AI Ethics Rules for Lawyers: How State Bars Shape Responsible Use

State bar associations regulate lawyers’ use of artificial intelligence by applying existing professional duties to new tools: confidentiality, competence, supervision, candor, communication, conflicts, and protection of client property and information. AI ethics rules for lawyers rarely amount to a single checklist. Instead, the question is whether a lawyer can explain what the tool did, protect what went into it, verify what came out, and remain personally responsible for the work product. The cost planning behind solo law practice startup costs should therefore include time for review, training, secure software settings, and written internal procedures rather than treating AI as a free replacement for legal judgment.

Where AI ethics rules leave lawyers responsible

A state bar’s authority may appear through several sources, and they do not all carry the same weight. Start with the jurisdiction’s professional-conduct rules, then look for formal ethics opinions, advisory guidance, disciplinary decisions, court orders, and notices directed at lawyers. A vendor’s privacy page, a software company’s promise that a feature is secure, or a popular prompt template may be useful background, but none transfers the lawyer’s professional responsibility to the software provider. The controlling question is usually practical: could the lawyer defend the process and the final result if it were examined later?

Confidentiality begins before the first prompt

The riskiest AI decision often occurs before any answer is generated: what information is entered into the system. A prompt can contain a client name, a case number, medical details, financial records, privileged communications, negotiation positions, or a combination of facts that identifies a client even after names are removed. Questions about who may own law firms, including nonlawyer ownership law firms, are separate from AI use, but both subjects raise the same basic concern: a lawyer cannot casually hand control of confidential legal work to an outside business arrangement or technology service.

A useful home test takes 10 minutes and requires no account or software purchase. Write a fictional client fact pattern of 120 to 150 words, then underline every detail that could identify a real person, organization, dispute, or strategy if substituted into a live matter. Most readers will find more than five such details. That exercise shows why removing a name alone is not a reliable anonymization method. Before using any external AI service, lawyers need to know whether prompts are retained, whether they may be used for training, who can access them, how long they are stored, and whether the account settings differ between free, personal, and business plans.

Competence means checking output, not merely producing it

Generative AI can draft a client letter, summarize a deposition, compare contract clauses, suggest research terms, organize chronology entries, or create a first-pass outline. It can also invent cases, quotations, statutes, dates, record citations, and factual assertions that sound plausible. A polished paragraph is not evidence that the underlying authority exists. Lawyers remain responsible for verifying every citation, quoted passage, procedural statement, calculation, and factual characterization that will be sent to a client, opposing party, tribunal, insurer, or third party.

A workable review method has three passes. On the first pass, compare the output against the source documents and mark every statement of fact. On the second, open and read each cited authority rather than relying on a citation string, headnote, or AI summary. On the third, ask whether the draft omits a material limitation, defense, deadline, or unfavorable fact. For a two-page draft, reserve at least 15 minutes for this review even if generation took 30 seconds. Faster drafting changes where time is spent; it does not erase the need for legal analysis.

Supervision, client communication, and a written AI record

AI use also raises supervision questions. A lawyer who delegates a task to software still needs a defined workflow for staff, contractors, and junior lawyers who use that software. A one-page internal policy can state which tools are permitted, which categories of information may never be entered, who approves new tools, when human review is required, and where the final source documents are stored. Review the policy every 90 days during the first year of AI adoption, because features, account terms, and team habits can change quickly.

Keep a short matter-level record when AI materially contributes to client work. Six fields are enough for many uses: the date, the tool name, the account type, the task requested, whether client information was included, and the name of the lawyer who reviewed the output. This is not a substitute for substantive work, but it can make later questions answerable. If an AI-generated summary is challenged 18 months later, a contemporaneous note is more useful than trying to reconstruct the process from memory.

Client communication may also be necessary when AI use affects the representation in a meaningful way, particularly where it changes costs, confidentiality risk, the handling of client materials, or the level of human involvement. Avoid vague assurances such as saying that a tool is “secure” without knowing what that means. A clearer explanation identifies the task, the safeguards used, the lawyer’s review role, and any choice the client needs to make. The same discipline applies to billing: describe the legal work performed and reviewed, not simply the number of seconds an automated system took to generate text.