Aspen Management Group | AI Ethics and Bar Compliance | 5/15/26
You have a data security policy. You have confidentiality agreements. You remind your team about privilege at every turn.
And somewhere in your firm, right now, an attorney or paralegal is pasting client information into ChatGPT.
This is not a hypothetical. It is happening in the majority of law firms that have not addressed it directly. The question is not whether it is occurring in your firm. The question is whether you know about it, and whether you have done anything to either stop it or make it safe.
Why This Keeps Happening
ChatGPT and similar tools are genuinely useful. Employees discover them on their own, and bring them into their practice because they save time. A paralegal uses it to draft a demand letter. An associate uses it to summarize a deposition. A partner uses it to outline an argument. None of them intend to create an ethics problem. Most of them do not realize they are.
The issue is what happens to the information they enter. By default, many AI tools retain conversation data for training purposes. Some route data through third-party servers. Even tools with enterprise privacy settings are only protective if they have been enabled and if the person using them understands the distinction.
Most attorneys using these tools on their own have not thought through any of that. They are solving a problem in front of them. The ethics analysis is your job, not theirs, unless you have made it their job through clear guidance.
What the Bar Says
The ABA addressed this directly in Formal Opinion 512, issued in 2024. The opinion makes clear that attorneys have a duty of competence that includes understanding the tools they use, a duty of confidentiality that extends to AI platforms handling client data, and supervisory obligations that apply to how staff use these tools.
The Maryland State Bar has issued similar guidance. Virginia and DC bar ethics committees have weighed in as well. The common thread across all of them: using AI with client information is not automatically prohibited, but it requires informed judgment and appropriate safeguards.
“I did not know” is not a defense to a bar complaint. Neither is “everyone is doing it.”
What Appropriate Safeguards Actually Look Like
You do not need to prohibit AI use. You need to manage it. That means:
- A written policy that specifies which tools are approved, under what conditions, and what information may and may not be entered into them
- Clear guidance on the difference between tools with enterprise data agreements and consumer-grade tools
- Staff training that is specific enough to be useful — not “be careful with AI” but “here is what you may and may not put into Copilot, and here is why”
- A periodic check to verify that what you think is happening matches what is actually happening
None of this requires a large investment. It requires intention and follow-through.
The Firms Getting This Right
The boutique and mid-size firms handling this well are not necessarily the most tech-forward ones. They are the ones where a managing partner decided to get in front of it rather than hope for the best. They did the work to understand what their team was already using, made some decisions about what was acceptable, communicated those decisions clearly, and built a simple policy that reflects how they actually practice.
That is a half-day of focused work. The firms that skip it are gambling with their bar license and their clients’ trust.
What to Do This Week
- Ask two or three attorneys and two staff members what AI tools they are currently using for work. You may be surprised by the answers.
- Check whether your Microsoft 365 subscription includes Copilot and, if so, whether data handling settings have been configured for a legal environment.
- Look at your current technology policy. Does it mention AI at all? If not, it is already out of date.
If you want a structured way to work through this, the AI Governance Workshop and AI Ethics and Compliance Review at AMG are built exactly for this situation. But even without outside help, the three steps above will tell you where you stand.
Aspen Management Group works with boutique advisory firms to clarify key workflows, layer in AI where it truly adds value, and build governance and training around that change.
aspenmg.net
Scott spent 20 years running a managed IT services practice with law firm clients across the DC Metro area, and has worked in technology for 30 years. AMG helps boutique law firms get practical value out of AI.