An AI policy tells everyone at your firm which AI tools they may use, what client information may go into them, and how AI output must be checked before it reaches a client or a court. Below is a free template you can copy and adapt or download in Word, an approved-tool assessment worksheet, notes for in-house teams, and a short plan for rolling it out.
This template is general information, not legal advice. Before adopting it, check the rules of professional conduct, court rules and client requirements that apply to your practice.
Download the policy and assessment worksheet
Both documents are editable in Microsoft Word and free to download. No account, signup or email address is required.
- Download the AI policy template (.docx) — the complete policy below, with placeholders for your firm's details and notes for in-house teams.
- Download the approved-tool assessment worksheet (.docx) — a blank form to record a vendor's data and security terms, test results, permitted uses, restrictions, approvals and review dates.
Replace the policy's bracketed fields and have the responsible lawyer adapt it to the firm's obligations. Complete a separate worksheet for each tool and configuration before adding it to the approved tools list. Record the evidence you reviewed and any conditions of approval; a completed worksheet is a decision record, not a security certification.
Why your firm needs an AI policy now
Lawyers are already using AI, whether or not the firm has approved a tool. A written policy turns individual habits into firm rules, and it is the clearest way to show that the firm meets its ethical duties.
Those duties are now spelled out. On July 29, 2024, the American Bar Association issued Formal Opinion 512, its first ethics guidance on generative AI. It applies existing Model Rules to AI use:
- Competence (Rule 1.1): lawyers need a reasonable understanding of what the AI tools they use can and cannot do.
- Confidentiality (Rule 1.6): before entering information about a representation into a tool that can learn from it, the lawyer needs the client's informed consent. The opinion says boilerplate in an engagement letter is not enough.
- Communication (Rule 1.4): in some situations clients must be told how AI is used on their matter.
- Candor and meritorious claims (Rules 3.1, 3.3 and 8.4(c)): lawyers must review AI output so that nothing false reaches a court.
- Supervision (Rules 5.1 and 5.3): managers must set clear policies and make sure lawyers and staff follow them.
- Fees (Rule 1.5): hourly billers may charge only for time actually spent, may not bill for learning a general-purpose tool, and may pass on AI costs only as disclosed direct costs.
State bars have issued their own guidance, including California's practical guidance (November 2023), Florida Bar Ethics Opinion 24-1 (January 2024), the New York State Bar Association's AI task force report (April 2024) and Texas Ethics Opinion 705 (February 2025). Courts are also watching: a public database of court decisions involving AI-hallucinated content had logged more than 2,200 cases by November 2026. We cover how to prevent that in How to avoid AI hallucinations in legal work.
What a good AI policy covers
- Which tools are approved, and who approves new ones.
- Which kinds of information may go into which tools.
- When the client must consent or be told.
- How AI output is verified, and who is responsible for it.
- How AI agents that carry out multi-step work are supervised.
- Court disclosure rules, billing, training, incident reporting and review.
The template
Replace the text in [brackets] with your firm's details. Delete sections that don't apply, and add any requirements from your clients' outside counsel guidelines.
[Firm Name] Policy on the Use of Artificial Intelligence
Effective date: [date]. Policy owner: [AI committee / General Counsel / Managing Partner].
1. Purpose and scope
This policy sets the rules for using artificial intelligence tools in [Firm Name]'s work. It applies to all partners, associates, counsel, paralegals, staff, contractors and anyone else working on firm or client matters, on any device. Its goal is to let the firm use AI to serve clients better while protecting client confidences, meeting our professional obligations and keeping lawyers responsible for all work product.
2. Definitions
- AI tool: any software that uses artificial intelligence to generate, summarize, analyze, translate or edit text, documents, images, audio or code.
- AI agent: an AI tool that carries out a series of steps toward a goal, such as reading documents, comparing them to firm standards and preparing a draft, with limited human input between steps.
- Client information: any information relating to the representation of a client, whatever its source.
- Approved tool: an AI tool listed on the firm's approved tools list for the uses stated there.
3. Approved tools
[Policy owner] maintains a list of approved AI tools and the uses each is approved for. Only approved tools may be used for firm or client work. Consumer AI tools that are not on the list may not be used with client information. To request a new tool, contact [contact]. Before approving a tool, the firm will confirm at least that:
- the vendor does not train AI models on firm or client data, and says so in its contract;
- data retention terms, including those of any AI model provider the vendor uses, are acceptable;
- the vendor provides current independent security assurance, such as a SOC 2 report;
- access is controlled through the firm's single sign-on, with the ability to remove users promptly.
4. What information may be entered into AI tools
- Public information (published law, public filings, news): any approved tool.
- Internal firm information (templates, know-how, firm policies): approved tools only.
- Client information: approved tools only, within the client's instructions, and with informed consent where section 5 requires it.
- Restricted information (for example health records, sealed or protective-order material, export-controlled data, or any matter where the client has prohibited AI use): not without written approval from [policy owner] and the responsible partner.
5. Client consent and communication
The responsible lawyer will obtain the client's informed consent before client information is entered into a tool that may retain or learn from it, and will follow any client instructions or outside counsel guidelines about AI. Consent and instructions are recorded in the matter file. Lawyers will answer client questions about AI use honestly and will tell clients about AI use when it is relevant to their decisions about the representation.
6. Verification of AI output
AI output is a draft, never a final work product. Before any AI-assisted work is sent to a client, filed or relied on:
- every case, statute and regulation cited is checked against the primary source to confirm it exists, says what is claimed and is still good law;
- every quotation is checked word for word against its source;
- facts are checked against the record or the client's documents;
- the lawyer who signs or sends the work has read it in full and takes responsibility for it.
7. Supervision and AI agents
Supervising lawyers are responsible for AI use on their matters, as they are for work done by any lawyer or staff member they supervise. AI agents may be used only for tasks approved by [policy owner], with access limited to the matters and systems the task needs. An AI agent may not send a communication outside the firm, file a document or commit the firm or a client to anything without approval from a lawyer. The firm keeps a record of each agent's approved scope and of who reviewed its output.
8. Courts and tribunals
Before filing, the responsible lawyer checks the local rules, standing orders and judge-specific requirements on AI disclosure or certification, and complies with them.
9. Billing
Lawyers billing by the hour record only the time actually spent, including time reviewing AI output. Time spent learning a general AI tool is not billed to clients unless the client asks for that work. AI tool costs are charged to clients only as direct costs that have been explained to the client in advance, without a markup. Client billing guidelines on AI take precedence.
10. Training
Everyone covered by this policy completes AI training before getting access to an approved tool, and a refresher [annually]. Training covers this policy, the limits of AI tools, verification and confidentiality.
11. Reporting problems
Report to [contact] within [24 hours] if client information was entered into a tool that is not approved, if AI output with errors reached a client or a court, or if you believe an approved tool is not working as expected. Reporting a mistake promptly is always better than not reporting it.
12. Review
[Policy owner] reviews this policy and the approved tools list at least every [six months] and whenever relevant rules or guidance change.
13. Acknowledgment
I have read and understood [Firm Name]'s Policy on the Use of Artificial Intelligence and agree to follow it.
Name: ____________________ Signature: ____________________ Date: __________
Adapting the policy for an in-house legal team
The same structure works for a corporate legal department, with a few changes:
- Align the approved tools list with the company's IT and security policies, which usually take precedence.
- Replace "client consent" with rules on what company and third-party information may be entered, including information covered by confidentiality agreements with customers and suppliers.
- Add a section on privilege: who may use AI on privileged material, and how to keep that work within the legal team.
- Add requirements for outside counsel: whether firms must disclose their AI use, and how AI-assisted work is billed.
- Cover AI use by business teams that send work to legal, such as AI-drafted contracts from sales.
How to roll out the policy
- Find out what people already use. A short anonymous survey is usually enough.
- Choose approved tools before the policy takes effect, so people have a compliant option on day one. Use the approved-tool assessment worksheet above to record your review.
- Set the data rules with IT and security, and configure single sign-on and access controls to match.
- Train before granting access, using real examples from your practice.
- Review after six months. Expect to update the approved tools list as the tools and guidance change.
How Gist fits a policy like this
Gist was built for these requirements. We never train models on your data, on any tier, and Zero Data Retention is enforced across every foundation model we route work to. Gist is SOC 2 certified, audited by EY, and the free tier gets the same security as the top tier. Answers in Gist link to the document and passage they came from, which makes the verification in section 6 faster. See our FAQ and trust center for details.
More from Gist
- How to Avoid AI Hallucinations in Legal Work
- Generative AI vs Agentic AI for Legal Work
- Will AI Replace Lawyers?
- Which AI Tools Review Contracts Inside Microsoft Word?
- Can Legal AI Draft Using My Firm's Own Precedents and Templates?
- Who Builds and Maintains Custom AI Agents for Law Firms?
- Gist Legal AI Evaluation: Contract Processing and Legal Research
