AI for your firm: Part 7 of 8. A short series for law firm leaders on getting AI right, from the risks you can’t see to the policy, tools and plan that fix them.
Quick answer: A law firm AI policy is a short set of rules that tells your team which AI tools are approved, what client information can and can’t go into them, how output must be checked, when clients need to be told, how AI-assisted work is billed, and who to ask. One to two pages is enough to start.
Somebody at your firm asked it last week: “Can I use ChatGPT to summarize this?” And you didn’t have a clear answer. Maybe you said “be careful.” Maybe you said “probably fine.” Either way, the person walked away guessing.
That’s what a law firm AI policy fixes. It turns “be careful” into specific rules your team can follow without calling you. This guide covers why you need one, what regulators expect, and a starter outline you can copy and adapt.
Why a policy beats a memo
A one-off email gets read once and forgotten. A policy gives people something to follow, something to be trained on and something you can point to if a client, insurer or regulator asks how your firm handles AI.
It also protects your people. When rules are unclear, the keen staff member who tries a free tool on a client file is taking a risk they don’t know about. We cover how that plays out in Shadow AI in law firms. A policy is the main fix.
What do regulators expect from a law firm AI policy?
Regulators don’t hand you a template, but they’re clear on who’s responsible.
- ABA Formal Opinion 512 says managerial lawyers must establish clear policies regarding the firm’s permissible use of generative AI, and supervisory lawyers must make reasonable efforts to ensure lawyers and nonlawyers comply. It adds that supervisory duties include training on ethical and practical use and on the risks.
- Law Society of Ontario guidance tells firms with employees to develop policies on AI and to review AI-assisted work.
- Law Society of Alberta‘s Generative AI Playbook says to supervise, and to implement and publicize policies.
- Law Society of BC guidance reminds lawyers that they remain responsible for work they oversee, whether produced by staff or technology, and that they should check whether courts or tribunals require AI disclosure.
None of these documents set out a single required policy format. Look at your own law society or Bar Association’s guidance, and ask its practice advisors if you’re unsure.
Keep it short enough to be used
A 25-page policy that nobody reads is worse than a two-page one that everybody follows. A few rules of thumb:
- Plain language. Write for your receptionist as much as your partners.
- Name one owner. Someone who answers questions and keeps it current.
- Use examples. “You may use the approved tool to summarize a deposition transcript. You may not paste client emails into a free personal account.”
- Separate policy from procedure. The policy sets the rules. A short how-to guide covers the steps.
A copyable starting-point outline
This outline is a starting point to adapt, not legal advice or a finished policy. Have your own counsel or your law society or Bar Association’s practice advisors review it against the rules that apply to you.
YOUR FIRM'S AI USE POLICY
Owner: (policy owner) | Effective: (start date) | Review: every 6 to 12 months
1. PURPOSE AND SCOPE
Why we have this policy; who it applies to (lawyers, staff, contractors);
which tools it covers (generative AI and AI features in other software).
2. APPROVED TOOLS
List of approved tools, who may use them and for what.
Anything not listed is not approved. How to request a new tool.
3. RESTRICTED AND PROHIBITED USES
What may never be done (e.g. entering client information into any
non-approved tool; relying on AI for legal advice without review).
4. INFORMATION TIERS
What can go into which tool: public / internal / client confidential.
5. VERIFICATION AND HUMAN REVIEW
All output is a draft. Citations, dates, amounts and names checked
against primary sources. Who reviews, and how it's recorded.
6. CLIENT COMMUNICATION AND CONSENT
When clients are told about AI use; when consent is sought;
engagement letter and client-guideline checks.
7. COURTS AND TRIBUNALS
Check for AI rules or declarations before filing (e.g. the Federal
Court of Canada's notice). Who is responsible for checking.
8. BILLING
How AI-assisted work is recorded and billed, consistent with your
regulator's fee rules.
9. SUPERVISION AND TRAINING
Who supervises; initial training; refreshers; who to ask.
10. INCIDENTS
What counts as an incident (e.g. client data in an unapproved tool);
who to tell, how fast; no-blame reporting.
11. GOVERNANCE AND REVIEW
Policy owner; review schedule; how changes are communicated.
12. ACKNOWLEDGMENT
Each person confirms they have read and will follow the policy.Don’t want to start from a blank page?
Our free AI readiness assessment gives you a written summary and a checklist of the guidance that applies to your jurisdiction, so your policy starts from the right place.
Decisions only your firm can make
An outline can’t answer these for you. Settle them before you finalize the policy.
- Which tools are approved? See Secure AI tools for law firms for how to vet them.
- When do clients hear about AI use? ABA 512 says boilerplate language in engagement letters isn’t enough where informed consent is required, and the Law Society of BC says it’s prudent to make clients aware of how you plan to use AI. Decide your threshold and put it in writing.
- How do you bill AI-assisted work? ABA 512 says lawyers who bill hourly must bill actual time, not time saved, and may not charge clients to learn a tool they’ll use regularly. The Law Society of BC reminds lawyers that fees must be fair and reasonable under its Code. Flat-fee and disbursement approaches need their own thought.
- What’s off limits entirely? Some firms ban AI for certain matter types or information categories.
- How will you record AI use on files? ABA 512 suggests marking materials produced by AI tools when they’re stored.
Make it stick: rollout and review
A policy only works if people know it exists.
- Announce it with the “why.” Explain that the goal is to let people use AI safely, not to catch them out.
- Train on real examples from your own practice areas. See AI use cases by practice area.
- Give people an approved option. Rules without a usable tool push people toward workarounds.
- Collect acknowledgments and keep them on file.
- Review on a schedule. Tools, terms and regulator guidance change. Put a review date on the calendar.
If you’d rather build your policy as part of a wider plan, the 90-day implementation plan shows where it fits.
FAQ
Do we need an AI policy if we don’t use AI?
Probably yes. Your team may be using AI whether you’ve approved it or not, and AI features are appearing inside software you already use. A short policy that says what’s allowed and what isn’t covers you either way.
How long should a law firm AI policy be?
Short enough to be read. Many firms start with one to two pages covering approved tools, what information can go in, review, client communication and who to ask, then expand over time.
Can we copy a template from another firm?
You can use one as a starting point, but adapt it to your jurisdiction, practice areas, tools and clients, and have it reviewed against the rules that apply to you. A policy that doesn’t match how your firm works won’t be followed.
Need a policy that fits your firm? We write policies around the guidance that applies to you, and we work with law firms in every province and territory across Canada and throughout the United States. Start with our free AI readiness assessment.
Ready to build yours?
Explore AI implementation for law firms
Want independent help? See does your firm need an AI audit?
This article and outline are general information, not legal or ethics advice. Review any policy against the rules that apply to you, and consult your law society or Bar Association’s practice advisors.
