Staff using approved versus unapproved tools
Shows whether the policy and approved options are actually adopted.
Law firms · AI usage policy and governance
A practical AI policy your attorneys will actually follow
Your attorneys and staff are already using generative AI, whether or not the firm has decided anything. Some are drafting emails in a free chat tool. Some are summarizing deposition transcripts. A few may have pasted client facts into a public model. ABA Formal Opinion 512 makes clear that the duties of competence, confidentiality, communication, supervision and reasonable fees all apply to this use.
How it often works today
- There is no written policy, or a one-line ban that everyone quietly ignores because the tools are useful and nobody enforces it.
- Staff use personal accounts on public AI tools, and the firm has no visibility into what client information may have been entered.
- Partners are unsure how to supervise AI-assisted work, so verification of citations and facts depends on each associate's habits.
- The firm has no position on billing for AI-assisted tasks or on what to tell clients, and client outside counsel guidelines are starting to ask.
An AI use policy turns those duties into rules people can follow on a Tuesday afternoon: which tools are approved, what data can go where, when output must be verified, how AI-assisted time is billed and when clients are told. We would draft it with your managing partner and ethics counsel, then back it with tool settings and short training so it is more than a PDF.
The improved workflow
Inventory current use
A short anonymous survey and a review of software subscriptions show which AI tools people actually use, for what tasks and with what kinds of data.
Classify tools and data
Tools are sorted into approved, approved with limits and prohibited, based on vendor terms, data retention and training settings. Data is sorted by sensitivity.
Draft the policy with the firm
A plain-language policy covers approved uses, verification duties, supervision, billing, client communication and incident reporting, reviewed by your ethics counsel.
Configure tools to match
Enterprise accounts, disabled training settings, single sign-on and blocked consumer tools on firm devices make the policy the default rather than a request.
Train and review
Short practical sessions show attorneys and staff what good use looks like, and the policy is reviewed every six months as tools and bar guidance change.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
Staff who completed training
Supervision duties are easier to meet when everyone has the same baseline.
Policy questions or incidents reported
A healthy number of questions means people are engaging with the rules.
Where people stay in control
- The final policy is approved by the managing partner and reviewed by the firm's ethics counsel; InTheory does not provide legal or ethics advice.
- No client confidential information goes into any AI tool that has not been reviewed and approved under the policy.
- Every AI-assisted work product that reaches a client or court is verified by the responsible attorney, including all citations and factual statements.
Example
Illustrative: a 25-person firm's first policy
For example, a 25-person firm finds that eleven people use AI tools, mostly free consumer versions, for drafting emails and summarizing documents. The firm approves an enterprise tool with training disabled, prohibits consumer accounts for client work, requires citation checks on anything filed, and decides that AI-assisted time is billed at actual time spent. Training takes two lunch sessions. This illustrative example shows the shape of a first policy, not a recommendation for your firm.
Tools typically involved
What the first 30 days look like
In the first 30 days we would survey current AI use, review the terms of every tool in use, and map the firm's data types by sensitivity. You would receive a draft policy outline and a recommended approved tool list for partner and ethics counsel review.
Common questions
Should we just ban AI tools?
Bans tend to push use onto personal devices where the firm has no visibility. Most firms are better served by approving a small number of tools with appropriate data terms, setting clear limits, and training people. That said, the decision belongs to your partners.
Does the Colorado AI Act affect our firm?
Colorado's SB 26-189, which replaced SB 24-205 and takes effect January 1, 2027, sets obligations when automated decision-making technology is used in consequential decisions. Whether and how it applies to your firm is a legal question for your counsel. Your policy should note who monitors these developments.
How long does it take to put a policy in place?
A workable first version, with tool settings and training, typically fits within the first 30 to 60 days of an engagement. The policy should then be reviewed periodically, since tools and bar guidance are changing quickly.
The business case
Does it pay for itself?
Illustrative defaults for a law firm. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
AI usage policy and governance in other industries
Accounting and CPA firmsArchitecture firmsFinancial advisory firmsMedical and specialty clinicsNonprofit organizationsTax preparation offices
AI usage policy and governance: full guide
Related guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small business
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.