Question 1

Do I need a written AI use policy for my California law firm?

Accepted Answer

Yes, in practice. CRPC 1.1 (competence) read together with ABA Formal Opinion 512 (2024) on generative AI competence and CRPC 5.3 (supervision of non-lawyer assistance) effectively requires a written framework that addresses confidentiality, supervision, hallucination review, and client disclosure. Without it, you are relying on individual attorney judgment for issues the firm has not collectively addressed.

Question 2

Do I need a BAA or DPA with my AI vendor?

Accepted Answer

If you input any client-confidential information into a third-party AI tool, CRPC 1.6 (confidentiality) requires reasonable safeguards. A Business Associate Agreement (where HIPAA applies) or a Data Processing Addendum that addresses training-data use, retention, and confidentiality is the baseline. Free consumer tiers of most AI tools are not appropriate for confidential client work.

Question 3

Do I have to disclose AI use to my clients?

Accepted Answer

Disclosure intersects with CRPC 1.4 (communication), 1.5 (fees), and 5.3 (supervision). The defensible posture is to address AI use in your engagement letter (or an addendum) and again in the matter-specific scope, so the client knows AI is being used, that you are supervising it, and how it affects fees.

Law Firm AI Implementation Evidence Pack

Your firm's AI use today