The ABA's new guidance on generative AI and client data

When the ABA issued Formal Opinion 512, it did not create a new duty so much as apply an old one to a new tool. Rules 1.1 and 1.6 already require competence and confidentiality. What the opinion adds is clarity: if client information is entered into a generative AI tool, the firm must understand where that data goes, who can see it, and whether it can be recalled.

What the opinion actually asks of you

Three obligations matter most in day-to-day practice. First, competence — you need a working understanding of the tool's limits before you rely on it. Second, confidentiality — client data should not flow into a consumer tool that trains on inputs or retains them indefinitely. Third, supervision — a junior associate using AI to draft a brief is still practising under your licence and your judgement.

The practical controls that satisfy it

Most firms we support land on the same short list: a written AI use policy, a firm-approved tool with a no-training data agreement, a rule that client identifiers never enter an unapproved tool, and a review step before anything leaves the office. None of that is exotic. The failure mode is almost always the same — no written policy, and a partner who assumes somebody else wrote one.

Where IT comes in

Policy only holds if the technology supports it. That means email and web controls that block unapproved AI services, device management that keeps firm data on firm machines, logging so you can answer "what happened" if a client asks, and an AI tool that is provisioned centrally instead of expensed quietly on a personal card.

If you are not sure what your attorneys are already using, that is the place to start. A short review of browser traffic, approved applications and your current engagement letters will tell you more than another policy draft.