AI Governance & Quality Control
Law Firm AI Acceptable Use Policy: A Practical Template and Checklist
By Anthony Villanueva ·
An AI acceptable use policy defines what attorneys and staff may and may not do with AI tools in their daily work. This template covers the essential elements and includes a checklist for policy completeness.
An AI acceptable use policy (AUP) is the foundational governance document that defines the boundaries of permissible AI use in a law firm. Unlike broad technology use policies, an AI AUP must address the specific professional responsibility dimensions of AI use — confidentiality, supervision, accuracy, and disclosure — alongside the more familiar security and productivity considerations.
Essential elements for acceptable use documentation
A complete AI AUP should address the following elements: Approved Tools (an explicit list of AI tools approved for use, by category — research tools, drafting tools, document review tools — with indication of which tools are approved for what types of work); Prohibited Uses (explicit prohibition of AI use for tasks where the technology is demonstrably unreliable, such as jurisdiction-specific legal research in areas where the model's training data is sparse); Data Handling Requirements (rules for what client information
may be entered into AI tools, consistent with confidentiality obligations under ABA Model Rule 1.6); Supervision Requirements (the minimum review standards for AI-generated content before it reaches clients); and Reporting Obligations (how to report AI errors, near-misses, and incidents of concern).
Integrating training requirements into governance
The policy should also address the training requirements for AI use authorization — what training an attorney must complete before being authorized to use specific AI tools in client work. The 8am Legal Industry Report identifies training gaps as a leading correlate of AI adoption problems; embedding training requirements in the AUP creates a governance mechanism for addressing this.
Aligning policies with jurisdictional bar guidance
The AUP drafting process should involve review against the state bar guidance for each jurisdiction in which the firm practices. State bars have issued dramatically different AI guidance — some have provided detailed frameworks, others have extended existing opinions on technology use, and some have issued no AI-specific guidance at all. The firm's ethics counsel should confirm that the AUP satisfies the most restrictive jurisdiction-specific requirements applicable to the firm's practice.
Frequently asked questions
What elements should be included in a complete AI AUP to manage professional responsibility dimensions?
A complete AI AUP should address the following elements: Approved Tools (an explicit list of AI tools approved for use, by category — research tools, drafting tools, document review tools — with indication of which tools are approved for what types of work); Prohibited Uses (explicit prohibition of AI use for tasks where the technology is demonstrably unreliable, such as jurisdiction-specific legal research in areas where the model's training data is sparse); Data Handling Requirements (rules for what client information
may be entered into AI tools, consistent with confidentiality obligations under ABA Model Rule 1.6); Supervision Requirements (the minimum review standards for AI-generated content before it reaches clients); and Reporting Obligations (how to report AI errors, near-misses, and incidents of concern).
What does the 8am Legal Industry Report identify as a leading correlate of AI adoption problems?
The policy should also address the training requirements for AI use authorization — what training an attorney must complete before being authorized to use specific AI tools in client work. The 8am Legal Industry Report identifies training gaps as a leading correlate of AI adoption problems; embedding training requirements in the AUP creates a governance mechanism for addressing this.
Why must an AI AUP be reviewed against state bar guidance for each jurisdiction where the firm practices?
The AUP drafting process should involve review against the state bar guidance for each jurisdiction in which the firm practices. State bars have issued dramatically different AI guidance — some have provided detailed frameworks, others have extended existing opinions on technology use, and some have issued no AI-specific guidance at all. The firm's ethics counsel should confirm that the AUP satisfies the most restrictive jurisdiction-specific requirements applicable to the firm's practice.