Use this law firm AI policy template to write down how your lawyers and staff may use AI tools before someone decides for themselves. Picture a paralegal pasting a client's intake notes into a free chatbot. Nobody at the firm has said whether that is allowed. Written rules answer the question in advance.
This guide gives you twelve clauses with sample wording you can copy, the ethics rule behind each one, and notes on how to adapt it. Later sections cover how to size the policy, how to roll it out, and the add-ons an immigration practice needs for USCIS and immigration court.
Key Takeaways
- A law firm AI policy is a short written document that says which AI tools are approved, what client information may go into them, and who checks the output.
- ABA Formal Opinion 512 (2024) says lawyers with managerial authority must establish clear policies on the firm's permissible use of generative AI.
- The template has twelve clauses, each with sample wording, the rule behind it and notes on adapting it.
- A solo lawyer can cover the essentials in one page. A larger firm adds a tool register, a usage log and a named policy owner.
- Immigration firms add rules for A-numbers, passport scans, declarations, responses to requests for evidence, immigration court filings and non-attorney representatives.
What Is a Law Firm AI Policy?
A law firm AI policy is a written set of rules for how lawyers and staff use generative AI. That covers chatbots, drafting assistants and AI features inside other software. It names the approved tools, limits what client information may be entered, and says who reviews what the tool produces.
It differs from a standard operating procedure. The policy sets a rule, such as keeping client identification numbers out of general-purpose chatbots. A procedure describes the routine staff follow to apply it, and our law firm standard operating procedures template shows how to write one.
Does Your Firm Need One, and How Big Should It Be?
The short answer is yes, and the model rules point that way. ABA Model Rule 5.1(a) asks partners and managing lawyers to make reasonable efforts to have measures in place. Those measures must give reasonable assurance that every lawyer follows the Rules of Professional Conduct. ABA Formal Opinion 512, issued July 29, 2024, applies that duty to generative AI. It says managerial lawyers must establish clear policies on the firm's permissible use of the tools.
No rule sets a length. Your state's version of Rules 5.1 and 5.3 controls, so confirm the wording with your bar. The table gives a workable size for three firm types.
Those lengths are a judgment based on how much supervision each firm can do informally, and they are not a rule. A two-lawyer firm that skips a usage log can still meet its duty, so long as someone checks the work and the policy is followed.
The Law Firm AI Policy Template
The twelve clauses below run from scope and tools through client data, consent, review, courts, billing, training, records and incidents. They are written in plain language and use "the Firm" and "the AI Policy Owner" as defined terms. Copy the sample text into your own document and change the choices to match your firm. Then have a lawyer who knows your state's rules review the result. Each sample is a starting point and does not replace that review.
Clause 1: Purpose and Scope
This policy governs how the Firm's lawyers and staff use generative AI tools in client work and in Firm operations. It applies to every lawyer, paralegal, contractor and vendor who handles Firm or client information. Generative AI means any software that produces text, images, summaries or analysis in response to a prompt, including features built into software the Firm already uses.
Rule 5.1(a) is the source of the duty to have measures like these. Define the term broadly. An AI feature inside your email software raises the same questions as a chatbot.
Clause 2: Approved Tools and the Approval Process
Staff may use only tools on the Firm's Approved Tools Register. The AI Policy Owner adds a tool after reviewing its terms on confidentiality, data retention and training use. The approval date is recorded. Personal accounts and free consumer versions of AI tools may not be used for Firm work.
Lawyers should investigate a tool's reliability, security measures and policies and confirm that it protects confidentiality, according to Opinion 512. That applies Rule 5.3 on supervising nonlawyer assistance, which covers outside vendors. Our guide to attorney oversight of AI in immigration lists vendor questions to ask before approving a tool. The register is a simple table with the tool name, its approved tasks, the highest data tier allowed and the date of approval.
Adapt the "approved for" column to your tasks. A tool can be fine for summarizing a public regulation and unacceptable for reading a client's medical records.
Clause 3: Client Information and Data Rules
Information is sorted into three tiers. Tier 1 is public or general information with no client detail, and any approved tool may receive it. Tier 2 is client information, and only a tool approved for Tier 2 may receive it. Tier 3 is identification numbers, passport and civil document images, medical records and sealed material. It also covers anything a client has asked us to keep out of AI tools. Tier 3 information may be entered only with the written approval of the supervising attorney.
ABA Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent inadvertent or unauthorized disclosure of, or access to, information relating to a client. Tiers turn that standard into a decision a paralegal can make in seconds. Opinion 512 says a tool that learns from inputs raises the risk that one client's information surfaces for others. The register in Clause 2 records how each tool treats inputs.
Clause 4: Client Consent and Communication
Before a Tier 2 or Tier 3 input goes into a tool that may retain or learn from it, the supervising attorney will explain the use to the client, including the risks and benefits, and obtain the client's informed consent. General statements in the engagement letter do not satisfy this requirement. The Firm will follow any client instruction or outside counsel guideline that limits the use of AI on the matter.
Generic boilerplate in an engagement agreement is not enough to obtain informed consent when client information goes into a self-learning tool, says Opinion 512. The Minnesota Lawyers Professional Responsibility Board's summary of the opinion repeats that point, and it adds that the explanation should be particular to the use. Rule 1.4 on communication sits alongside it, because a client may need to know about AI use that affects the representation.
Corporate clients and insurers often send outside counsel guidelines that restrict or prohibit AI use. Add a line that the intake team checks each new client's guidelines and records any limit in the file. Tools that never retain or train on inputs may not need consent, and your lawyer should decide that point after reading the terms.
Clause 5: Verification of AI Output
AI output is a draft and never a finished work product. The person who uses a tool checks every fact, quotation, citation and number against its source before the work leaves the Firm. A lawyer reviews all work product that states or applies the law.
Opinion 512 treats this as the lawyer's duty of competence under Rule 1.1. The lawyer needs a reasonable understanding of what the tool can and cannot do. Review of its output should match the task. An internal summary may need a light check, while a brief needs a full cite-check.
Set the level of review by output type. Internal summaries get a spot check by the person who prompted. Client letters get a read by the lawyer. Anything filed gets the review in Clause 6.
Clause 6: Courts and Agencies
No filing, brief, declaration, response or other submission to a court or agency may include AI-generated content until the signing attorney has read it in full and verified every citation and factual statement against a primary source. The Firm follows each tribunal's current rules, standing orders and certification requirements on AI use, and the AI Policy Owner keeps a list of them.
Courts have sanctioned lawyers for filing citations an AI tool invented. In Mata v. Avianca, Inc. (S.D.N.Y. June 22, 2023), a federal judge imposed a $5,000 fine over a brief that cited cases ChatGPT had invented. ABA Model Rule 3.3 bars a lawyer from knowingly making a false statement of law or fact to a tribunal. Opinion 512 tells lawyers to review output so they do not submit misstatements of law or fact. It also says to check for missing controlling authority.
That reference list matters because rules vary by judge and by forum. Immigration court and USCIS are covered in the add-ons later in this guide.
Clause 7: Billing and Fees
The Firm bills clients for the time a lawyer or staff member actually spends, including time spent prompting and reviewing. The Firm does not bill time spent learning an AI tool. A tool built into software the Firm already pays for is overhead and is not charged as an expense. A per-use charge from a third-party tool is billed at the cost actually incurred, and only if the client agreed to it in writing.
Under ABA Model Rule 1.5 a lawyer may not charge unreasonable fees or expenses. Opinion 512 says hourly lawyers must bill for actual time and not more. It also says a lawyer may not charge for the time or cost of learning a tool, unless the client specifically asks for that tool.
Billing is easy to overlook. If a drafting task takes ten minutes with a tool, the bill reflects ten minutes.
Clause 8: Supervision and Training
Every person who may use an approved tool completes training on the Firm's policy and on the limits of the tool before their first use, and again each year. Lawyers who supervise others check that the policy is followed, and the AI Policy Owner keeps a record of who was trained and when.
Rules 5.1 and 5.3 put supervision on lawyers who manage the firm and on those who direct nonlawyer staff. Opinion 512 says supervisors must ensure lawyers and nonlawyers are trained in the ethical and practical use of the tools, and in their risks. A 30-minute session with the policy, three examples of correct and incorrect use, and a short quiz meets the need for a small firm.
Clause 9: Prohibited Uses
No one may use an AI tool to make a final decision on a client matter, to give legal advice to a client without lawyer review, to enter Tier 3 information without approval, to present AI output as a person's own verified research, or to evade this policy by using a personal account.
Keep the list short and concrete, since each item draws on Rules 1.1, 1.6 and 3.3. A prohibition that people can recall will be followed more often than a long list of cases. Add any task your firm has seen go wrong, such as drafting a client declaration from facts the client has not reviewed.
Clause 10: AI Use Log and Records
For any task where AI output goes into client work, the person who used the tool records six items: the tool, the task, the data tier entered, the reviewer, the date and the billing treatment. Records are kept in the client file for as long as the Firm keeps the file.
The log is the evidence that supervision under Rule 5.1 happened. It also helps with billing, because the billing treatment is written down at the time of the work. A one-line entry is enough, and a shared sheet or a field in your practice management system will do.
Add the fields your firm wants. Remove any your staff will not fill out, because a log that goes unused is worse than none.
Clause 11: Incident Response
A person who enters restricted information into an unapproved tool, relies on output that proves wrong, or learns of a vendor security problem reports it to the AI Policy Owner within 24 hours. The supervising attorney decides whether the client must be told, whether a filing must be corrected, and whether state breach notification rules apply.
Rule 1.6(c) asks for reasonable efforts to prevent disclosure, and reasonable efforts include a plan for when something slips. State breach notification laws and any duty to tell the client vary. Name a lawyer as the decision maker and let the facts drive the outcome. A reporting window of 24 hours is a choice, and your firm can pick another.
State plainly that a prompt report will not lead to discipline for an honest mistake. Staff who fear blame may stop reporting.
Clause 12: Policy Owner, Review and Acknowledgment
The managing attorney names an AI Policy Owner. The AI Policy Owner reviews this policy and the Approved Tools Register every six months. A change in a tool, rule or tribunal requirement triggers an earlier review. Each person signs an acknowledgment when they join the Firm and after each revision.
Pick one person with the authority to say no. A policy without an owner goes stale, and the tools change faster than most firm handbooks. Six months is a reasonable starting interval, since the ABA sets no review cycle.
Immigration Add-Ons to the Template
Any practice can use the twelve clauses, and our look at how immigration lawyers use AI covers day-to-day use. Immigration files carry sensitive identity data and agency deadlines. They also involve filings before two different government forums, so each of the six rows below adds a rule to the base policy.
The Executive Office for Immigration Review (EOIR) issued Policy Memorandum 25-40, "Use of Generative Artificial Intelligence in EOIR Proceedings," on August 8, 2025. It states that EOIR has neither a blanket prohibition on generative AI nor a mandatory disclosure requirement. It adds that filers should confirm the accuracy of any citations or other research or drafting done with AI tools. Individual adjudicators may adopt standing orders on disclosure. Attorneys may also need to consult clients about AI use, and the memo cites ABA Formal Opinion 512 on that point.
The memo also says a practitioner who files hallucinated or erroneous AI content likely violates conduct rules, and it points to 8 CFR 1003.102. Paragraph (c) of that section covers knowingly or recklessly making a false statement of material fact or law. Other paragraphs the memo cites cover competence, adverse authority and boilerplate filings. Before DHS, 8 CFR 292.3 applies the same discipline grounds to attorneys and representatives.
How to Adopt and Roll Out the Policy
A policy takes effect when people know it and use it, so adoption has five steps.
- Find out what people already use. Ask staff, without blame, which tools they have tried. Tools nobody mentioned are often the ones that raise problems.
- Fill in the template. Choose the options in each clause, name the AI Policy Owner and build the first Approved Tools Register from step one.
- Have a lawyer review it. A lawyer who knows your state's rules and any outside counsel guidelines you have signed should read the final text.
- Train and collect signatures. Run the session from Clause 8 and file each signed acknowledgment.
- Set the review date. Put the date for the first six-month review on the owner's calendar before you close the project.
A small firm can finish steps one through four in a week. Step five keeps the policy from going stale.
Where Software Can Help
Software can enforce parts of a policy once it exists, and the lawyer keeps every decision. Write the policy first, then pick tools that fit it.
Several clauses map to tools a firm may already use. AI Retainer drafts the engagement agreement and tracks signatures before a lawyer reviews it. The consent language from Clause 4 can go into that agreement. Clients can send documents through the Immigration Client Portal, so passport scans stay out of ordinary email.
AI Legal Document Drafting produces first drafts for lawyer review. AI Case Assembly then organizes forms and exhibits into a package for attorney review before filing. Before adopting any tool, ask the vendor your own questions on data handling and record the answers in the Approved Tools Register.
Get the Free Law Firm AI Policy Template
To start on your own policy, copy the twelve clauses above into a document and edit one at a time. A downloadable Word version is not available on this page yet. Have your lawyer review the final text against your state's rules and your tribunals' requirements before anyone signs it.
Put Your AI Policy Into Daily Work With US Immigration AI
US Immigration AI is AI-powered immigration case management software for licensed immigration firms, covering intake, retainers, document collection, drafting and case assembly. Schedule a demo to see how those steps can follow the policy you just wrote.
Frequently Asked Questions
