YOUR ORGANIZATION
AI & Data
Privacy Policy
EFFECTIVE DATE To be determined
APPLIES TO All attorneys, staff, contractors, and interns
Executive Summary
Use AI within this policy’s professional responsibility and confidentiality framework.
Never enter confidential, privileged, or identifying client information into consumer AI.
Keep client, legal, and firm information out of AI unless expressly authorized under Tier 2.
Use consumer AI only for generic tasks with anonymized, de-identified content.
Remove names, dates, locations, amounts, and identifying facts before Tier 1 use.
A licensed attorney must independently review and verify AI work for legal accuracy.
Obtain written client consent before AI use involving substantive client data or strategy.
Use only firm-managed enterprise accounts for permitted client work; no autonomous advice or final legal work.
Classify matter risk; obtain partner approval for high-risk matters.
Use approved devices, MFA, and secure accounts; restrict consumer AI access to firm systems.
Keep legal judgment with people; AI may not replace professional judgment.
Complete annual confidentiality, AI risk, and cybersecurity training.
Report suspected misuse, disclosure, or policy violations immediately to the designated policy contact.
Stop use; notify the Managing Partner and IT within one hour; preserve evidence and follow incident response steps.
Use approved notetakers with consent, controlled access, appropriate retention, and attorney review.
Quick Reference
1. Use AI within this policy’s professional responsibility and confidentiality framework.
2. Never enter confidential, privileged, or identifying client information into consumer AI.
3. Keep client, legal, and firm information out of AI unless expressly authorized under Tier 2.
4. Use consumer AI only for generic tasks with anonymized, de-identified content.
5. Remove names, dates, locations, amounts, and identifying facts before Tier 1 use.
6. A licensed attorney must independently review and verify AI work for legal accuracy.
7. Obtain written client consent before AI use involving substantive client data or strategy.
8. Use only firm-managed enterprise accounts for permitted client work; no autonomous advice or final legal work.
9. Classify matter risk; obtain partner approval for high-risk matters.
10. Use approved devices, MFA, and secure accounts; restrict consumer AI access to firm systems.
11. Keep legal judgment with people; AI may not replace professional judgment.
12. Complete annual confidentiality, AI risk, and cybersecurity training.
13. Report suspected misuse, disclosure, or policy violations immediately to the designated policy contact.
14. Stop use; notify the Managing Partner and IT within one hour; preserve evidence and follow incident response steps.
15. Use approved notetakers with consent, controlled access, appropriate retention, and attorney review.
1. Purpose
This policy governs the use of artificial intelligence tools (including but not limited to Claude, ChatGPT, Microsoft Copilot, and similar generative AI platforms) to ensure compliance with professional ethical obligations, client confidentiality requirements, and the Firm’s risk management standards.
The Firm recognizes that AI tools can improve efficiency. Improper use, however, may expose confidential client information, waive privilege, or create malpractice risk.
This policy establishes a two-tier system:
Tier 1: Consumer AI (generic use only)
Tier 2: Firm-approved enterprise AI (limited client use permitted)
2. Core Rule
No confidential, privileged, or identifying client information may ever be entered into consumer AI platforms. This includes drafting prompts, uploading documents, or pasting text. If you are unsure whether information is confidential, assume that it is.
3. Prohibited Content (All AI Platforms Unless Explicitly Authorized)
Employees may not input any of the following into any AI system unless expressly permitted under Tier 2:
Client Information
Client names or initials
Matter names or internal file numbers
Addresses, phone numbers, or email addresses
Financial data
Medical information
Immigration status
Any personally identifying information
Legal Materials
Client communications
Draft pleadings containing client facts
Discovery responses
Settlement positions
Litigation strategy
Attorney notes
Trust or estate documents
Contracts or agreements tied to identifiable clients
Firm Information
Internal memoranda
Financial records
Passwords or credentials
Vendor contracts
Human resources data
4. Tier 1: Consumer AI (Generic Use Only)
Consumer AI includes free or personal versions of tools such as ChatGPT, Claude or similar services accessed outside the Firm’s managed systems.
These tools may be used only for:
General legal research on abstract legal principles
Brainstorming high-level ideas
Drafting generic templates or sample language
Grammar or style edits on fully de-identified text
Educational purposes
Administrative productivity unrelated to client matters
All content must be anonymized and stripped of identifying details.
Acceptable example: “Draft a generic engagement letter for an estate planning client.”
Unacceptable example: “Draft a response to opposing counsel in Smith v. Jones regarding our client’s trust dispute” where Smith v. Jones is a matter the Firm is handling.”
5. De-Identification Requirements
If using Tier 1 AI tools, you must remove or replace:
Names (use “Party A” or “Tom and Cindy Client”)
Dates (use general references)
Locations (use general regions, change street addresses to 1234 Main St., Nowheresville Illinois)
Dollar amounts (use ranges or placeholders)
Any unique facts that could identify the matter
If the facts could reasonably allow reconstruction of a client’s identity, AI may not be used.
6. No Reliance Without Attorney Review
AI output is not legal advice. All AI-generated content must be independently reviewed by a licensed attorney and verified for legal accuracy and jurisdictional correctness. Associates and staff remain fully responsible for the final work product. Use of AI does not reduce professional responsibility.
7. Client Consent
Client consent is required before using any AI tool in a manner involving:
Substantive client data
Case strategy
Draft documents containing client facts
Consent must be documented in writing.
Absent explicit consent, AI may only be used in anonymized form.
8. Tier 2: Firm-Approved Enterprise AI
The Firm permits limited client-related AI use solely through Firm-Approved Enterprise AI, subject to the restrictions below.
Permitted Uses:
Drafting client documents
Summarizing emails or documents
First-pass legal research
Matter summaries
Contract review assistance
Internal work product organization
Impermissible Uses:
Provide direct client advice
Replace legal analysis
Generate final pleadings without attorney supervision
Make settlement recommendations
Communicate autonomously with clients
Only Firm-managed accounts may be used. Personal accounts are prohibited.
9. Matter Risk Classification for Firm-Approved Enterprise AI Use
High-risk matters require partner approval.
Low Risk: Templates, routine drafting, publicly available information
Medium Risk: Transactional drafting, estate planning, non-litigation matters
High Risk: Active litigation, sensitive personal data, regulated matters
10. Security Requirements
Employees must:
Use only Firm-approved devices
Never store client data inside consumer AI platforms
Never connect consumer AI tools to Firm document systems
Never upload files directly from the Firm network into consumer AI
Log out of AI tools after use
Maintain multi-factor authentication
AI browser extensions or plug-ins are prohibited unless approved by IT.
11. No Automation of Legal Judgment
AI is an assistant, not a lawyer. AI may not replace professional judgment.
12. Training and Compliance
All attorneys and staff must complete annual training on confidentiality, AI risks, and cybersecurity. Violations may result in discipline up to termination.
13. Reporting Concerns
Any suspected data exposure or improper AI use must be reported immediately to the designated policy contact. Prompt reporting is essential.
14. Incident Response Protocol (AI or Data Exposure)
If any employee believes confidential information may have been entered into AI or improperly disclosed:
1.Immediately stop using the tool
2.Notify Managing Partner and IT within one hour
3.Preserve all relevant screenshots, prompts, and outputs
4.Do not delete accounts or chats unless instructed
5.IT will assess scope and containment
6.Firm leadership will determine client notification obligations
7.Insurer and ethics counsel will be contacted if required
8.Incident will be documented and remediation implemented
Failure to report promptly may result in disciplinary action up to termination.
15. AI Notetakers, Meeting Recordings, and Automated Transcription
“AI Notetakers” include any tool that records, transcribes, summarizes, or generates meeting notes using artificial intelligence, including bots or assistants embedded in videoconferencing platforms, phone systems, or third-party applications. Examples include automated meeting summaries, transcription services, and AI “assistants” that join meetings as participants.
Core Rule. AI notetakers may be used only if:
The tool is explicitly approved by the Firm
The tool meets Firm security standards (no training on Firm data, encryption in transit and at rest, defined retention limits, Firm ownership of outputs)
All required participant consents have been obtained
A human reviews all outputs before reliance or distribution
Absent these conditions, AI notetakers are prohibited.
Internal Meetings (Firm Personnel Only) AI notetakers may be used for internal meetings provided that:
All participants are informed that AI recording or transcription is occurring
Any participant may object, and if so, the notetaker must be disabled immediately
Transcripts and summaries are stored only in Firm-approved systems
Outputs are treated as drafts and reviewed by a human for accuracy
Access is limited to Firm personnel with a legitimate business purpose
AI-generated notes may not replace attorney judgment or supervision.
External Meetings (Clients, Opposing Counsel, Third Parties). AI notetakers may not be used in external meetings unless ALL of the following conditions are met:
Supervising attorney approval is obtained in advance
All participants are affirmatively informed that AI recording/transcription is occurring
Any legally required consent is obtained
No participant objects
The tool is Firm-approved and configured for confidentiality
If any participant objects, the AI notetaker must be disabled immediately.
AI notetakers should not be used in client meetings involving privileged legal advice unless explicitly authorized by Firm leadership and properly secured.
Confidentiality and Privilege Protection
Employees must treat AI notetakers as non-lawyer assistants.
Accordingly:
Privileged or confidential information may only be captured using Firm-approved tools
Bots may not be invited into meetings unless access permissions are controlled by the Firm
Recordings and transcripts must be stored only in Firm systems
Links to recordings or summaries may not be shared externally without attorney approval
Improper recording or storage of privileged communications may waive privilege and expose the Firm to malpractice risk.
Data Minimization and Retention
AI notetakers must be configured to collect only what is necessary.
Employees must:
Avoid capturing highly sensitive data unless required
Disable audio retention when transcript-only is sufficient
Store finalized notes in the matter file
Delete recordings and transcripts when no longer needed, consistent with Firm retention policies
Accuracy and Reliance.
AI-generated meeting summaries are not authoritative records.
Before use or circulation:
Attorneys must review for accuracy
Misstatements must be corrected
Action items must be confirmed
AI notes may not be sent to clients or third parties without attorney review and approval.
Client Transparency
Clients must be informed when AI tools are used to record or summarize meetings.
Where AI use is material to client services, disclosure must be documented.
Incident Reporting
Any improper recording, accidental disclosure, unauthorized storage, or suspected misuse involving AI notetakers must be reported immediately under the Firm’s Incident Response Protocol.
Enforcement
Failure to comply with this section may result in disciplinary action up to and including termination.