AI Ethics & Compliance for Law Firms: A Practitioner's Guide to the 2026 Regulatory Landscape

Disclosure-Heavy States

Some jurisdictions require affirmative disclosure to clients whenever AI is used in legal work. Florida, California, and New York have issued guidance suggesting that AI use should be disclosed in engagement letters or at the point of use.

Example: Review your engagement letter templates to include AI disclosure language for jurisdictions that require it.

Why it excels: Non-disclosure in these jurisdictions creates disciplinary risk even if the AI output is accurate and properly supervised.

Tool-Evaluation States

Several states focus on the duty to evaluate AI tools before adoption. Texas and Illinois guidance emphasizes that firms must conduct due diligence on AI vendors, including reviewing security practices, data handling, and accuracy claims.

Example: Develop an AI vendor evaluation checklist aligned with your state bar's specific requirements.

Why it excels: Adopting an AI tool without documented evaluation may itself constitute a competence violation, regardless of whether the tool performs well.

Minimal-Guidance States

Some states have issued only general statements that existing ethics rules apply to AI use without providing specific guidance. In these jurisdictions, ABA Formal Opinion 512 serves as the primary framework.

Example: Even without state-specific guidance, implement a baseline AI policy aligned with ABA Opinion 512.

Why it excels: The absence of specific state guidance does not reduce ethical obligations — it simply means the ABA framework applies with less local interpretation.

Which AI tools are approved for use in client work?

Maintain an approved tool list that distinguishes between tools vetted for client work (e.g., legal-specific platforms with enterprise security) and tools approved only for internal use (e.g., general-purpose AI for marketing or administrative tasks). Unapproved tools should be explicitly prohibited for client work.

What types of client data can be entered into AI tools?

Define data classification tiers. Highly sensitive data (privileged communications, trade secrets, PII) may require stricter controls or prohibition from certain tools. Less sensitive data (public filings, general legal research) may have broader approved use. Always verify the tool's data handling and training policies before entering any client data.

What verification steps are required before using AI output?

Specify minimum verification requirements by task type. Legal research output should require independent citation verification. Drafted documents should require substantive review by a licensed attorney. Contract analysis should require human review of flagged provisions. The level of verification should be proportional to the risk of the task.

When must AI use be disclosed to clients?

Define disclosure triggers based on applicable jurisdiction requirements and firm practice. At minimum, consider disclosure when AI materially affects the cost or approach to a matter, when required by court rules, or when the client has specifically asked about AI use in their engagement.

How should AI use be documented for billing purposes?

Establish billing guidelines for AI-assisted work. Options include billing AI-assisted time at a reduced rate, billing for the time spent reviewing and verifying AI output rather than generation time, or adopting flat-fee structures for AI-enhanced services. The key principle: clients should not pay manual rates for AI-accelerated work.

Who is responsible for AI governance within the firm?

Designate an AI committee or individual responsible for maintaining the approved tool list, updating the AI use policy, conducting training, and responding to AI-related incidents. In larger firms, this may be a cross-functional group including ethics counsel, IT leadership, and practice group leaders.