AI for Law Firms: A Guide for Lawyers Adopting Legal AI

AI for law firms is a governance problem rather than an adoption problem. Law firms have adopted AI for legal work faster than they have governed it, and the duties that apply to AI at a law firm are the ones every law firm already knows: competence, confidentiality, supervision, and reasonable fees.

That changes what a firm has to decide first. The question is not which tool to buy. It is which workflow the firm is prepared to supervise, who signs off on the output, and what the firm tells the client, all of which land on the partners and associates who already carry those duties at law firms of every size.

This guide works through what the tools do by workflow, what American Bar Association (ABA) Formal Opinion 512 requires, and what an AI use policy has to contain. It then covers verification in practice, how to stage a rollout, how to evaluate a tool, client confidentiality, and billing for AI-assisted work.

Key takeaways

1. Adoption is largely settled at the practitioner level, and written governance is the part that lags behind it.
2. The duties that apply to AI are the existing Model Rules on competence, communication, fees, confidentiality, and supervision, not a new category of rule.
3. ABA Formal Opinion 512 requires informed client consent before information relating to a representation goes into a self-learning generative AI tool, and boilerplate engagement-letter language does not satisfy it.
4. The verification step is the one that produces sanctions when a firm skips it, and the public record of those sanctions is countable.
5. Billing follows actual time spent, so a task that generative AI shortens is billed shorter.

[cta-1]

The adoption gap: law firms use AI faster than they govern it

The law firm AI adoption and governance gap is visible in two different surveys of two different populations. Clio’s 2026 surveys report that 71% of solo practitioners, 75% of small firms, and 86% of mid-sized firms use AI, while the 8am 2026 Legal Industry Report finds that only 9% of legal professionals say their firm has a written AI policy that is actually enforced, 43% say their firm has no policy and no plans to write one, and 54% say their firm provided no training on responsible AI use, figures collected in the North Carolina Bar Association’s review of the adoption surveys.

Why the adoption figures disagree

The ABA’s own technology survey, taken from a different population, lands considerably lower than the Clio figures, and the distance between them is the part worth understanding before quoting either. That survey counted 30% of responding lawyers using AI, rising to 46% at firms of 100 or more attorneys and falling to 18% among solo practitioners, as the ABA Journal reported.

The spread between the Clio and ABA figures is a definitional artifact rather than a contradiction, and the denominators explain it:

1. Clio counts any AI use, including general-purpose assistants, and includes non-lawyer staff in the population it surveys.
2. The ABA counts firm adoption of AI-based tools, as reported by responding lawyers about their firms.
3. Read together, the two surveys say that individual use is widespread while firm-level deployment is narrower, which is the shape of a governance deficit.

What the governance deficit looks like in practice

The governance gap shows up as specific missing artifacts, and each one is recoverable:

1. No written list of which tools are approved for client work.
2. No stated rule about what client information may be entered into a tool.
3. No named role responsible for verifying output before it leaves the firm.
4. No training record, which is the item a disciplinary body is most likely to ask for.

The question of which named firms have actually deployed AI, and what they deployed it for, sits in the firm-by-firm adoption record.

How are law firms using AI?

Law firms are using AI in four workflows today: contract drafting and review, document review across large sets, legal research, and client intake and firm operations. Transactional work is where returns are easiest to measure, because contract language is structured, repetitive, and benchmarked against precedent the firm already owns.

Contract drafting and review

The lawyer receives third-party paper, reads it against the firm’s position, marks the clauses that fall outside it, and drafts replacement language. AI assists at the identification step: it flags clauses that deviate from a defined standard and proposes redline language the lawyer accepts, edits, or rejects. The Review feature works this way inside Microsoft Word, surfacing risks and proposing revisions as native tracked changes so the lawyer’s existing redlining workflow does not change shape.

What goes wrong is scope creep in the standard. A firm that has not written down its fallback positions gets flags without guidance, and the associate ends up making the same judgment calls unaided. The practitioner step that makes this work is defining the playbook first, which means recording three things:

1. The firm’s preferred language for each clause type it negotiates regularly.
2. The fallback positions it will accept, in order, and the ones it will not.
3. The point at which a deviation stops being an associate decision and goes to a partner.

Document review across large sets

Due diligence, lease portfolios, and closing checklists involve reading the same question across hundreds of documents. The work is extraction and comparison rather than judgment, which is why it suits AI assistance. The Associate feature runs this kind of question across a whole document set, and the output is a table the lawyer verifies before relying on it.

This is also where the ABA places the newest shift in the market, toward tools that execute multi-step tasks rather than answer single prompts. The supervision question gets sharper as the task gets longer, because an unverified intermediate step propagates into everything built on top of it. A named reviewer per document set, and a sample the reviewer reads in full, is the control.

Legal research

Research is the workflow with the highest penalty for an unverified output, which the next sections cover in detail. A lawyer uses AI to find the line of authority faster, then opens every case before citing it. The failure mode is treating a generated summary as a substitute for reading the opinion, and it is the failure mode that reaches a judge.

Client intake and firm operations

Intake forms, conflict checks, time capture, and matter budgeting are operational rather than legal tasks, and firms evaluating this layer are usually comparing it against the practice management and billing systems they already run, which sit in a broader category of software for lawyers. This is also the easiest place to run a first pilot, because a mistake does not reach a client deliverable and the baseline data already exists. Intake volume is counted and cycle time is recorded in the system the firm already pays for, so the before-and-after comparison uses data the firm already holds.

What ABA Formal Opinion 512 requires before AI touches client work

ABA Formal Opinion 512 requires a lawyer using a self-learning generative AI tool to obtain the client’s informed consent before inputting information relating to the representation. Issued July 29, 2024, the opinion creates no new rules: it applies the existing Model Rules on competence (1.1), communication (1.4), fees (1.5), confidentiality (1.6), and supervision (5.1 and 5.3) to generative AI, and it states that boilerplate consent language in an engagement letter is not sufficient.

What informed consent has to cover

The consent has to be specific to the tool and the matter. Per the National Conference of Bar Examiners’ analysis of the opinion, the disclosure covers three things:

1. Why the tool is being used on this representation.
2. The specific risk that use creates for the client’s information, rather than a general statement about technology.
3. The benefit the client gets in return.

The opinion also reaches Rules 1.9(c) and 1.18(b), which puts former clients and prospective clients inside the duty rather than outside it. A firm that scopes its consent process to current matters only has left two populations uncovered.

Where state authorities land

State authorities have reached the same place by their own route, and naming the specific opinion matters more than a general reference to bar guidance. The Florida Bar’s Ethics Opinion 24-1, issued January 19, 2024, holds that lawyers may use generative AI but must protect the confidentiality of client information, provide accurate and competent services, avoid improper billing practices, and comply with lawyer advertising restrictions. The opinion also directs lawyers to research a program’s policies on data retention, data sharing, and self-learning before using it. Advisory opinions of this kind are not binding, and they are not bright-line rules; they are the standard a disciplinary body is likely to apply.

One practical consequence is worth stating plainly. A general-purpose consumer chatbot and a legal tool with contractual data terms are different propositions under Rule 1.6, which is the question behind whether it is legal for lawyers to use ChatGPT on client matters at all.

Writing a law firm AI use policy: what it has to cover

A law firm AI use policy has to be specific enough to act on, and this guide works through six questions a usable policy answers in writing: which tools are approved, what client information may be entered into each one, who must verify AI output before it leaves the firm, how the firm obtains and records client consent, who supervises non-lawyer staff using AI, and how AI-assisted time is billed. The underlying obligation is the supervision duty in Model Rules 5.1 and 5.3: partners and supervising lawyers must maintain measures giving reasonable assurance that the firm’s lawyers and non-lawyer assistants comply with the rules, and a policy that stops at “use AI responsibly” does not provide that assurance.

Giving each of the six a trigger or a threshold

A policy item without a trigger is a statement of intent, which is the same reason risk frameworks such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework express governance as named functions with assigned owners rather than as principles. Each of the six becomes enforceable when it carries one:

1. Approved tools: a named list, with the review date, and a stated rule that anything not on the list requires sign-off before it touches client work.
2. Permitted inputs: a tiering of information, from public material through to client-identifying and privileged content, with the tier at which each approved tool stops.
3. Verification: the named role that reads the output before it leaves the firm, and the record that shows the reading happened. Citations and quotations get opened at the source, every time.
4. Client consent: the matter-opening step at which consent is sought, the specific language used, and where the record is stored. Rule 1.9(c) means the policy also states how former-client information is handled.
5. Supervision of non-lawyer staff: which paralegals, legal assistants, and operations staff may use which tool, and the supervising lawyer accountable for each.
6. Billing: the rule for recording AI-assisted time, and the firm’s position on whether the tool is overhead or a per-use charge.

Keeping the policy usable as the tools change

A policy written around a named product has to be rewritten the next time the firm switches vendors, which is an argument for organizing the document by duty rather than by technology. The State Bar of California’s practical guidance for the use of generative AI is a useful model on exactly that point, because its structure follows the duties a lawyer already owes. A policy organized that way survives a procurement change without a rewrite.

[cta-2]

Verification: what an unchecked AI citation costs in court

AI hallucination cases in which a court identified a lawyer as the party using AI now number 864 worldwide, within a database of 2,180 cases across all parties, according to the AI Hallucination Cases database maintained by Damien Charlotin and read on October 9, 2026. Recorded sanctions range from warnings to monetary penalties and referrals to the bar. Each of those filings carried a citation that a lawyer signed without opening it.

The lawyer-attributed share is the figure that matters for a firm reading the database. Most entries involve self-represented litigants rather than counsel, so the 864 cases describe professional exposure, while the 2,180 total describes the wider phenomenon of hallucinated citations reaching courts.

The three verification steps

Federal Rule of Civil Procedure 11(b) already places the control at the signature: an attorney presenting a paper to the court certifies that the legal contentions are warranted by existing law, formed after an inquiry reasonable under the circumstances. Verification is therefore a procedural control rather than a technical one, and it significantly mitigates the risk rather than removing it. Three steps do most of the work:

1. Open every cited authority at its source and read the proposition it is cited for, not the summary of it.
2. Check every quotation against the original text, including internal quotations inside a quoted passage.
3. Confirm that the authority is still good law, and that it has not been reversed, vacated, or superseded.

A firm that writes this into the policy and names the role responsible has a defensible position. A firm that relies on individual diligence has an undocumented one.

How to implement AI in a law firm

To implement AI in a law firm, work through three stages over about 90 days: pick one high-volume, low-judgment workflow and measure its current cycle time, run a supervised pilot with a named partner accountable for output quality, then expand only once the pilot has produced a verification standard the firm can enforce. A firm that skips the measurement stage cannot tell afterwards whether the tool helped.

Stage one: pick and measure the workflow

Choose work the firm does repeatedly, where the output is checkable and the stakes of a caught error are low, which is why nondisclosure agreement (NDA) and vendor-agreement review against an existing contract review checklist is the usual starting point. The shortlist worth considering:

1. NDA and vendor-agreement review, where the firm’s position on each clause is already settled.
2. First-draft generation from the firm’s own precedent rather than from a generic template.
3. Due diligence extraction across a document set, where the question is the same on every document.
4. Intake and conflict checks, which never reach a client deliverable unverified.

Before anything is installed, record the current state: hours per matter, turnaround time, the number of review passes, and who currently does the work. Without that baseline, any later claim about time saved is an assertion.

Stage two: run a supervised pilot

Scope the pilot to one practice group and a fixed period, and name the partner accountable for output quality. The pilot produces two things beyond the time data:

1. A list of the failure modes the group actually encountered, in the group’s own words.
2. The beginnings of a verification standard, drafted from those failures rather than from a vendor’s documentation.

Keep the group small enough that the accountable partner can read a sample of every week’s output. If the accountable partner cannot read a weekly sample, the pilot is not supervised.

Stage three: expand once the verification standard exists

Expansion is gated on the verification standard, not on the pilot’s satisfaction scores. Three things should be in place before a second practice group starts:

1. The policy items above, written down and circulated.
2. The training, delivered and recorded.
3. The consent step, built into the matter-opening process rather than left to the individual lawyer.

Firms that invert this order write the policy after an incident.

How to choose an AI tool for a law firm

A procurement conversation can test five criteria before a law firm commits to an AI tool: whether the vendor retains or trains on your data, whether the tool runs inside the application your lawyers already use, whether every output traces back to a source you can open, how long setup takes before the first useful result, and whether the vendor’s specialization matches the work your firm actually bills.

1. Data handling: ask whether your inputs are retained, whether they train the vendor’s models, where processing happens, and what the contract says rather than what the marketing site says. A vendor that will not put retention terms in writing has answered the question.
2. Workflow fit: ask which application your lawyers work in. A tool that requires copying client text into a separate browser window adds a confidentiality decision to every task, and that friction shows up in whether lawyers keep using it.
3. Traceability: ask to see an output and then ask to open its source. Any tool whose answers cannot be traced to a document or authority the lawyer can read puts the verification burden back on your firm with no assistance.
4. Time to first result: ask how long until a lawyer gets usable output, and what your firm has to supply first. Ask for the implementation timeline in writing, because a multi-quarter rollout is a different purchase from a self-serve start.
5. Specialization: ask what the tool was built for. A tool built for commercial contract work and a platform built for litigation or research behave differently on the same document, and each carries limitations worth surfacing during the evaluation.

For a more in-depth breakdown of the best solutions for your firm, check out our in-depth  legal AI tools guide.

Client confidentiality and AI data privacy for law firms

Client confidentiality under Model Rule 1.6 is the controlling professional-responsibility constraint on AI data privacy for law firms. State and foreign privacy law and the vendor contract constrain the same decision on their own terms. Rule 1.6 turns three vendor terms into threshold questions: whether the vendor retains your inputs, whether it trains its models on them, and where the data is processed. Ask for the data processing agreement and the SOC 2 Type II report before the pilot, not after.

Retention, training, and processing location are three different questions

The three are not interchangeable, and a vendor can answer one well and the others poorly:

1. Retention governs what exists to be subpoenaed or exposed in a breach. The question is how long your inputs persist and who inside the vendor can reach them.
2. Training governs whether client language can surface in another customer’s output. The contractual answer is the only one that counts.
3. Processing location governs which privacy regime applies and whether a cross-border transfer mechanism is needed for your European or regulated clients.

Which security controls to ask about

Specific controls are worth more than security adjectives in this conversation:

1. SOC 2 Type II describes an audited control environment over a defined period, which is why the report date matters as much as the report.
2. HIPAA compliant is the accurate wording for a vendor posture, because HIPAA operates no vendor certification scheme for anyone to hold.
3. The General Data Protection Regulation (GDPR) and the EU AI Act reach your firm if it has European clients or operations, independent of what the Model Rules require.

If your clients ask about data residency or an on-premise deployment, those questions sit alongside the broader set of AI data privacy obligations a firm carries.

Billing clients for AI-assisted work

Lawyers can bill for AI-assisted work, but only for the time actually spent on it, so a task that generative AI shortens from three hours to one is billed at one hour. ABA Formal Opinion 512 states that a fee charged for which little or no work was performed is an unreasonable fee under Model Rule 1.5. The cost of the tool itself may be treated as office overhead or charged on a per-use basis, provided the arrangement is explained to the client in advance.

What this means for the hourly model

This has an uncomfortable implication for hourly billing, and it is better resolved in advance than in a fee dispute. If AI compresses the time a matter takes, the hourly fee falls unless the firm has agreed a different basis with the client. Two responses are in use:

1. Moving the affected work to fixed or capped fees, which prices the outcome rather than the hours.
2. Keeping hourly billing and redirecting the recovered capacity to work the firm previously wrote off or declined.

Record-keeping that holds up

Two habits make the position defensible if a client questions an invoice:

1. Record time as it was actually spent, including verification time, which is real work and properly billable.
2. State any charge for tool usage in the engagement letter rather than introducing it on an invoice.

Where Spellbook fits

Spellbook is an AI suite for transactional legal work, built for the commercial contract workflows above rather than for litigation, legal research, or contract storage. It is used by more than 5,000 in-house teams and law firms across 80+ countries, and the published customer accounts describe how those teams set it up.

What each feature does

1. The Review feature surfaces risks and proposes redlines as native Microsoft Word tracked changes, working against the firm’s own playbook rather than a generic standard.
2. The Draft feature generates first-draft language from the firm’s precedent.
3. The Associate feature works across a whole document set for due diligence and multi-document review.
4. The Compare to Market feature benchmarks terms against 20M+ real contracts.
5. The Playbooks feature is where the firm’s fallback positions are recorded, so the flags arrive with guidance attached.

How Spellbook maps to the governance questions above

Spellbook operates on a zero data retention basis and holds SOC 2 Type II, which are the contractual answers the Rule 1.6 questions above are asking for, and they are the two items worth confirming in writing with any vendor. The error base rate is why a review step exists at all: 60% of contracts filed with the Securities and Exchange Commission (SEC) contain drafting errors, measured across 3,019 material-contract exhibits from more than 500 public companies by Spellbook Labs.

Pricing is custom per seat by team size, and there is a free seven-day trial that does not require a sales call or an implementation project.

Frequently asked questions

What is the best AI for a law firm?

There is no single answer that holds across firms, because the right tool depends on the work. A firm whose billable hours sit in commercial contracts needs clause-level review against its own standards. A litigation practice needs document review at volume and research with traceable citations. Judge candidates on the five criteria above, starting with data handling and workflow fit, and run the pilot before signing a multi-year term.

Is there a ChatGPT for lawyers?

General-purpose assistants and legal-specific tools are different products, and the consumer tier of a general assistant is different again from the same vendor’s enterprise agreement. A general assistant is built for broad language tasks, and the data commitments depend entirely on which tier the firm has signed, while a legal tool is grounded in legal source material and sold with those commitments in the contract. The practical difference shows up at the Rule 1.6 question, which is what separates a consumer tier of ChatGPT for legal work from an enterprise agreement that makes the commitments contractual.

Is Claude or ChatGPT better for lawyers?

The comparison that matters is not model quality but deployment terms. For client work, the questions are whether inputs are retained, whether they train the model, whether outputs cite sources a lawyer can open, and whether the enterprise agreement makes those commitments contractual. A model that performs well in a benchmark and offers no retention commitment is the weaker choice for a matter file.

Does a law firm need a written AI policy?

If lawyers or staff are using AI on client work, the supervision duty in Model Rules 5.1 and 5.3 is already engaged, and an unwritten policy is difficult to show. The minimum useful version is one page covering approved tools, permitted inputs, the verification step, and the consent process.

How can AI support paralegals and legal ops?

Paralegals and legal operations staff do a large share of the extraction, proofing, and document-assembly work where AI assists most directly, which is also why Model Rule 5.3 places their use under a supervising lawyer. The role itself changes shape rather than disappearing, which is the question behind whether AI replaces paralegals.

Can AI be used in all areas of law?

AI can assist in most practice areas, though the usefulness varies with how structured and repetitive the document work is. Transactional and contract-heavy practices see the clearest gains. Areas that turn on oral advocacy, negotiation judgment, or novel questions of law get less from current tools, and the verification burden stays the same everywhere.

Start with one workflow

Try Spellbook free to see how the Review feature handles your own third-party paper inside Word.