AI Ethics for Lawyers: A Practical Compliance Checklist for Using Generative AI in Client Work

If you're a solo or small-firm attorney, you've probably already experimented with ChatGPT, Claude, or Copilot. Maybe you've used them to draft a demand letter, summarize a contract, or brainstorm legal arguments. The efficiency gains are real—but so are the ethics risks. In Mata v. Avianca, two attorneys were sanctioned in 2023 for submitting a brief that cited non-existent judicial opinions fabricated by ChatGPT. That case became the cautionary tale that prompted bar authorities across the country to issue formal guidance on generative AI in legal practice.

The regulatory landscape has moved fast since then. In July 2024, the ABA issued Formal Opinion 512, the first comprehensive national ethics guidance on generative AI tools in legal practice. In February 2025, the State Bar of Texas Professional Ethics Committee issued Opinion 705, applying the Texas Disciplinary Rules to AI use. California, Florida, New Jersey, New York, and other states have all weighed in. And in Texas, the Texas Responsible AI Governance Act (TRAIGA), signed into law in June 2025 and effective January 1, 2026, adds a new compliance layer for attorneys whose clients develop or deploy AI systems.

This article walks through the four duty clusters that every solo and small-firm attorney must address before using generative AI in client work: competence, confidentiality, supervision, and communication. We've previously covered Model Rule 1.1 competence and confidentiality obligations in a general context—this piece is the practical checklist that turns those principles into concrete do's and don'ts.

Duty of Competence (ABA Model Rule 1.1 / Texas Rule 1.01)

ABA Model Rule 1.1 requires lawyers to provide competent representation, which Comment 8 extends to maintaining "the benefits and risks associated with relevant technology." The Texas Disciplinary Rules impose a parallel obligation under Rule 1.01, which defines competence as "the possession or the ability to timely acquire the legal knowledge, skill, and training reasonably necessary for the representation of the client." As the Texas Ethics Committee explained in Opinion 705, this duty extends to "technological competence," building on prior opinions about cloud computing and electronic metadata.

What this means in practice: Before you use any generative AI tool for client work, you must understand—at a reasonable level—how it works. That includes understanding what "hallucinations" are (the tendency of AI models to fabricate plausible-sounding but false answers), how the tool's training data may be incomplete or outdated, and what the tool does with your inputs. You don't need to become a machine learning engineer, but you do need enough working knowledge to evaluate the risks.

Do:

• Take a CLE or online course on generative AI fundamentals for lawyers before using these tools in client work
• Read the terms of service and privacy policy of any AI tool you plan to use
• Test the tool on non-client research first to understand its limitations and failure modes
• Stay current—the technology changes monthly, and your competence obligation is ongoing

Don't:

• Paste a client's fact pattern into a public AI tool and trust the output without verification
• Assume that because a tool produces confident, well-formatted text, the content is accurate
• Treat AI-generated case citations as verified research without independently confirming each one

The ABA's Formal Opinion 512 makes clear that lawyers "must understand the capacity and limitations of GAI and periodically update that understanding." This is not a one-time requirement—it's a continuing duty.

Duty of Confidentiality (ABA Model Rule 1.6 / Texas Rule 1.05)

This is where most ethics violations are likely to occur. ABA Model Rule 1.6 prohibits lawyers from revealing information relating to the representation of a client. Texas Rule 1.05 imposes an even broader duty, covering both privileged information and "all other information relating to a client or furnished by the client" during the representation.

The core problem is this: many generative AI tools are "self-learning"—they store and incorporate user inputs into their training data to improve future responses. If you paste a client's confidential facts into a public ChatGPT prompt, that information could potentially be exposed in the tool's response to a different user's query later. The Texas Ethics Committee was blunt: "The use of such self-learning programs poses a risk that the confidential information a lawyer inputs to the program may be stored within the program and revealed in responses to future inquiries by third parties. That is obviously unacceptable."

The California State Bar's Practical Guidance, issued in November 2023, similarly warns lawyers against "uploading or inputting confidential client information in GenAI platforms" that "may lack reasonable or adequate security."

Do:

• Use enterprise or pro-tier AI tools that contractually prohibit training on your inputs (e.g., ChatGPT Team/Enterprise, Claude Pro with data retention disabled, Copilot for Microsoft 365 with business data protection)
• Anonymize or abstract client facts before inputting them into any AI tool—replace names, dates, and identifying details with generic placeholders
• Review the tool's terms of service to confirm whether inputs are used for model training
• If you need to input confidential information, obtain informed client consent first and document it
• Consult with IT or cybersecurity professionals to verify the tool's security and data retention protocols, as the California guidance recommends

Don't:

• Paste a client's social security number, financial records, or full case narrative into a free, consumer-grade AI tool
• Assume that "incognito mode" or a private browser window protects client data—it doesn't
• Share AI tool login credentials across firm staff without access controls and training

Texas Opinion 705 draws from the Committee's earlier Opinion 680 on cloud computing and recommends that lawyers take "reasonable precautions" including: acquiring a general understanding of how the technology works, reviewing the terms of service, learning about the data-security protections, and training staff on appropriate use.

Duty of Supervision (ABA Model Rule 5.3 / Texas Rule 5.03)

Model Rule 5.3 requires lawyers to supervise non-lawyer assistants and make reasonable efforts to ensure their conduct is compatible with the lawyer's professional obligations. ABA Formal Opinion 512 extends this framework to AI tools—treating them, functionally, as non-lawyer assistants whose output must be reviewed and verified.

For solo and small firms, the supervision duty has two dimensions: supervising staff who use AI tools, and supervising the AI tools themselves. If your paralegal uses ChatGPT to draft a summary of medical records, you—the supervising attorney—are responsible for verifying the accuracy of that summary. If your associate uses AI to generate legal research, you must review every citation.

Do:

• Adopt a written firm AI use policy that specifies which tools are approved, what types of client information may be entered, and what verification steps are required before AI-generated work product is used
• Require all staff to complete AI ethics training before using AI tools in client work
• Implement a review checklist: verify all citations, confirm factual accuracy, check for hallucinated content, and ensure no confidential information was improperly disclosed
• Keep a log of which AI tools were used on which matters, in case you need to demonstrate supervision after the fact

Don't:

• Allow staff to use consumer AI tools for client work without your review and approval
• Delegate substantive legal analysis to an AI tool and rubber-stamp the output
• Assume that because an AI tool is marketed as "legal-specific," its outputs are guaranteed accurate

For a deeper framework on building supervised AI workflows, see our guide on implementing AI in law firms with lawyer-in-the-loop controls.

Duty of Communication and Disclosure (ABA Model Rule 1.4 / Texas Rule 1.03)

Model Rule 1.4 requires lawyers to keep clients reasonably informed about the status of their matters and to explain matters sufficiently to permit informed decision-making. The question every attorney now faces: when must you tell a client you're using generative AI?

ABA Formal Opinion 512 offers guidance on "when, and to what extent, lawyers are required to communicate their use of GAI to clients." The answer depends on the significance of the AI use to the representation. If you use AI to generate a first draft of a routine letter that you then substantially revise, disclosure may not be required. If you use AI to conduct legal research that forms the basis of your advice, or to draft substantive portions of a filing, you should consider informing the client.

Several state bars take a more proactive stance. The Florida Bar's Advisory Opinion 24-1, approved in January 2024, recommends obtaining client consent before using third-party AI tools that involve confidential data. The Pennsylvania/Philadelphia Joint Formal Opinion 2024-200 advises transparency with clients "about the use of AI if it significantly impacts the representation."

Do:

• Add a brief AI use disclosure to your engagement letter—something as simple as: "Our firm may use generative AI tools to assist with certain tasks in your representation. All AI-generated work product is reviewed and verified by a licensed attorney before it is used or filed on your behalf"
• Communicate specifically when AI use could materially affect the client's interests or decision-making
• Document client consent if you plan to input confidential information into an AI tool

Don't:

• Hide your AI use from clients—if they ask, answer honestly
• Use AI to generate communications sent directly to clients without attorney review
• Charge clients for time you spent learning how to use an AI tool (ABA Formal Opinion 512 is explicit on this point)

Texas-Specific Considerations: TRAIGA and the State Bar AI Toolkit

Texas attorneys face an additional compliance dimension. The Texas Responsible AI Governance Act (TRAIGA), House Bill 149, was signed into law on June 22, 2025, and takes effect January 1, 2026. While TRAIGA primarily regulates AI developers and deployers—not attorneys' internal use of AI tools—it matters to Texas lawyers in two ways.

First, if your clients are companies that develop or deploy AI systems in Texas, they may be subject to TRAIGA's disclosure requirements, prohibited-use provisions, and civil penalty structure (ranging from $10,000 per curable violation to $200,000 per uncurable violation). You need to understand the law to advise them competently. We've covered this in detail in our TRAIGA compliance guide for Texas companies.

Second, TRAIGA's safe harbor for entities that "substantially comply" with the NIST AI Risk Management Framework signals that Texas regulators expect AI governance to be structured and documented. While this doesn't directly apply to a solo practitioner using ChatGPT to draft a contract, the regulatory direction is clear: Texas is building an enforcement infrastructure around AI, and attorneys who use AI tools should align with the same risk-management principles.

The State Bar of Texas AI Toolkit provides additional practical resources, including model policies and guidance documents specifically designed for Texas practitioners.

State Bar Guidance Roundup: What Other Jurisdictions Are Saying

Beyond Texas and the ABA, multiple state bars have issued formal opinions or guidance on generative AI in legal practice. Here's a summary of the key ones:

• California (November 2023): The State Bar's Practical Guidance addresses confidentiality, competence, diligence, and billing. It warns against inputting confidential client information into non-secure AI platforms and emphasizes that a lawyer's "professional judgment" remains "the lawyer's responsibility at all times."
• Florida (January 2024): Advisory Opinion 24-1 permits AI use but mandates accuracy verification, confidentiality protection (recommending client consent for third-party AI use with confidential data), and proper billing. It also addresses AI chatbots on attorney websites, requiring compliance with lawyer advertising rules.
• New Jersey (January 2024): The NJ Courts' Preliminary Guidelines clarify that the Rules of Professional Conduct apply fully to AI use, specifically highlighting the duty to verify citations (citing Mata v. Avianca) and prohibiting the generation of false evidence.
• New York (April 2024): The NYSBA Task Force on AI issued an extensive report concluding that while no new ethics rules are immediately needed, existing rules on competence and supervision must be "strictly applied" to AI use.
• D.C. Bar (April 2024): Ethics Opinion 388 emphasizes that lawyers must have a "reasonable understanding" of AI's capabilities and limitations, making the important distinction that generative AI products "are not search engines that accurately report hits on existing data in a constantly updated database."
• North Carolina (late 2024): Formal Ethics Opinion 2024-1 states plainly: "A lawyer may not abrogate her responsibilities under the Rules of Professional Conduct by relying upon AI."

The common thread across all jurisdictions: existing ethics rules apply to AI use. No state has created AI-specific ethics rules—instead, regulators are applying the duty of competence, confidentiality, supervision, and communication to this new technology. The burden is on the lawyer to use AI in a way that satisfies those existing obligations.

Actionable Next Steps

If you haven't already built an AI ethics compliance framework for your practice, here's what we recommend doing in the next 30 days:

1. Adopt a written AI use policy. Specify which AI tools are approved for client work, what data may and may not be entered, and what verification steps are required. The Texas Bar AI Toolkit and the state ethics opinions cited above provide templates and guidance.
2. Audit your AI tools. For each tool you use or plan to use, review the terms of service, data retention policy, and training-data practices. Confirm whether the tool offers an opt-out from model training. If you're using a free or consumer-grade tool for anything beyond general research, stop and upgrade to an enterprise tier with contractual data protections.
3. Update your engagement letter. Add a brief, plain-language disclosure that your firm may use AI tools, that all AI-generated work product is reviewed by a licensed attorney, and that you will seek client consent before inputting confidential information into any third-party AI system.
4. Train everyone. If you have staff, paralegals, or associates, require them to complete AI ethics training before using AI tools in client work. Document the training.
5. Build a verification checklist. Before any AI-generated work product leaves your office, verify: (a) all citations exist and say what the AI claims they say, (b) factual statements are accurate, (c) no client confidential information was improperly disclosed in the AI interaction, and (d) the work product reflects your independent professional judgment, not uncritical reliance on AI output.
6. Stay current. Subscribe to your state bar's ethics opinions feed. The guidance is evolving rapidly—what was acceptable in 2024 may be insufficient by 2026. The duty of technological competence is a continuing obligation.

Generative AI can make solo and small-firm lawyers more efficient, more competitive, and more accessible to clients who need affordable legal services. But the ethics rules don't bend for technology—they apply with full force. The attorneys who will thrive are the ones who build compliance into their AI workflows from day one, not the ones who wait for a disciplinary complaint to force the issue.