Why most firm AI policies don't hold
A typical law-firm AI policy lists approved tools and tells attorneys not to paste confidential matter into chatbots. That's necessary, but it's enforcement by honor system — and one rushed associate undoes it.
The stronger move is to make the policy structural: define where AI may run such that privileged matter can't leave the firm in the first place. Then the rules are backed by architecture, not just goodwill.
What an AI policy for a law firm should cover
A workable policy addresses, at minimum:
- Confidentiality & privilege — what client information may or may not be processed, and where.
- Permitted vs. prohibited tools — which systems are approved, and an explicit ban on pasting client matter into consumer chatbots.
- Client consent & disclosure — when engagement letters or client notice are required.
- Supervision — that attorneys remain responsible for AI output (verification, no unchecked filings).
- Data handling & retention — where data lives, how long, and who can access it.
- Vendor diligence — what a third-party AI vendor must contractually guarantee.
The ethics backdrop
ABA Model Rule 1.6 requires reasonable efforts to prevent unauthorized disclosure of client information, and the duty of competence now extends to understanding the technology.
"We used a vendor that promised not to look" is a weak answer in a malpractice claim or bar inquiry. A policy that relies on vendor promises inherits the vendor's risk.
The clause that makes the rest enforceable
The single most effective policy provision is about deployment: require that AI handling privileged matter runs on infrastructure the firm controls — on-premise or air-gapped.
With that in place, the confidentiality section stops being a hopeful request. The matter never leaves the firm's boundary, so the question of "did our data get used to train someone's model" is moot.
That's the basis for air-gapped AI for law firms you own: research, contract review, and discovery agents that run on the firm's own infrastructure, built on the Agentic OS, with full code ownership and client data that never leaves.
Where to start
Draft the policy around three questions: what data, which tools, and where does it run. Answer "where" with owned/air-gapped for anything privileged, and the rest of the policy gets easier to write and far easier to enforce.
Pilot one workflow under the policy — internal knowledge search is low-risk — prove the controls on real matters, then widen the approved-use list from there.