On July 29, 2024, the American Bar Association issued Formal Opinion 512, formal guidance on lawyers' use of generative AI tools. It reminds lawyers that existing duties of competence, confidentiality, supervision and reasonable fees apply when they use these tools. A written generative AI policy is how a legal team turns those duties into daily practice.
Without a policy, each person decides alone which tool to trust and what to paste into it. With one, the team agrees on approved uses, protects client information, checks the output and keeps records. It is the backbone of responsible legal AI use. This guide shows how a policy anchors AI governance, what to include and how to keep the policy short enough to follow.
Key takeaways
- A generative AI policy should name approved tools, approved uses and prohibited uses.
- Client confidentiality is the sharpest risk. ABA Opinion 512 says boilerplate consent is not enough.
- The more a task affects a client or a court filing, the more human review it needs.
- Keep records of tools, instructions, versions and testing so that work can be explained later.
- Review the policy on a schedule, because tools and rules change quickly.
Why does a legal team need a generative AI policy?
Because the tools are already in use and the duties already exist. Opinion 512 says lawyers need not become experts in generative AI, but they must reasonably understand a tool's capabilities and limitations. It also warns against relying on output without independent review.
A policy also helps outside the law firm. Clients and courts may ask how AI was used on a matter. A written answer, backed by records, is easier to give than an improvised one.
What should a generative AI policy cover?
Keep the document to a few pages. Seven topics do most of the work.
- Scope and definitions. Say what counts as generative AI and who the policy covers, including contractors and vendors.
- Approved tools and uses. List the tools that have passed review, and the tasks they may perform. Separate low-risk uses, such as drafting an internal outline, from high-risk uses, such as reviewing documents for production.
- Confidentiality and consent. Opinion 512 says lawyers must assess whether others outside the firm could access client information entered into a tool, and that informed consent is generally needed before entering it into self-learning tools. Boilerplate in an engagement letter does not count.
- Human review. State who must check output and how closely. Opinion 512 ties the amount of review to the task: document review needs more checking than brainstorming.
- Vendor due diligence. Ask where data is hosted, who can see it, whether it is used to train a model, how long it is kept and how it is deleted. Record the answers.
- Records and defensibility. Log the tool, version, instructions and testing results for any work that may be challenged. For discovery work, Rule 26(g) still requires a reasonable inquiry by the signing lawyer.
- Billing and training. Opinion 512 says clients should not be charged for work not performed, and lawyers may not bill for time spent on their own inexperience. Train staff before they use a tool, and again when the policy changes.
How can NIST frameworks help shape the policy?
NIST published its AI Risk Management Framework 1.0 on January 26, 2023, and a Generative AI Profile (NIST AI 600-1) on July 26, 2024. The framework groups risk work under four functions: govern, map, measure and manage. Legal teams can borrow that structure without adopting the whole framework:
- Govern: assign an owner for the policy and a path for approving tools.
- Map: list where AI is used and what data it touches.
- Measure: test outputs on samples and record error rates.
- Manage: fix problems, report incidents and retire tools that fail.
How do you apply a generative AI policy to eDiscovery?
Using AI in eDiscovery is where the policy gets tested hardest, because the output can shape what is produced. Three habits help:
- Decide in advance who writes and approves the instructions the tool follows.
- Test on a random sample and keep the results, as described in our comparison of technology-assisted review and generative AI.
- Keep a lawyer responsible for the final call on relevance, privilege and production.
Our article on autonomous AI agents in eDiscovery looks at what changes as tools take on more steps without a person in the loop.
How should the policy stay current?
Set a review date, such as every six months, and name who owns it. Add triggers for an earlier review: a new tool, a new ethics opinion in your state, an error that reached a client or a change in your vendor's terms. Keep a short change log so you can show what the policy said on a given date.
How Gemean helps
Gemean's governance, risk and compliance practice covers audits, monitoring, privacy and information governance, and its eDiscovery practice supports document review, so both can inform a policy. Gemean's PythAI tool is described by Gemean as a private, consultant-managed environment where human validation remains central to consequential decisions. If your team is drafting or updating a policy, get in touch.
FAQs
What is a generative AI policy?
A generative AI policy is a written set of rules for how an organization uses generative AI tools. It covers approved tools and uses, data protection, human review, record keeping, training and updates.
Does ABA Formal Opinion 512 require a written policy?
The opinion applies existing professional duties to generative AI. A written policy is a practical way to meet those duties consistently, and your state bar or court may add its own rules.
Can lawyers put client information into a generative AI tool?
Sometimes, but with care. Opinion 512 says lawyers must evaluate who could access the information, and that informed consent is generally required before entering it into self-learning tools. Boilerplate consent is not enough.
How much human review does AI output need?
It depends on the task. Opinion 512 says the level of independent review varies, and document review calls for more checking than brainstorming. Anything filed with a court or sent to a client deserves careful review by a lawyer.
How often should a generative AI policy be updated?
Review it on a schedule, such as every six months, and sooner when you add a tool, when guidance changes or when an error shows a gap.
Sources
- ABA Formal Opinion 512, Generative Artificial Intelligence Tools (American Bar Association, July 29, 2024), as summarized in The Bar Examiner (National Conference of Bar Examiners, Fall 2024): https://thebarexaminer.ncbex.org/article/fall-2024/generative-artificial-intelligence-tools/
- AI Risk Management Framework, AI RMF 1.0 released January 26, 2023 (National Institute of Standards and Technology): https://www.nist.gov/itl/ai-risk-management-framework
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 (NIST, July 26, 2024): https://doi.org/10.6028/NIST.AI.600-1
- Federal Rules of Civil Procedure, Rule 26(g) (Legal Information Institute, Cornell Law School): https://www.law.cornell.edu/rules/frcp/rule_26
- PythAI for Document Review (Gemean): https://gemean.com/pythai-for-document-review/
- Governance, Risk, and Compliance (Gemean): https://gemean.com/grc-governance-risk-and-compliance/
