In August 2024, the ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512, titled "Generative Artificial Intelligence Tools." The opinion is the most significant formal guidance on AI and legal ethics issued at the national level to date. Its conclusion is direct: using generative AI in legal work falls within Rule 1.1's competence requirement, and an attorney who uses AI without understanding how it works, what its limitations are, and how to verify its output may be in violation of their professional obligations.

This is not a warning about some future possibility. It is a current ethical obligation. Attorneys who are using AI tools today in their practice without understanding those tools are taking on disciplinary risk whether or not they realize it.

This guide covers what Formal Opinion 512 requires, the confidentiality risks specific to AI tools, the supervision obligations for AI-generated work product, the hallucination problem and its candor implications, and how to build an AI use policy for your firm.

Disclaimer: This article is for general information only and does not constitute legal advice. AI ethics guidance is evolving rapidly. Consult your state bar's ethics resources and formal opinions for current guidance specific to your jurisdiction.

What Model Rule 1.1 Requires When Using AI

Model Rule 1.1 requires attorneys to provide competent representation, which includes the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation. Comment 8 to Rule 1.1, adopted by the ABA in 2012, states that competence includes keeping abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.

ABA Formal Opinion 512 applied Comment 8 specifically to generative AI. The opinion identifies five competence requirements when using AI for legal work:

  1. Understanding how the specific AI tool being used works, at a functional level sufficient to assess the quality of its output
  2. Understanding the tool's limitations, including the risk of hallucination (fabricated information presented as fact)
  3. Verifying AI-generated output before relying on it
  4. Maintaining the attorney's professional judgment and not delegating judgment to the AI
  5. Staying current as AI tools evolve

The practical implication: using ChatGPT to draft a brief and filing it without reading and verifying the output is a Rule 1.1 violation. Using AI-assisted legal research and failing to verify that the cited cases exist and say what the AI claims they say is a Rule 1.1 violation. The AI generated the output. The attorney is responsible for it.

The Confidentiality Problem (Model Rule 1.6)

Model Rule 1.6 requires attorneys to make reasonable efforts to prevent the inadvertent disclosure of information relating to the representation. When an attorney inputs client information into a third-party AI system, three questions arise:

  1. Is the client information being stored by the AI provider?
  2. Is the client information being used to train the AI model?
  3. Could the client information be disclosed to other users of the platform?

The answers depend entirely on the terms of service and data processing practices of the specific AI tool. Consumer-tier AI tools (the free or standard paid versions of major AI platforms) typically retain user inputs and may use them for model training. Enterprise or API versions of the same tools typically have different terms that prohibit storage and training use of inputs.

Before inputting any client-identifying information into an AI tool, attorneys must understand what happens to that data. ABA Formal Opinion 512 explicitly addresses this: attorneys must review the terms of service of any AI tool they use and must not use tools that retain or use client data in ways that would violate Rule 1.6.

The practical guidance: use AI tools through enterprise agreements that prohibit data retention and training, or use AI tools that process data without transmitting it to third parties. Generic consumer AI subscriptions are not an adequate solution for client-specific work.

Supervision Requirements for AI-Generated Work Product

Model Rule 5.1 requires supervisory attorneys to take reasonable measures to ensure that other attorneys at the firm comply with the Rules of Professional Conduct. Rule 5.3 imposes similar requirements regarding non-attorney staff. ABA Formal Opinion 512 applies the same logic to AI: an attorney who uses AI to generate work product is responsible for supervising that AI's output to the same extent they would supervise a subordinate attorney or paralegal.

What supervision of AI output looks like in practice:

Supervision does not mean rewriting everything the AI produces. It means verifying the output and taking professional responsibility for it. An attorney who reviews AI output and files it without verification has not supervised it. They have rubber-stamped it.

Hallucination Risk and Your Candor Obligation

AI hallucination refers to the tendency of large language models to generate false information with apparent confidence. In the legal context, this most commonly manifests as fabricated case citations: the AI produces a citation to a case that does not exist, or produces a citation to a real case but describes that case as saying something it does not say.

This has already produced disciplinary consequences. In 2023, attorneys in multiple jurisdictions were sanctioned for filing briefs that contained AI-generated citations to cases that did not exist. In Mata v. Avianca, the Southern District of New York imposed sanctions and required corrective filings after an attorney submitted a brief with six fictitious AI-generated citations. The court found that the conduct violated Federal Rule of Civil Procedure 11 and the duty of candor to the tribunal under Rule 3.3.

Model Rule 3.3 prohibits making false statements of fact or law to a tribunal and requires attorneys to correct false statements of material fact previously made. If an attorney discovers that a brief they filed contains a hallucinated citation, the duty to correct requires prompt disclosure to the court and corrective action. Hoping the court does not notice is not a compliant response.

State Bar AI Guidance (California, New York, Florida)

Several states have issued specific AI guidance beyond the ABA model:

California: The State Bar of California's Committee on Professional Responsibility and Conduct issued a Practical Guidance for the Use of Generative Artificial Intelligence in July 2023. California's guidance emphasizes confidentiality obligations, competence requirements, and the prohibition on unauthorized practice of law implications of AI use. California attorneys are advised to conduct a risk assessment before using any AI tool in client matters.

New York: The New York State Bar Association's AI Task Force issued a report in April 2024 that includes specific guidance on AI use in legal practice, addressing competence, confidentiality, supervision, and candor. The report recommends that firms adopt written AI policies and train attorneys and staff on AI use and risks.

Florida: The Florida Bar's Ethics Counsel has addressed AI questions informally and through the grievance committee process. Florida's guidance emphasizes that attorneys remain fully responsible for AI-generated work product and that bar discipline will follow the same standards regardless of whether the work was AI-assisted.

Building an AI Use Policy for Your Firm

A written AI use policy accomplishes three things: it establishes clear guidance for attorneys and staff, it creates a record of the firm's approach to AI ethics compliance, and it provides a framework for evaluating new AI tools before they are used in client matters.

A practical AI use policy for a small law firm should address:

  1. Approved tools: Which AI tools are approved for use in client matters? Include enterprise versions of tools with compliant data terms. Exclude consumer-tier tools.
  2. Client disclosure: When will clients be informed that AI has been used in their matter? Many firms include an AI disclosure clause in their engagement letters.
  3. Verification requirements: What verification is required before AI-generated content is filed or delivered? Specify citation verification, factual verification, and attorney review as mandatory steps.
  4. Confidentiality requirements: What information can and cannot be entered into AI systems? Prohibit entry of client-identifying information into tools without appropriate data terms.
  5. Prohibited uses: What is AI not authorized to do? Signing documents, exercising professional judgment on case strategy, and communicating directly with clients are examples.

Most law firms using AI are doing so without a policy, which means each attorney is making individual decisions about confidentiality and verification. That is not a manageable compliance posture as AI use scales across the firm. The firms building policies now, while AI use is still relatively limited, are in a significantly better position than those who wait until the first complaint to formalize their approach. The AI tools built specifically for law firm operations, as opposed to consumer AI products, include the data protections and compliance infrastructure that the ethics rules require. If you want to understand how that applies to your practice, book a free audit call. For related compliance guidance, see our post on law firm data security: protecting client confidentiality.