What should a law firm's AI policy say? ABA Formal Opinion 512 for employers

Formal Opinion 512 was issued July 29, 2024 by the ABA's Standing Committee on Ethics and Professional Responsibility, and it addresses lawyers' use of generative AI tools.

The duties it works through are ones lawyers already owe: competence, confidentiality, communication, supervision of employees and agents, candor, and reasonable fees.

The NCBE Bar Examiner's summary of the opinion maps those duties to Model Rules 1.1 (competence), 1.4 (communication), 1.5 (fees), 1.6 (confidentiality), 1.9(c), 1.18(b), and 5.1 and 5.3 (supervision).

Two limits frame everything else on this page.

The opinion interprets the Model Rules as they already exist — it does not create new AI rules — and it is ABA guidance that binds no state.

For employers, the operative line is this: managerial lawyers must establish clear policies on the firm's permissible use of generative AI, and supervisory lawyers must make reasonable efforts to ensure that the firm's lawyers and nonlawyers comply with their professional obligations when they use the tools.

That sentence makes a written AI policy part of the supervision picture rather than an optional IT document.

A note on sources, and the limit that matters.

The ABA's website blocked automated access while we researched this page, so two details above — the issuing committee and the rule-by-rule mapping — come from the NCBE Bar Examiner's summary of the opinion rather than the ABA's original text.

The duties the opinion covers, and the positions this page states without naming the Bar Examiner, come from the opinion itself.

Either way, the model rules behind it bind no one until a state adopts them, and state versions differ in places.

Confirm the opinion's text and your state's rules with your state bar's ethics counsel before you write policy language around them.

The opinion's supervision mandate stands on two model rules: Rule 5.1, on supervisory lawyers' responsibilities, and Rule 5.3, on nonlawyer assistants — paralegals, legal assistants and other nonlawyer staff.

Our research summarizes Rule 5.3 as making partners and supervising lawyers responsible for reasonable efforts so that nonlawyer assistants' conduct is compatible with the lawyer's professional obligations — but we could not check that against the ABA's own text, so confirm the wording of your state's adopted version with your state bar.

Applied to AI, the duty does not change shape — it changes subject matter.

Supervisory lawyers must make reasonable efforts to ensure that the lawyers and nonlawyers they oversee comply with their professional obligations when using generative AI tools, which is what the opinion says directly.

What reasonable efforts look like in practice is general employer hygiene rather than something the opinion lists: a written policy everyone has actually seen, an approved-tools list, training before use, and a named lawyer who answers questions.

The opinion requires reasonable efforts; it does not hand over a checklist.

Rule 5.3's duty is not AI-specific — it is the model rule for supervising nonlawyer assistants generally.

Our guide to Rule 5.3 walks through the full duty for nonlawyer staff.

Confidentiality is where the opinion gets most specific.

Its consent rule is narrow: client informed consent is required before information relating to the representation is input into a self-learning generative AI tool of the kind the opinion describes.

Uses that involve no client information — the opinion's own distinction — are treated differently, which is what keeps routine research or drafting help from becoming a consent event.

Consent, on the Bar Examiner's reading of the opinion, also has a quality bar: boilerplate consent buried in an engagement letter is not enough.

The opinion also carries over the diligence law firms apply to outsourcing vendors and applies it to generative AI providers: reference checks and vendor credentials, an understanding of the vendor's security policies and protocols, confidentiality agreements, and the vendor's own conflicts checks.

For your policy, that points to two lists: the tools staff may use without a consent step because no client information goes into them, and the tools and matters that need a consent step first — plus a vendor file for every approved tool.

On hourly matters the opinion's position is direct: a lawyer billing hourly must bill only the time actually spent, even where generative AI made the work faster.

The Bar Examiner's summary adds two edges the opinion draws — no little-or-no-work fees, and no charging a client for the time a lawyer spends learning a tool because of the lawyer's own inexperience.

Reasonable fees remain the umbrella duty covering all of it.

For a firm's policy, the billing section does not need to be long: how timekeepers record AI-assisted time on hourly matters, and who fields a client's questions about AI use and the bill.

The sources this page cites publish no model policy — the opinion states duties, not forms.

The outline below assembles those duties into the skeleton a small firm's AI policy needs.

Each line traces to the opinion as this page describes it; your state's adopted rules control the details.

• Scope. The policy applies to every lawyer and every nonlawyer at the firm — the opinion's supervision duties cover both.
• Approved tools. A list of the generative AI tools staff may use, added only after the vendor diligence the opinion applies to AI providers.
• Client information. Information relating to the representation goes into a self-learning generative AI tool only after the client's informed consent — and, on the Bar Examiner's reading, boilerplate in an engagement letter does not count.
• Billing. On hourly matters, only the time actually spent is billed; AI-assisted speed does not add hours to a bill.
• Training. No one uses a tool before training on its ethical and practical use and its risks.
• Ownership. A named lawyer owns the policy, answers questions, and reviews it on a schedule the firm sets.

Treat the outline as a starting structure, not a compliance sign-off: it organizes the duties an ABA opinion describes, and it is not your state's rule.

Your state bar's ethics counsel is the check before any of it goes into your handbook.

Training sits inside the supervision duty, not alongside it.

The opinion says supervisory obligations include ensuring that subordinate lawyers and nonlawyers are trained on the ethical and practical use of the relevant generative AI tools and their risks.

On content, the topics the opinion suggests are the basics: how the tools work, what they can and cannot do, the ethics issues they raise, and secure data handling, privacy and confidentiality.

For hiring, the practical move is to fold the policy into onboarding: send it with the offer, cover it in week one, and have the new hire acknowledge it alongside the confidentiality and conflicts materials.

Training is part of the supervision duty the opinion describes, so it cannot wait for the next all-hands.

An AI policy is one piece of the employer compliance stack.

The rest of the employer picture — roles, rules, pay and onboarding — is covered in our guide to hiring for your law firm.

Employer information, not legal advice. This page describes an ABA formal opinion and ABA model rules; the versions your state has adopted control. Confirm your firm's policy with your state bar's ethics counsel before you act on it.