The Short Answer
A law firm may bill a client for an AI agent's actual per-matter cost, but not for a cost it cannot attribute: Florida Opinion 24-1 and Oregon Formal Opinion 2025-205 both place unattributable AI charges in the firm's own overhead. An agent that silently retries a task is therefore a fee question before it is an engineering one. On ibl.ai you own all the code and the data, so the run record belongs to the firm.
The usual framing is that untracked agent activity on privileged documents is a discovery problem. True, and already half-covered.
The half nobody is costing out is the invoice. Every opaque retry on a client matter is a line item somebody has to either justify or eat, and the rule deciding which already exists.
Why is an untracked AI agent retry a billing problem for a law firm?
Because the ethics rules make attribution the precondition for charging, and a retry loop you cannot decompose fails that test.
Florida Bar Ethics Opinion 24-1, dated 19 January 2024, states it in one sentence: "If a lawyer is unable to determine the actual cost associated with a particular client's matter, the lawyer may not ethically prorate the periodic charges of the generative AI and instead should account for those charges as overhead."
Oregon then adopted the same rule and hardened the verb.
Formal Opinion No 2025-205 says lawyers unable to determine the actual cost associated with a particular client's matter "may not ethically prorate the periodic charges of a specialized AI, including GAI, and instead must account for those charges as overhead."
Two jurisdictions, one test, and the stricter of the two is the newer one. That direction of travel is the part worth planning against.
Now apply it to an agent. A single matter-level task may fan out into retrieval calls, tool invocations, a failed tool response, two silent retries, and a model switch mid-run.
If the firm's record of that run is an aggregate monthly token total, the firm cannot determine the actual cost associated with that client's matter. Under both opinions the charge is overhead, and the margin on the work quietly moves.
The opposite case is equally real and more interesting. A firm that can attribute the run has a defensible expense, and a reason to ask whether the retries belonged on the client's bill at all.
Can a law firm bill a client for the cost of an AI agent's token use?
Sometimes, and ABA Formal Opinion 512 — issued 29 July 2024 — draws the line more precisely than the summaries of it usually do.
The opinion's own two examples sit at opposite ends. "[W]hen a lawyer uses a GAI tool embedded in or added to the lawyer's word processing software to check grammar in documents the lawyer drafts, the cost of the tool should be considered to be overhead."
But "when a lawyer uses a third-party provider's GAI service to review thousands of voluminous contracts for a particular client and the provider charges the lawyer for using the tool on a per-use basis, it would ordinarily be reasonable for the lawyer to bill the client as an expense for the actual out-of-pocket expense incurred for using that tool."
So per-use AI cost is billable in principle. Opinion 512 attaches two conditions that bear directly on agent design.
First, disclosure comes first: under Rule 1.5(b), "before charging the client for the use of the GAI tools or services, the lawyer must explain the basis for the charge, preferably in writing."
Second, no double-dipping: where a firm runs its own in-house tool, "[t]he lawyer must ensure that the amount charged is not duplicative of other charges to this or other clients."
The D.C. Bar reached the same place in Ethics Opinion 388, April 2024: "If the lawyer intends to bill the client for use of GAI for which there is an out-of-pocket cost to the lawyer, that expected cost is an expense that should be communicated to the client under this rule."
Opinion 512 also forecloses the adjacent temptation. A lawyer "may not charge a client to learn about how to use a GAI tool or service that the lawyer will regularly use for clients," unless the client specifically asked for that tool.
One thing is worth stating plainly rather than dramatising, because the cautionary-tale version of this post would be more fun and less true. We found no published decision in which AI cost pass-through produced a billing sanction or a fee-dispute ruling.
The rules are in place and the enforcement record is empty. That is a window to get the record-keeping right, not evidence the rules are theoretical — the attribution test applies the first time a client's billing partner asks how a line item was computed.
| Authority | Date | What it says about AI cost you cannot attribute |
|---|---|---|
| Florida Bar Op. 24-1 | 19 Jan 2024 | May not prorate periodic charges; should account for them as overhead |
| ABA Formal Op. 512 | 29 Jul 2024 | Per-use third-party cost is "ordinarily" billable; amount must not duplicate other clients' charges |
| D.C. Bar Op. 388 | Apr 2024 | Expected out-of-pocket GAI cost must be communicated to the client |
| Oregon Formal Op. 2025-205 | 2025 | May not prorate; must account for them as overhead |
| California COPRAC Practical Guidance | 2026 edition | Subscription fees for general functionality are overhead; no markup without informed written consent |
What does California's 2026 guidance say about agentic AI in a law firm?
It is the first of these authorities written with agents specifically in view, and it was written on request.
The State Bar of California's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law replaces the November 2023 original and, in its own words, "at the request of the California Supreme Court, addresses the unique challenges presented by the use of agentic AI."
Its definition is operational rather than hand-waving.
Agentic systems "can pursue goals, 'plan,' select tools, and even execute tasks without immediate human intervention," with pleading revisions across multiple iterations and the preparation of discovery responses given as examples.
On cost it is the most explicit of the five. Subscription fees for tools providing "general office functionality, such as drafting assistance, research capabilities, or document review" are overhead, "similar to library maintenance or general computer systems."
Matter-specific charges are different: "per use fees for specialized AI tools or costs for custom AI implementations developed for a particular matter" may be billed — provided the fee agreement discloses it, the charge "reasonably reflect[s] the lawyer's actual cost," and "no markup or profit element may be added without the client's informed written consent."
Note what that trio requires jointly. To satisfy all three a firm has to know the actual cost of a specific run, not a blended rate, and be able to show it.
The guidance also puts a sentence in a footnote that deserves a wider audience: "the duty of competence requires a lawyer to supervise technological agents."
Does an untracked agent action on privileged documents create discovery exposure?
Yes, and the California guidance names the mechanism rather than leaving it as a worry.
Agentic systems "may be configured to access internal firm systems, such as email, messaging platforms, document management systems, knowledge bases, client files, or calendaring systems," with "persistent or automated access to large volumes of confidential client information."
The consequence it draws is specific: "[u]nrestricted or poorly configured agentic systems may unintentionally disclose confidential information (including across different matters) and even expose privileged material."
Cross-matter leakage is the clause to reread. An agent with standing access to a document management system is one retrieval away from grounding a memo for Client A in material belonging to Client B.
What the litigation record adds is who gets to hold the resulting copy. The orders in NYT v. OpenAI reached 20 million de-identified ChatGPT logs, affirmed on 5 January 2026 — a sequence we set out in the law firm AI checklist drawn from that discovery record.
And the liability doctrines that would allocate the consequences are still being stretched, as we examined in AI agents do licensed work and liability law doesn't fit.
Meanwhile the courts are no longer warning.
In Fletcher v. Experian Information Solutions, No. 25-20086, the Fifth Circuit sanctioned counsel $2,500 on 18 February 2026, having determined that counsel used AI to draft a substantial portion of a reply brief.
Its show-cause order enumerated 16 instances of fabricated quotations and 5 further serious misrepresentations of law or fact.
That opinion also records the scale, with its scope stated: as of 18 February 2026 Damien Charlotin's tracker had identified 239 cases of hallucination by lawyers in the United States, a figure the court notes "excludes hallucinations introduced by pro se litigants and judges." The same database, counting every jurisdiction and every actor, listed 2,184 cases when last updated on 10 October 2026.
Can a court hold that AI work product was never privileged in the first place?
One court has, and its reasoning ran partly through the vendor's privacy policy — which is the ownership argument made by a judge rather than by a vendor.
In United States v. Heppner, No. 25-cr-00503-JSR (S.D.N.Y.), Judge Jed S. Rakoff ruled orally on 10 February 2026 and issued a written opinion a week later, on 17 February 2026.
He held that materials a defendant generated through a consumer AI platform were protected by neither attorney-client privilege nor work product.
On privilege, the court found that the tool "was not a lawyer and could not establish an attorney-client relationship," and that the defendant had "no 'reasonable expectation of confidentiality in his communications'" with the platform.
The basis for that second finding is the part a firm should read twice. The platform's privacy policy disclosed that it would collect inputs and outputs, use the data to "train" its model, and disclose data to multiple categories of "third parties," including the government.
On work product, the court found no protection because the materials were "prepared by the defendant on his own volition," not at counsel's direction.
State the limits precisely, because the overread version of this case is doing the rounds.
Heppner had retained counsel but used the platform independently, so the holding is about a party acting outside counsel's direction — not a ruling about a law firm's own supervised tooling.
The opinion says nothing about audit trails or logging, and no court has required an AI audit log. One district ruling is also not a doctrine; this area is unsettled and the next court to reach it may weigh the same facts differently.
What it does establish is that the privilege analysis turns on provenance: who wrote the prompt, at whose direction, for what purpose, and under whose terms of service. That is precisely the set of facts a firm either has in a record or argues about from memory.
What must a law firm be able to reconstruct about an agent run months later?
Enough to answer a fee dispute, a privilege challenge and a sanctions inquiry from one record, because all three arrive late.
- Which matter the run belonged to. Not the user, not the month — the matter number, because that is the unit Florida 24-1 and Oregon 2025-205 ask about.
- Every attempt, including the ones that failed. A retry is a cost event. A record showing only the successful attempt understates the spend and hides the reason for it.
- What was retrieved, with identifiers. The specific documents the output rests on, which is what makes a cross-matter retrieval visible instead of theoretical.
- Which model answered. On a model-agnostic platform the model in use changes, so the trail has to pin the version that produced a given output and the price in force at the time.
- Who reviewed it, and when. California's supervision requirement is satisfied by a recorded act, not by a policy document asserting one.
- At whose direction the run started. Heppner turned work product on whether the material was prepared at counsel's direction, so "a lawyer asked for this, on this matter" is a fact worth recording rather than reconstructing.
A firm holding all six can bill the attributable part, absorb the rest and say which is which. A firm holding a monthly invoice cannot do any of that, and the ethics opinions resolve the ambiguity against charging.
Can a hosted legal AI vendor give a law firm the audit trail it needs?
Often yes, and the honest version of this comparison matters more than the flattering one.
Several hosted legal AI products ship real audit logging, per-user activity records and usage reporting, and some of it is better than a firm's first in-house attempt. The difference is not capability. Claiming a hosted vendor cannot produce an audit trail would be false.
The difference is custody, and it shows up in four questions a procurement committee can actually ask.
Who holds the log — the firm, or the vendor's platform?
Who sets the retention period, and can it be shortened without the firm's agreement?
What happens to the record on vendor exit, acquisition or insolvency? And if a third party subpoenas the vendor, is the firm in the room when scope is argued?
Where the answers all point outward, the firm's ability to reconstruct a run is a contractual right rather than an operational capability, and it expires with the contract.
That is the same custody question we worked through for the telemetry layer in AI agent observability has no standard to buy yet.
There is also a pricing shape that forecloses the billing answer before anyone looks at the logs. A per-seat legal AI subscription charges a flat amount per lawyer per month regardless of use, so it produces no per-matter cost figure by construction.
That is not one pricing option among several for a firm that bills clients.
It is the wrong shape for the obligation: an unattributable periodic charge is exactly what Florida 24-1 and Oregon 2025-205 send to overhead, and headcount-indexed pricing keeps growing whether the agents ran or not.
We did the arithmetic in the AI cost math for law firms.
How does ibl.ai make agent cost and action reconstructable inside a firm?
By making the run record a firm asset rather than a vendor report, and by pricing in the unit the ethics rules ask about.
With ibl.ai you own all the code and the data. The firm self-hosts the entire stack with full source code access under a perpetual license, so the trace store, the retention schedule and the export format are the firm's own.
Pricing is usage-based with no per-seat pricing, which is the shape that yields a per-matter number instead of a headcount multiple.
It is model-agnostic across any LLM and the firm can switch anytime — and an open-weight model can run entirely inside the firm's network, so privileged material never leaves it.
You can deploy anywhere: your own cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity.
Run-level evidence is a platform feature rather than a request: a per-agent audit panel recording who changed what and when, transcripts of what was said and retrieved, per-run costs, and data reports exporting to CSV or JSON for whatever system of record the firm's billing partners already read.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. See how it is configured for firms at ibl.ai/solutions/legal.
ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.
For a firm answering a client's security questionnaire about where privileged material is processed, that is a different answer than a foreign-owned or VC-controlled vendor can give.
The doctrine on agent liability will take years. The attribution question will not: it is already decided in at least three jurisdictions, and it is answered by a record or not at all.
Sources: the proration-and-overhead rule and the 19 January 2024 date from Florida Bar Ethics Opinion 24-1; the mandatory-verb version from Oregon Formal Opinion No 2025-205; the grammar-checker and per-use contract-review examples, the Rule 1.5(b) disclosure requirement, the non-duplication condition and the learning-time prohibition from ABA Formal Opinion 512, issued 29 July 2024; the out-of-pocket communication requirement from D.C. Bar Ethics Opinion 388, April 2024; the agentic-AI definition, the Supreme Court request, the overhead/matter-specific split, the markup-and-informed-consent condition, the cross-matter privilege warning and the technological-agents supervision footnote from the State Bar of California's 2026 Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law; the $2,500 sanction, the 16 fabricated quotations, the AI-drafting determination and the 239-case United States figure from the Fifth Circuit's 18 February 2026 opinion in Fletcher v. Experian Information Solutions, No. 25-20086; the all-jurisdictions total of 2,184 cases as of 10 October 2026 from Damien Charlotin's AI Hallucination Cases database; and the dates, docket number, holdings and quoted reasoning in United States v. Heppner from Gibson Dunn's report of the opinion.
Three things were dropped rather than smoothed over. The 2026 California guidance carries no adoption date on its face, so it is described here only as the 2026 edition replacing the November 2023 original, which is what the document itself states. A reported figure of roughly $145,000 in first-quarter 2026 AI sanctions was dropped because it appears only in secondary commentary with no primary tally behind it. And a circulating claim that "at least 15 federal courts" have adopted the Heppner framework was dropped: the count exists only in commentary, and one district opinion from February 2026 would not support it.