Sixty percent of mid-sized firms report having formal policies guiding AI use, per Clio's March 2026 report. At the small end the figure is not encouraging enough for anyone to have led a press release with it.
Part of that is that "write an AI policy" sounds like a project. It is not. It is roughly two pages, and most of the work is finding out answers you do not currently have rather than writing them down.
Why the document is named at all
Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI, and supervisory lawyers must make reasonable efforts to ensure that the firm's lawyers and nonlawyers comply
ABA Formal Opinion 512, July 2024, as quoted in The Bar Examiner — the opinion is here
Note the second half. Establishing the policy and ensuring compliance are two separate obligations landing on two different people, and the compliance half explicitly reaches non-lawyers.
The seven headings
- Approved tools, named by plan The list is not "ChatGPT" or "Copilot". It is the product and the subscription plan, because the protections differ between plans of the same product. Anything not on the list is not approved, which is the only way a list of this kind does any work. Why it is in scope: Microsoft's own documentation states "the specific controls will vary depending on a customer's Microsoft subscription plans."
- What may never be entered, by category Written as categories of information rather than as a feeling. This is the section that takes the longest and it is the one that decides whether anybody can follow the policy without asking a partner. Why it is in scope: Model Rule 1.6(c) covers "information relating to the representation of a client" — broader than privilege, and broader than most people assume.
- Who approves a new tool, and how One named person, and the questions they have to answer before saying yes. Without this, the policy is out of date the first time somebody finds something useful. Why it is in scope: Texas Opinion 705 requires understanding how the technology works, reviewing the terms of service, and learning about data-security protections — per tool.
- Verification of output, and who does it Which work products get checked, against what, by whom, before they leave. Why it is in scope: Texas Opinion 705 — "Lawyers are responsible for the work product they submit regardless of who (or what) does the original research and drafting."
- Supervision, including non-lawyer staff Who is responsible for whom. The compliance duty in Opinion 512 names "the firm's lawyers and nonlawyers", so a policy addressed only to attorneys leaves out most of the people typing. Why it is in scope: ABA Formal Opinion 512, quoted above.
- When the client is told, and how consent is taken Opinion 512 requires informed consent before information relating to the representation goes into a self-learning tool — and says a general clause will not do it. The client is entitled to "particulars about the kinds of client information that will be disclosed." Why it is in scope: ABA Formal Opinion 512 on Rule 1.6 and informed consent.
- Billing The shortest section and the one most likely to be missed. Both authorities land in the same place: bill actual time. Why it is in scope: Opinion 512 — "When lawyers are billing hourly, they must only bill for their actual time" and "a fee charged for which little or no work was performed is an unreasonable fee." Texas 705 agrees: you may charge for time spent using and refining the output, not for the time saved.
The test that tells you whether it worked
A policy is not measured by whether it exists. Plenty of firms have one that was adopted at a partners' meeting and has not been opened since, and that document is doing nothing at all.
The test is a person. Take somebody three months into the job — a paralegal, a new associate — hand them a real document from a real matter, and ask whether they may put it into the firm's approved tool. If they can answer from the policy, without asking anybody, it is a control. If they have to come and find a partner, it is a document.
That is a five-minute test and it is worth more than the drafting.
What to do
If you already have a policy, run the five-minute test this week. One new-ish member of staff, one real document, one question. You will know inside five minutes whether you have a control or a filed document, and that is worth more than another drafting session.
If you do not have one yet, do not start by writing. Start by finding out which plans your accounts are actually on and what those plans' own documentation says, because sections one, two and three cannot be written until you know. That part delegates; the signing does not, because Opinion 512 puts it on managerial lawyers by name. Then the writing takes an afternoon.
What it costs to leave it is not a fine and we are not going to pretend it is. It is narrower than that: the compliance half of Opinion 512 reaches "the firm's lawyers and nonlawyers", so a policy the paralegals have never opened leaves you holding the document without the thing the document was for.
How to find out which plans you are on, in about ten minutes and without buying anything, is the last post in this series.
If you would rather work through those seven headings with somebody rather than from a blank page, the consulting page is the way in — though the drafting itself is legal work and stays with your lawyers. The five-minute test costs nothing and you can run it today.