent, the same as your word processor or research database. Disclosure duties sharpen when the use is consequential to the representation: when confidential information flows to a tool whose terms warrant scrutiny, when a client asks, or when billing is affected. The clean practice is a technology clause in the engagement letter describing categories of use - it costs a sentence and converts every later question into 'as disclosed.'

The small-firm compliance checklist

• Vendor file: for each AI tool, keep the terms, the data-use commitments (training exclusion in writing), and security posture. One folder; update annually.
• Review discipline: nothing AI-produced reaches a client, court, or counterparty unreviewed. Prefer tools where output arrives cited so review takes minutes.
• Citation verification: every authority in anything filed gets checked against the source. No exceptions, no matter how confident the draft reads.
• Engagement-letter clause: one sentence on technology use, reviewed by you once, protecting you always.
• Billing alignment: bill actual time, or move the fee model to flat/value where efficiency gains are legitimately yours.
• Audit trail: prefer platforms that log what the AI did, what it read, and who approved - your supervision evidence if ever questioned.

The posture that fails, and the one that works

Two postures fail predictably: abstention (competence now cuts both ways - refusing efficient tools has its own client-service cost) and abdication (letting output ship unreviewed). The posture that works is the one the profession has always used for delegated work: delegate the labor, supervise the judgment, own the result. AI changes the economics of the labor; it changes nothing about ownership.

Is it ethical for lawyers to use AI?

Yes - the ABA (Formal Opinion 512, 2024) and state bars agree that existing rules permit AI use, governed by the ordinary duties: competence in the tool, confidentiality of client data, supervision of output, candor to tribunals, and reasonable fees. The violations making headlines are not 'using AI' but skipping the duties - especially filing unverified output.

Do I need client consent to use AI?

For routine internal use of properly vetted tools, generally no specific consent is required - the analysis parallels other technology. Sharper disclosure applies when confidential data flows to tools with questionable terms, when use materially affects the representation or the bill, or when the client asks. Best practice: a one-sentence technology clause in the engagement letter covering categories of use.

What client data can I put into AI tools?

Into a vetted, purpose-built platform - training exclusion in writing, encryption, access controls, firm isolation, acceptable terms - confidential matter data may be processed as part of the representation, like any practice system. Into consumer AI tools with default retention and training, effectively nothing confidential. The dividing line is the vendor's data posture, and verifying it is the lawyer's competence duty.