ABA Formal Opinion 512 Summary: What a Small Law Firm Must Do

ABA Formal Opinion 512 says a lawyer using generative AI must meet the existing Model Rules: understand the tool well enough to use it competently, protect client confidentiality, tell clients what they need to know, verify output before relying on it, supervise staff and vendors, and charge reasonable fees. It applies existing duties rather than creating new ones.

Issued on 29 July 2024 by the ABA's ethics committee, it interprets the Model Rules; your own jurisdiction's rules decide what binds you. For a small firm, the useful reading is not the opinion's length but its task list. Below, each duty becomes an action with an owner, a frequency and a record. This is a practical summary, not legal advice; read the opinion itself and your bar's guidance before you adopt a policy.

Follow me on Instagram@sagnikteaches

The five duties on one page

A sixth strand runs across all five: meritorious claims and candour towards the tribunal (Rules 3.1, 3.3 and 8.4(c), section D of the opinion). Whatever AI helped to draft, the lawyer who files it answers for it. The opinion lists the problems seen so far: citations to non-existent opinions, inaccurate analysis of authority and misleading arguments. It also notes that some courts now require lawyers to disclose their use of generative AI, so check the standing orders of any court you file in.

Connect on LinkedInSagnik Bhattacharya

Competence: a rule you can run weekly

The opinion does not ask you to master the technology. It asks for a reasonable understanding of what the tool can and cannot do, and for independent verification matched to the task. The opinion says the right amount of review depends on the tool and the task. Its own example: a lawyer who has tested a tool's contract summaries against a smaller set of documents read by hand, and found them accurate, need not re-read every contract in a large set. A tool designed for legal practice or for a narrow task, especially one the lawyer has a track record with, may need less verification. It adds that competence here is not a one-off: lawyers must keep up with the tools' benefits and risks as they change. Whatever the level of review, the lawyer stays fully responsible for the work.

Subscribe on YouTube@sagnikteaches

For a small firm that becomes three practical rules.

1. One approved list. Tools the firm has reviewed and permits, with the permitted uses beside each. Anything else is not for client work.
2. A verification ladder. Illustrative: drafting a client email, partner reads before sending; summarising a document, the lawyer checks against the source for anything relied on; summarising a large set of similar documents, test the tool first on a sample you have read yourself and record the result; legal research, every authority is found and read in a primary source; anything filed, a lawyer verifies every citation, quotation and proposition.
3. Short, recorded training. A 45-minute session on what the tools do, where they fail (invented citations, confident wrong answers, out-of-date law) and the firm's rules. Keep the attendance list.

Owner: the managing partner, with a named fee-earner as tool lead in a bigger firm. Frequency: review the list quarterly, because tools change often.

Confidentiality: self-learning tools and informed consent

The opinion asks lawyers to weigh the risk that client information will be disclosed to, or accessed by, people outside the firm or inside it, and calls that analysis fact-driven: it depends on the client, the matter, the task and the tool. As a baseline, every lawyer should read and understand the terms of use, privacy policy and related contract terms of any tool they use, or consult a colleague or outside expert who has, and may need IT or cybersecurity help to follow them.

It singles out "self-learning" tools, ones that learn from what users enter. Because their output could reveal one client's information to other users, even other lawyers in the same firm, the opinion says the client's informed consent is required before information relating to the representation goes in. Informed consent needs the lawyer's best judgement about why the tool is used, the specific risks, the kinds of information involved and the benefits. The opinion is explicit that merely adding general, boiler-plate provisions to engagement letters is not sufficient. Using such a tool for idea generation, with nothing about the matter entered, needs no consent.

A vendor review a small firm can do in an hour

The questions follow the opinion's own list, drawn from earlier opinions on cloud computing and outsourcing: how the tool is configured to protect confidentiality, whether that obligation is enforceable, whether you will hear of a breach or a demand for your information, its reliability and security, and whether it keeps or claims rights over what you enter.

Owner: the partner responsible for risk or compliance. Record: one dated page per tool, with the terms version you read. OpenAI and Anthropic both state that their business plans (ChatGPT Business and Enterprise, and Claude's commercial plans) do not train on your inputs by default, while their consumer plans may train on chats unless you switch that off in the privacy settings. Terms change, so record the version you read. The note taker tutorial for lawyers applies the same questions to meeting recorders.

Communication: decide once when clients must be told

The opinion does not impose a blanket duty to announce every use of AI: the facts of each case decide, and depending on the circumstances disclosure may be unnecessary. It names the cases where the client must be told: when the client asks how the work was done or whether AI was used; when the engagement agreement or the client's outside counsel guidelines require it; before information relating to the representation goes into a tool that needs consent; when AI use is relevant to the basis or reasonableness of the fee; and when the tool's output will influence a significant decision, such as evaluating likely litigation outcomes or jury selection. Even where nothing requires it, the opinion calls the engagement agreement a logical place to explain how the firm uses AI. A small firm should therefore write down a decision rule rather than improvise.

An illustrative rule: "We tell the client and obtain written consent before client confidential information is entered into any tool that retains or learns from inputs. We tell the client if AI use materially affects the fee, the timescale or the way the matter is staffed. We answer truthfully if asked." Add a sentence on what you do if the client objects.

A sample consent paragraph for an engagement letter, which the firm should adapt with its own counsel:

We may use approved software tools, including generative AI, to help prepare drafts and summaries. Before we enter your confidential information into any such tool, we will explain which tool, why we want to use it, and the main risks, and we will ask for your agreement. You may say no, and that will not affect our service to you. A lawyer reviews all work before it reaches you.

That wording is a starting point only. The engagement letter AI clause tutorial goes further into drafting it. Owner: the partner who signs engagement letters. Record: consent noted on the matter file.

Fees: four billing situations

The fees section says fees and expenses must be reasonable and that hourly billing means actual time. The opinion's own example: a lawyer who spends 15 minutes entering information into a tool to draft a pleading may bill those 15 minutes plus the time spent reviewing the draft for accuracy and completeness, not the hours the job used to take. Before charging for a tool at all, the lawyer must explain the basis of the charge, preferably in writing.

A lawyer may not bill a client for learning a tool they will use regularly. The exception is a client who asks for a specific tool the lawyer does not know, where billing the learning time may be appropriate if it is agreed first. Tool costs that work like equipping the practice, such as an AI grammar checker built into the word processor, are overhead unless disclosed to the client in advance; a per-use charge from an outside provider for, say, reviewing thousands of contracts on one client's matter can ordinarily be billed as an expense at actual cost.

The second row is the one firms tend to avoid. Write a rule for reviewing flat-fee schedules every year, with the partner asking what time the work now needs. Owner: the partner in charge of billing. Record: the annual fee review note. The AI time capture tutorial shows how to log the time honestly.

Supervision: policy, training, vendors

Under Rules 5.1 and 5.3, the opinion says managerial lawyers must establish clear policies on the firm's permissible use of generative AI, and supervisory lawyers must make reasonable efforts to ensure lawyers and non-lawyers comply. Supervision includes training on the ethical and practical use of the tools and their risks; the opinion suggests covering the basics of the technology, the tools' capabilities and limits, the ethics issues and secure data handling. For outside providers it points to the checks used for outsourcing: references and credentials, the vendor's security policies, confidentiality agreements, its conflicts checks, and whether a legal forum is available if the agreement is breached. In a small firm this reduces to one short written policy and one person checking it is followed.

A one-page policy skeleton:

1. Approved tools and permitted uses (list; date reviewed).
2. Never enter: [categories of client information] into any tool not on the list.
3. Verification rule by task (the ladder).
4. Court filings: every authority checked in a primary source by the signing lawyer.
5. Client disclosure and consent rule.
6. Billing rule.
7. Reporting: tell [name] immediately if client information was entered in error or an output was filed unchecked.
8. Training: on joining and yearly; attendance recorded.
9. Review: every three months by [name].

Owner: managing partner for policy; each supervisor for their team. Record: signed acknowledgements and the training log. The ChatGPT legal compliance and ethics checklist is a longer companion.

A six-person family-law firm sets up in a fortnight

Say a family-law firm of two partners, two associates and two assistants wants to use an AI assistant for first drafts of letters and summaries of long documents. The managing partner follows the table above.

1. Day 1 to 2, tool list. The partner picks one business-plan assistant, reads its terms and security pages, fills in the vendor review table and files it. Cost: roughly 90 minutes. The firm decides the assistant may be used for drafting and summarising, not for legal research.
2. Day 3 to 4, policy. The one-page policy is written from the skeleton, with a tight "never enter" list: names with case details, financial account numbers and anything about children.
3. Day 5, consent rule. The firm decides that no client information goes in without written consent, using the paragraph above, adapted by the partner who signs engagement letters.
4. Day 6 to 8, billing. The billing partner confirms hourly matters bill actual time, and lists the three flat-fee products for review.
5. Day 9, training. A 45-minute session with two live examples: a good draft, and an invented citation in a sample research answer. Attendance recorded.
6. Day 10, start. Two associates begin with letters on matters where consent has been given.
7. Day 14, check. The partner reviews five uses and records what was entered, what was verified and what was billed.

Total internal time: about 12 hours of partner time and 3 hours each for the others, illustratively. The outcome is a short file that answers, in order, what a regulator or a client would ask.

Five more situations and how the duties apply

An associate pastes a client email into a free chatbot

Confidentiality and supervision. Treat it as an incident: what went in, which tool, whether it retains inputs. Check whether consent or client notification is required under your rules, and follow your policy's reporting step. The fix is a tool on the approved list, not a lecture.

A research summary cites a case nobody can find

Competence and candour. The rule on filed work says the lawyer verifies every authority. Nothing goes out on the strength of the summary. Record the near miss in the policy review as training material.

A client asks, "Do you use AI on my file?"

Communication. Answer truthfully and specifically: which tool, for what, with what review. A written reply from the partner goes on the file.

The firm wants to use an AI tool that learns from inputs

The opinion says informed consent is required before information relating to the representation goes into a self-learning tool, and that boiler-plate engagement wording will not do. Either get specific, informed consent from each client, or use the tool only for work that involves nothing about the matter, such as generating ideas, which rarely covers much legal work. A firm may reasonably decide that a tool which learns from inputs is not for client matters.

A paralegal uses AI to draft a document the partner signs

Supervision, competence. The partner reviews as they would review any draft, and the policy says what review level applies. The routine letters tutorial sets out sensible review steps for these drafts.

A verification routine for research output, with a sample

The competence duty is easiest to meet with a routine that cannot be skipped. For any AI-assisted legal research, require a source table before anyone relies on the text. Ask the tool for it, then verify it yourself:

For each legal proposition in your answer, list: the proposition, the authority you rely on (name, court, year), and the exact passage that supports it. If you are not certain an authority exists, write NOT VERIFIED. Do not invent citations.

Illustrative output: one row cites a case with a plausible name and year, another is marked NOT VERIFIED. The lawyer finds each authority in a primary source. The plausible-looking one turns out not to exist. The row marked NOT VERIFIED is sound once found in a statute. Two lessons: the tool's confidence tells you nothing, and its own "not verified" flags are worth reading. Whichever way it goes, the table is stored with the matter file as evidence that checking happened.

A second example: a solo estate-planning practice

Say a solo lawyer with one assistant wants AI help with client questionnaires and first drafts of wills and trust summaries. With no partners to divide the owners column, she holds every role, which is exactly why the written record matters: it replaces the second person who would otherwise catch a lapse.

• Competence: one assistant on a business plan, used only for questionnaire summaries and plain-English explanations of documents she has drafted. No legal research with it.
• Confidentiality: clients' health and family details are highly sensitive, so she decides no names or identifiers enter the tool at all. She uses initials and removes dates of birth. She notes the decision and her reasons.
• Communication: a sentence in the engagement terms and a verbal explanation at the first meeting, noted in the file.
• Fees: flat fee for a standard package. She times three matters over a quarter, finds drafting time down by about a third, and decides to keep the fee but add a service, rather than quietly pocket the difference. That is a business decision, and the reasonableness question stays in front of her.
• Supervision: the assistant signs the policy and attends the 45-minute session. She spot-checks one file a month.

The whole setup is two pages and an afternoon. A solo practitioner does not need a committee; she needs a record that shows she thought about each duty.

What to tell a client who asks, with a sample answer

When the question comes, a good answer is short, true and specific. Illustrative wording for an email reply:

Hello [first name],

Thank you for asking. We use one approved AI assistant for first drafts of routine letters and for summarising long documents. We do not enter your confidential information into it without your agreement, and a lawyer reviews everything before it reaches you or anyone else. It does not change who is responsible for your matter, which is [name]. If you would prefer we do not use it on your file, tell us and we will not.

Kind regards,
[your name]

A few checks before sending such a reply: is every sentence true of your actual practice today, not your intended policy; does it match what the engagement terms say; and have you recorded that the client asked and what they were told. A reassuring sentence that is not true is worse than no sentence.

What to read in the opinion itself

This summary follows the opinion's text, which runs to 15 pages: competence, confidentiality, communication, meritorious claims and candour towards the tribunal, supervision, and fees. It is on the ABA website in its list of formal opinions. For anything you act on, read four passages yourself: the confidentiality discussion of self-learning tools and informed consent; the competence discussion of how much verification suits which tool and task; the fees examples, including the 15-minute pleading and the split between overhead and expenses; and the supervision section on outside providers. The opinion also flags rules it does not cover in depth, including advertising, current-client conflicts and duties to former clients. Then read your own bar's AI guidance: the opinion's footnotes cite several bars' opinions, which differ in detail. When your policy cites a rule, cite your jurisdiction's rule number, not the Model Rule.

Misreadings of the opinion

• "It bans AI." It does not. It says existing duties apply.
• "A disclaimer in the engagement letter covers us." Informed consent needs specific information, and the opinion says general, boiler-plate engagement-letter provisions are not sufficient.
• "Legal-specific tools are safe." They may need lighter checks, but the duty to review remains.
• "We can bill the old hours." Hourly time is actual time; flat fees need a reasonableness check.
• "It applies to us exactly." The Model Rules are a template; your bar's rules govern and some have their own AI opinions.

The task list with owners

Start with the first two rows and the policy, which together take a few hours, then add the rest over a month. If you want to see where AI pays off before you commit, what to automate first in a small law firm pairs well with this list, and my AI implementation consultation can help turn it into a policy and a pilot, with your own counsel advising on the rules that bind you.

Opinion 512 questions

Is ABA Formal Opinion 512 binding on my firm?

Not directly. It interprets the ABA Model Rules, which the ABA describes as models for the ethics rules of most jurisdictions. What binds you is your own jurisdiction's rules as adopted, plus any opinion from your own bar. The opinion itself cites several bars' AI opinions, and their details differ, so read yours alongside the ABA text.

Do I have to tell every client I use AI?

Not necessarily. The opinion ties disclosure to the circumstances: informed consent is required before information about the matter goes into a self-learning tool, and clients must be told what they need to make informed decisions. Where AI use is routine and carries little risk, disclosure may not be required. Check your own bar's rules and your engagement terms.

Can I bill clients for time spent using AI?

You can bill for the time you actually spend, including reviewing the output, if the fee is reasonable. You cannot bill for time you did not spend, and the opinion says not to charge clients for learning a tool you will use regularly. On flat fees, a large time saving can make the old fee unreasonable. Read the fees section of the opinion.

Does a legal-specific AI tool need less checking?

It may, but never none. The opinion links the level of review to the tool and the task: a tool built for legal work, or one used for a narrow job with a track record, may need less verification than a general chatbot. Anything filed with a court needs a lawyer's full check of citations and analysis.

Further reads

• AI Implementation Plan for a Small Law Firm: The First 90 Days — A 90-day plan once the policy exists.
• AI Client Intake for Law Firms: Qualify Enquiries Out of Hours — Intake is a common first AI job with its own duties.
• How Small Law Firms Use AI to Answer Client Status Questions — Client communication tasks where AI can help safely.
• AI Marketing for Small Law Firms: Content, Reviews and the Rules — Marketing and review rules that touch AI-written content.
• What an AI Consultant Does for a Law Firm, and What It Costs — What outside help with AI costs a small firm.
• AI Email Triage for Professional Firms: Sort, Summarise, Draft — Email sorting in a professional firm, with confidentiality limits.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024), read in full from the ABA's published PDF via a web.archive.org copy; the ABA's Model Rules of Professional Conduct overview page; OpenAI and Anthropic pages on business-plan data use. This is not legal advice.