AI Governance & Quality Control
How to Create a Responsible AI Governance Policy for a Law Firm
By Anthony Villanueva ·
A responsible AI governance policy is the foundation for every AI deployment in a law firm. This guide covers what a policy must include, how to structure the drafting process, and the ABA and NIST frameworks that should inform it.
A responsible AI governance policy is not a one-time document — it is an evolving framework that defines how a firm makes decisions about AI adoption, deployment, and oversight. The policy serves both an internal function (giving practitioners clarity about what is permitted and required) and an external function (demonstrating to clients and regulators that the firm takes its professional obligations seriously in the AI context).
Professional responsibility obligations for governance
The ABA's 2024 guidance on generative AI identifies competence, confidentiality, supervision, and candor as the primary professional responsibility obligations implicated by AI use. A responsible AI governance policy must address each: competence standards for attorneys using AI tools, confidentiality protocols for AI systems that process client data, supervision requirements for AI-generated content, and candor obligations when AI is used in client communications or court filings.
State bar ethics opinions — which vary significantly by jurisdiction — must also be reviewed and incorporated, as some states have issued specific guidance that goes beyond ABA model rules.
Technical structures for governance frameworks
NIST's AI Risk Management Framework provides the technical governance structure that complements the professional responsibility framework. The NIST framework identifies four core governance functions: Govern (establishing organizational policies and accountability), Map (identifying AI risks in context), Measure (assessing those risks against defined criteria), and Manage (implementing controls and monitoring performance). A law firm AI governance policy that integrates NIST's structure with ABA professional responsibility guidance produces a framework that satisfies both technical and regulatory scrutiny.
Drafting and updating governance policies
The drafting process for a law firm AI governance policy should involve the firm's professional responsibility counsel, its technology leadership, and representatives from the practice groups that will be most affected. It should also be reviewed against the governance frameworks adopted by peer firms and the guidance issued by the firm's primary jurisdiction state bars.
Crucially, the policy should include a review cycle — AI technology and regulatory guidance are both moving rapidly, and a policy written in 2024 may be significantly outdated by 2026 without a formal mechanism for updating it.
Frequently asked questions
Which four professional responsibility obligations does the ABA 2024 guidance identify as implicated by AI use?
The ABA's 2024 guidance on generative AI identifies competence, confidentiality, supervision, and candor as the primary professional responsibility obligations implicated by AI use. A responsible AI governance policy must address each: competence standards for attorneys using AI tools, confidentiality protocols for AI systems that process client data, supervision requirements for AI-generated content, and candor obligations when AI is used in client communications or court filings.
State bar ethics opinions — which vary significantly by jurisdiction — must also be reviewed and incorporated, as some states have issued specific guidance that goes beyond ABA model rules.
What are the four core governance functions identified by the NIST AI Risk Management Framework?
NIST's AI Risk Management Framework provides the technical governance structure that complements the professional responsibility framework. The NIST framework identifies four core governance functions: Govern (establishing organizational policies and accountability), Map (identifying AI risks in context), Measure (assessing those risks against defined criteria), and Manage (implementing controls and monitoring performance). A law firm AI governance policy that integrates NIST's structure with ABA professional responsibility guidance produces a framework that satisfies both technical and regulatory scrutiny.
Why should a law firm's AI governance policy include a formal review cycle?
The drafting process for a law firm AI governance policy should involve the firm's professional responsibility counsel, its technology leadership, and representatives from the practice groups that will be most affected. It should also be reviewed against the governance frameworks adopted by peer firms and the guidance issued by the firm's primary jurisdiction state bars.
Crucially, the policy should include a review cycle — AI technology and regulatory guidance are both moving rapidly, and a policy written in 2024 may be significantly outdated by 2026 without a formal mechanism for updating it.