Law Firm AI Policy: A One-Page Template for Small Firms

A one-page law firm AI policy template for small firms, written for the gap between an outright AI ban and staff quietly using ChatGPT on their own phones.

Written by Miriad with AI assistance and checked against the sources at the end. A template for office practice, not ethics advice: adapt it to your state bar's rules.

TL;DR: A small firm needs a written AI policy because a ban rarely stops use, it just hides it. One page is enough: what the firm uses, what never goes in, who checks the output, what the client is told, and how billing works. The structure below follows ABA Opinion 512 and the California, North Carolina and Texas guidance.

Here is the situation we see most often in firms of two to ten people. One partner has said "no AI here". Meanwhile the assistant uses a free chatbot to tidy up emails, an associate tries it for a first draft of a blog post, and nobody knows what was pasted in. The ban did not remove the risk; it removed the conversation.

A one-page law firm AI policy closes that gap. It is part of small law firm marketing as much as practice management, because most early AI use in a small office is on marketing and admin text.

Why does a small firm need an AI policy at all?

A small firm needs an AI policy because the ethics opinions expect one, and because people in the office are probably using AI already. Opinion 512 expects firm managers to set clear GenAI rules for lawyers and staff. A written page turns private guesses into one shared, checkable rule that a new hire can read.

The expectation is explicit. ABA Formal Opinion 512, issued in July 2024, says managerial lawyers should establish clear policies on GenAI use for lawyers, non-lawyers and staff (National Law Review, 2024). Supervising non-lawyer assistants is an old duty; the policy is how you meet it for a new tool.

The use is real too. Smokeball's 2025 survey found that 53% of small firms and solos already use generative AI in their workflows, while 53% still have ethical concerns (LawNext, 2025). Those two figures together describe the gap: people are using it while still unsure what is allowed.

A ban also has a cost that is easy to miss. Texas Opinion 705 does not require lawyers to use GenAI, but it says those who do need a "reasonable and current understanding" of it (Texas Opinion 705, 2025). A firm that bans AI on paper while staff use it in private ends up with neither control nor understanding.

What belongs on the one page?

The page needs five parts: approved tools, the client-data rule, the review rule, the client-consent rule and the billing rule. Each part should be a short sentence a non-lawyer can follow without asking. If a rule needs a paragraph to explain, it is probably two rules and belongs in a separate procedure.

Copy this and fill in the parts in parentheses:

(Firm name) AI rules, version (date)

  1. Approved tools. We use (tool names) for (drafting marketing text, summarising public material, formatting). Any other AI tool needs (partner name)'s approval first.
  2. Client data. No client names, facts, documents or matter details go into any public AI tool. Client information goes only into (tool name), approved after we read its terms of use and privacy policy, and only for (tasks).
  3. Review. A lawyer reads every AI output before it leaves the firm or goes into a file. Every citation, quote and statement of law is checked against the original source.
  4. Clients. Where a client's information will be used with an AI tool, the client gets a specific explanation and gives informed consent. A general engagement letter clause is not enough.
  5. Billing. We bill for time actually spent. We do not bill for learning an AI tool or for time a task would have taken without AI. General AI subscriptions are firm overhead.
  6. Questions and mistakes. Ask (name) whenever you are unsure. Report anything pasted by mistake to (name) the same day.

Point 2 reflects California's 2026 guidance, which says a vendor's "generalized marketing assurances" are not enough and that reasonable efforts may include reviewing terms of use and privacy policies (State Bar of California, 2026). Point 6 matters more than it looks: a policy without a no-blame route for mistakes gets ignored.

The policy should say that consent for AI use on a client's matter is specific, not boilerplate. Opinion 512 says general engagement letter provisions are not sufficient informed consent for self-learning tools. The client should understand which tool, for what task, and what happens to their information, before you rely on that consent.

North Carolina draws a useful line for small firms. Its 2024 FEO 1 says disclosing AI use is generally not required for ordinary tasks such as research, while delegating substantive work is "akin to outsourcing" and needs informed consent (North Carolina State Bar, 2024). The same opinion tells lawyers to avoid putting client-specific information into publicly available AI resources.

In practice that means two versions of the engagement letter paragraph: a short, plain note for firms that keep AI to marketing and admin with no client data, and a specific consent paragraph for any matter where client information will go into an approved tool. Your state bar's opinion decides the exact wording; the policy only needs to say which version applies when.

What should the policy say about billing for AI-assisted work?

The policy should say the firm bills for actual time, never for learning the tool, and never for time saved. Opinion 512, North Carolina and Texas all take this line. Flat fees are the cleaner way to share the efficiency, and California suggests firms may consider building AI savings into flat-fee rates.

The sources are consistent. Under Opinion 512 a lawyer may not bill clients for time spent learning a GenAI tool (National Law Review, 2024). North Carolina and Texas say a lawyer may not bill for the time a task would have taken without AI (North Carolina State Bar, 2024; Texas Opinion 705, 2025). California adds that subscriptions to general-purpose AI tools are typically overhead rather than a separate charge to the client (State Bar of California, 2026).

For marketing work this is easy: marketing is never billed to clients anyway. The billing line matters once AI moves from the newsletter to the file, and it is better written down before that happens.

How do you roll the policy out in a two-to-ten person office?

Roll it out in one short meeting: read the page together, show one safe and one unsafe example, and agree who answers questions. Then review it every few months, because tools and opinions change. For EU firms, this meeting also helps with the AI Act's AI-literacy duty.

Example (illustrative, not a real case): A two-partner estate-planning firm with one assistant uses a general chatbot and practice management software. Before the meeting, the partners write the page above. In the meeting they show two prompts: "rewrite our page on powers of attorney in plainer English" (fine, no client data) and "summarise this client's will and tell me what's missing" (not in a public tool, ever). The assistant asks whether she can use AI for a client's appointment reminder. The answer goes on the page as a new line: reminders are written from the template, not by AI with the client's details. The policy gets one line longer, and the next person with the same question does not have to ask.

Three habits keep the page alive:

  1. Date it. California replaced its 2023 guidance in 2026 and added agentic AI at the state Supreme Court's request, so your page will go out of date too.
  2. Keep a verification habit. The Mata v. Avianca sanctions order is the reason point 3 exists: the court said AI use was not improper in itself, but filing unverified, invented citations was (Mata v. Avianca, 2023).
  3. Train once, briefly. In the EU, the AI-literacy duty under Article 4 applies from 2 February 2025 to deployers, including law firms (EU AI Act, Article 4).

Once the page exists, the flat rule sheet in what you can put into ChatGPT as a lawyer makes point 2 concrete, and the law firm marketing plan example shows where AI fits in the weekly marketing routine. The full set of tactics, each checked against confidentiality, is in the small law firm marketing guide.

If you want the policy, your practice areas and your fee structure in one place that any AI tool can read before it drafts, the Business Brain Starter Kit is built for that. Get notified when it launches.

FAQ

Should a small law firm ban AI completely?

A ban is allowed, since no opinion requires lawyers to use AI. But a ban that staff quietly ignore is worse than a clear rule, because nobody knows what was pasted where. If you ban, say so in writing, explain why, and check that it holds. Most small firms do better with a narrow permission: approved tools, no client data, lawyer review.

Does a solo lawyer with no staff need a written AI policy?

It still helps. Writing one page forces you to decide which tools you trust, what you never paste and how you check outputs, before you are under deadline pressure. It also gives you something concrete to show a client who asks, and a starting point the day you hire an assistant or bring in a contract lawyer.

Is our engagement letter enough to cover AI use?

Not if it is a general clause. ABA Opinion 512 says boilerplate engagement letter provisions are not sufficient informed consent to put client data into self-learning tools. Consent should be specific to the tool and the task. For marketing and admin use with no client data, a short plain note may be enough, depending on your state.

How often should the AI policy be updated?

Review it whenever you adopt a new tool and at least a few times a year. Guidance moves: California replaced its 2023 guidance with a 2026 version that also addresses agentic AI. Put a version date on the page, note what changed, and read the new version together with staff so nobody is working from the old rule.

Sources

Related articles

Products from Miriad

Business brainBusiness Brain Starter Kit

Stop explaining your business from scratch. Write it down once, with a source next to every line.

49 USD

Get notified

See all prompt packs