AI tools for small law firms, inside the ethics rules

The short answer

The AI tools that help small law firms most fall into five groups: AI inside legal research platforms, drafting and review assistants in Word and practice software, transcription and summarization, intake and scheduling, and document extraction for discovery and records. The safest starting point is usually AI built into tools the firm already licenses, because the data stays under contracts you have reviewed.

Ethically, AI is allowed but not hands-off. ABA Formal Opinion 512, issued in July 2024, applies the existing duties of competence, confidentiality, communication, candor, supervision and reasonable fees. State bars, including Florida in Opinion 24-1, have reached similar conclusions. This is general information, not legal or ethics advice. Check your own jurisdiction’s rules.

Five categories of AI tools

1. Legal research with AI

Major research platforms now include AI that answers questions and drafts summaries grounded in their own case law and statute databases, with links to sources. They reduce, but do not remove, the risk of invented authority. Every citation still needs reading.

2. Drafting and document review

Assistants in Microsoft Word and practice management software draft first versions of letters, discovery requests and clauses, compare versions and summarize contracts. Microsoft states that Copilot used with a work account has enterprise data protection, and that prompts and responses are not used to train its foundation models, which matters for client confidentiality.

3. Transcription and summarization

Tools that transcribe client meetings, depositions and calls, then produce summaries and action items. Check recording consent laws in your state, and whether the vendor stores audio and for how long.

4. Intake, scheduling and client communication

Website chat, intake forms that sort inquiries by practice area, conflict-check preparation and appointment reminders. Anything client-facing must not give legal advice and must comply with advertising and solicitation rules. Florida’s opinion specifically addresses chatbots that interact with prospective clients.

5. Document extraction and e-discovery

AI that classifies, extracts and flags documents in large productions or medical records. These tools speed review, but the lawyer remains responsible for the result.

What the ethics opinions require

A plain-English summary of the main duties under ABA Formal Opinion 512, which state opinions largely echo:

• Competence (Rule 1.1). Understand, at a reasonable level, what the tool does, its limits and its risks. You do not need to be an engineer, but you cannot treat it as a black box.
• Confidentiality (Rule 1.6). Before entering client information, assess whether the tool could disclose it, including through training on inputs. For self-learning tools, the opinion says informed client consent may be needed, and boilerplate in an engagement letter is not enough.
• Communication (Rule 1.4). In some situations you must tell clients you use AI, for example when it affects the representation or fees, or when the client asks.
• Candor and meritorious claims (Rules 3.1, 3.3, 8.4(c)). Verify everything submitted to a court. In Mata v. Avianca (S.D.N.Y. 2023), lawyers were sanctioned after filing a brief with case citations generated by a chatbot that did not exist.
• Supervision (Rules 5.1, 5.3). Partners must set clear policies, train lawyers and staff, and vet vendors.
• Fees (Rule 1.5). Hourly billing must reflect actual time. Do not bill for time saved, and do not charge clients for learning a general tool.

What Florida’s Opinion 24-1 adds

The Florida Bar issued Ethics Opinion 24-1 in January 2024, before the ABA opinion. Like all advisory opinions it is not binding, but it is a useful model for firms anywhere. It concludes that lawyers may use generative AI if they protect client confidentiality, provide accurate and competent services, avoid improper billing and follow advertising rules.

• It recommends informed client consent before using a third-party AI tool that would disclose confidential information, and notes that an in-house tool that does not share data with a third party lowers the risk.
• It says the lawyer is responsible for what an intake chatbot tells prospective clients, and that people should be told they are dealing with an AI program.
• It warns against billing practices such as charging more than once for the same work because AI produced it quickly.

Is your firm’s IT ready for AI tools? Confidentiality depends as much on accounts, permissions and devices as on the AI itself. Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, automation and AI opportunities, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Questions to ask every AI vendor

1. Does the vendor use our inputs or outputs to train its models? Can that be switched off contractually?
2. Where is data stored, for how long, and who at the vendor can access it?
3. Can we enforce single sign-on and multi-factor authentication, and remove users immediately?
4. Are subcontractors, including the underlying AI model provider, bound by the same terms?
5. What security assessments or audits can the vendor share?
6. How do we export or delete our data if we leave?
7. For research tools: how does the product link answers to sources, and what does it do when it cannot find authority?

A safe rollout for a small firm

1. Inventory current use. Ask everyone, including paralegals and assistants, which AI tools they use. Shadow AI is the biggest confidentiality risk.
2. Write a short AI policy. Approved tools, what client data may go into each, verification rules, client communication and billing guidance. Name a responsible partner.
3. Start with built-in tools. AI inside your research platform, Microsoft 365 and practice software, under contracts you already have.
4. Pick one or two workflows. For example, first-draft demand letters or deposition summaries. Measure time and error rates.
5. Verify, then file. Every citation pulled and read. Every factual statement checked. Keep a note of how AI was used in the matter file if your policy requires it.
6. Lock down the basics. Multi-factor authentication, encrypted devices, same-day removal of departing staff, tidy document permissions and tested backups.
7. Review quarterly. Bar guidance is still developing. Update the policy as opinions and tools change.

Tasks to keep with lawyers

• Legal strategy and advice to clients
• Final review of anything filed or sent under the firm’s name
• Conflict decisions
• Fee agreements and billing judgments
• Sensitive client conversations

Getting the foundations right

AI magnifies whatever state your systems are in. If client files are shared too widely, an AI assistant can surface them to the wrong person. If passwords are weak, every stored conversation is exposed. Our guide to IT support for law firms covers the essentials, and our automation and practical AI team helps firms set up AI tools within those foundations. Confirm ethics questions with your bar’s ethics hotline or counsel.

Keep reading

• AI acceptable use policy: what to include for your employees
• Zapier vs Make: pricing, complexity and reliability compared for 2026
• ChatGPT for small business: practical uses, which plan to pick and the settings to change
• AI for small business owners: practical, safe uses that save time

Related services

• Automation and practical AI
• IT support for law firms
• Cybersecurity services
• Free Technology Health Assessment