Aspen Management Group | AI Ethics and Compliance | Category: AI Ethics and Compliance
Author: Scott Samborn, Founder, Aspen Management Group | aspenmg.net
| TL;DR Attorneys at most law firms are already using AI tools with client data without a firm policy in place.Consumer-grade tools like the free version of ChatGPT do not meet attorney confidentiality obligations under bar ethics rules.ABA Formal Opinion 512 (July 2024) and DC Bar Ethics Opinion 388 (April 2024) both apply existing ethics rules to AI use.Firms need a written AI use policy, staff guidance, and a periodic review of actual practice.The risk is not theoretical — courts have already sanctioned attorneys for AI misuse. |
You have a data security policy. You have confidentiality agreements. You remind your team about privilege at every turn.
And somewhere in your firm, right now, an attorney or paralegal is pasting client information into ChatGPT.
This is not a hypothetical. It is happening in the majority of law firms that have not addressed it directly. The question is not whether it is occurring in your firm. The question is whether you know about it, and whether you have done anything to either stop it or make it safe.
Why are attorneys using AI tools with client data?
ChatGPT and similar tools are genuinely useful. Attorneys discover them on their own, often outside of work, and bring them into their practice because they save time. A paralegal uses one to draft a demand letter. An associate uses one to summarize a deposition. A partner uses one to outline an argument.
None of them intend to create an ethics problem. Most of them do not realize they are creating one.
The issue is what happens to the information they enter. By default, many AI tools retain conversation data for training purposes. Some route data through third-party servers. Even tools with enterprise privacy settings are only protective if they are enabled and if the person using them understands the distinction. Most attorneys using these tools on their own have not thought through any of that.
What does ABA Formal Opinion 512 say about AI use?
On July 29, 2024, the ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512, “Generative Artificial Intelligence Tools.” The opinion makes clear that attorneys using AI must fully consider their applicable ethical obligations under existing Model Rules of Professional Conduct.
Opinion 512 addresses six areas: competence (Rule 1.1), confidentiality (Rule 1.6), communication with clients (Rule 1.4), candor toward the tribunal (Rules 3.1 and 3.3), supervisory responsibilities (Rules 5.1 and 5.3), and reasonable fees (Rule 1.5).
The opinion is clear that AI tools are not substitutes for independent professional judgment. Attorneys remain fully responsible for the accuracy of any work product that incorporates AI output.
Full text: https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf
What does the DC Bar say about attorneys using AI?
DC Bar Ethics Opinion 388, issued in April 2024, is one of the most detailed AI ethics opinions in the country. It applies the DC Rules of Professional Conduct to generative AI with specific, practical guidance on competence, confidentiality, billing, and candor.
The opinion uses Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023) as a teaching example — the case where an attorney submitted a brief citing non-existent cases generated by ChatGPT and faced sanctions as a result.
In April 2025, the DC Court of Appeals formally adopted a technology competence duty into the DC Rules of Professional Conduct.
Full text: https://www.dcbar.org/for-lawyers/legal-ethics/ethics-opinions-210-present/ethics-opinion-388
What does Maryland require for attorney AI use?
As of early 2026, Maryland has not issued a formal AI-specific ethics opinion. However, the Maryland Attorneys Rules of Professional Conduct (MARPC) fully apply. Maryland Rule 19-301.1, Comment 8 requires attorneys to stay current with technology relevant to their practice, including understanding AI tools and their limitations.
The Maryland State Bar Association has published guidance through its AI and Legal Technology Task Force, including an Overview of Ethical Considerations for Attorney Use of Generative AI and four policy templates. These are practical tools, not binding opinions, but they reflect where Maryland bar leadership stands.
Many Maryland attorneys also hold DC bar membership and must comply with DC Ethics Opinion 388, which creates a higher floor for practice in the Baltimore-Washington corridor.
MSBA AI Resource Hub: https://www.msba.org/site/site/content/Resources-and-Tools-Content/AI-Insights-Resources-HUB.aspx
What happened to the attorneys sanctioned for AI use?
In Mata v. Avianca, a New York attorney used ChatGPT to research a brief. The tool generated citations to non -existent cases. The attorney submitted the brief without verifying the citations. When the fabrications were discovered, the court held a sanctions hearing and imposed penalties.
Since that case, courts across the country have sanctioned additional attorneys for similar conduct. The pattern is consistent: attorneys who treat AI as a reliable source rather than a drafting tool that requires verification face consequences when the output is wrong.
“I did not know how it worked” has not been a successful defense.
What does appropriate AI use actually require?
You do not need to prohibit AI use. You need to manage it. That means:
- A written policy that specifies which tools are approved and what information may and may not be entered into them
- Clear guidance on the difference between enterprise tools with data agreements and consumer-grade tools
- Staff training specific enough to be useful — not “be careful with AI” but “here is what you may and may not put into Copilot and here is why”
- A periodic check to verify that what you think is happening matches what is actually happening
None of this requires a large investment. It requires intention and follow-through.
The Maryland bar is not trying to stop attorneys from using AI. It is requiring that you use it with the same professional judgment you apply to everything else.
What should a firm do this week?
- Ask two or three attorneys and two staff members what AI tools they are currently using for work. You may be surprised by the answers.
- Check whether your Microsoft 365 subscription includes Copilot and whether data handling settings have been configured for a legal environment.
- Review your current technology policy. Does it mention AI? If not, it is already out of date.
Frequently Asked Questions
Is it ever acceptable for attorneys to use ChatGPT with client information?
The free consumer version of ChatGPT does not meet the confidentiality standard required by attorney ethics rules. The paid enterprise version, with appropriate data handling agreements in place, may be acceptable depending on the specific use. Microsoft 365 Copilot, which keeps data within your Microsoft tenant, is a more reliable choice for most law firms.
What is the difference between consumer AI tools and enterprise AI tools?
Consumer tools like the free version of ChatGPT may retain your input data and use it to train future models. Enterprise tools with appropriate data processing agreements prohibit this and keep your data within a controlled environment. The distinction matters significantly for attorney confidentiality obligations.
Does ABA Formal Opinion 512 apply to Maryland attorneys?
ABA opinions are persuasive but not binding. However, Maryland’s existing rules on competence and confidentiality lead to the same obligations. Maryland attorneys who also hold DC bar membership are subject to DC Ethics Opinion 388, which is binding in DC.
What is the first step toward AI compliance for a small law firm?
The most important first step is a written AI use policy that specifies which tools are approved, what information may be entered into them, and what staff guidance applies. The MSBA has published four policy templates that are a useful starting point.
What are the court sanctions for improper AI use?
Courts have imposed monetary sanctions, required attorneys to attend ethics training, and in some cases referred matters to state bar disciplinary bodies. The sanctions in Mata v. Avianca included public reporting of the incident, which carries significant reputational consequences beyond the financial penalty.
Aspen Management Group works with boutique advisory firms to clarify key workflows, layer in AI where it truly adds value, and build governance and training around that change.
aspenmg.net
Scott spent 20 years running a managed IT services practice with law firm clients across the DC Metro area, and has worked in technology for 30 years. AMG helps boutique law firms get practical value out of AI.