AI agents for law firms and legal teams.

Does it change anything if the model runs in our own cloud tenant?

It changes the facts a court would be looking at. It does not give you a ruling, because no court has decided that configuration yet.

The confidentiality ground in Heppner rested on the privacy policy of a publicly available platform, which permitted training on inputs and disclosure to third parties. A deployment where inputs are never used for training, retention is contractually zero, and no third party may read the content takes away the specific fact the court relied on there. It does not touch the court's other two grounds.

Ethics regulators draw a similar line. Florida Bar Ethics Opinion 24-1 states that "confidentiality concerns may be mitigated by use of an inhouse generative AI rather than an outside generative AI where the data is hosted and stored by a third-party," and that if the use of the program "does not involve the disclosure of confidential information to a third-party, a lawyer is not required to obtain a client's informed consent pursuant to Rule 4-1.6."

Be honest about the limit. That is an advisory ethics opinion construing Florida's own rule, not a privilege ruling, and it binds no court. Rakoff also floated, without deciding, that had counsel directed the use, the tool "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent." Architecture improves the argument you would make. It does not settle it.

Do we have to tell clients we are using AI?

There is no single national answer, and pages that give one are wrong somewhere. Bar opinions are advisory, so what binds a firm is the rule its own state adopted.

ABA Formal Opinion 512, issued July 2024, says "the facts of each case will determine whether Model Rule 1.4 requires lawyers to disclose their GAI practices to clients or obtain their informed consent to use a particular GAI tool," and that "depending on the circumstances, client disclosure may be unnecessary." It then names when disclosure is required anyway: if the client asks how the work was done, if the engagement agreement or the client's outside counsel guidelines require it, if the use is relevant to the basis or reasonableness of the fee, or when the output "will influence a significant decision in the representation."

Confidentiality is the harder trigger. For self learning tools, the same opinion says "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool," and that "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient."

States then diverge. Texas Opinion 705, from February 2025, says a lawyer "should consider informing clients about the associated risks and may need to secure client consent," and notes that opinions from the ABA and the Florida Bar "go a step further and suggest that lawyers should obtain informed consent before using these tools." California's 2026 Practical Guidance, which replaced its 2023 version, says a lawyer "must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent." A New York City Bar task force survey of the opinions, dated May 2025, reported that most "conclude that client disclosure is not needed provided the attorney is otherwise complying with the attorney's ethical responsibilities when using generative artificial intelligence," with West Virginia the exception.

Will an agent that searches across all our matters break our ethical walls?

It can, and the risk is named in the guidance rather than hypothetical. The control has to be enforced inside retrieval rather than in a policy document.

ABA Formal Opinion 512 names the failure. A tool may disclose information relating to the representation to persons in the firm "who either are prohibited from access to said information because of an ethical wall" or "who could inadvertently use the information from one client to help another client, not understanding that the lawyer is revealing client confidences."

New York City Bar Formal Opinion 2024-5 closes the obvious escape hatch: "Even with closed systems, a lawyer must take care that confidential information is not improperly shared with other persons at or clients of the same law firm, including persons who are prohibited access to the information because of an ethical wall."

California's 2026 Practical Guidance speaks directly to agents given standing access to firm systems. It notes that such systems "may have persistent or automated access to large volumes of confidential client information, raising acute confidentiality considerations," that "lawyers must carefully evaluate and limit the scope of such access," and that unrestricted or poorly configured agents "may unintentionally disclose confidential information (including across different matters) and even expose privileged material."

In practice that means the wall is checked against the requesting user at query time, on every retrieval, or it is not a wall.

A judge wants us to certify that our AI use did not disclose privileged information. Can we sign that?

Read the qualifier, because it is narrower than it first appears, and whether you can sign it is a judgment for your own counsel on your own facts. Standing Order MC-11, signed by Judge Marcia A. Crone of the Eastern District of Texas, Beaumont Division, on 20 July 2026, applies when a party uses AI to draft or assist in drafting a pleading. The certificate must then disclose the use, certify that the party independently verified the accuracy of any AI drafted or AI assisted portion, and "certify that the use of AI has not resulted in the disclosure of confidential or privileged information to an unauthorized party." On its face that asks who received the data and what your contract permitted, and it does not by its terms bar hosted models.

Other orders reach further into the client relationship. Judge Nina Y. Wang of the District of Colorado requires an AI certification on every filing, effective 1 December 2025, and the sample language her order offers for illustration reads "I/we further certify that [Party] was/were advised of and consented to such use." Filings that do not comply "may be stricken without substantive consideration and with leave to re-file a compliant document."

The trend is not universal. The Fifth Circuit considered a proposed rule and decided not to adopt one, declining "to adopt a special rule regarding the use of artificial intelligence in drafting briefs at this time" and reminding counsel that "'I used AI' will not be an excuse for an otherwise sanctionable offense." Requirements are set judge by judge, so clearing a district's rule is necessary and not sufficient.

Does every lawyer have a duty of technology competence, and does it force us to use AI?

Most US lawyers have a duty to keep abreast of relevant technology, but it sits in a comment rather than in the rule itself, and it does not require you to adopt AI. Comment 8 to ABA Model Rule 1.1 says a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.

The Model Rules are a model. They bind nobody until a state adopts them, so the operative text is always your own state's version. The long running LawSites tracker counts 40 states plus the District of Columbia and Puerto Rico as having adopted that comment, which leaves ten states that have not, and North Carolina adopted modified wording. Check your own jurisdiction before telling partners this is a national duty.

Competence also is not expertise. ABA Formal Opinion 512 says lawyers need not become generative AI experts, only that they must have a reasonable understanding of the capabilities and limitations of the tools they use, and that the required level of competence can ordinarily be reached by self study, by associating with a competent lawyer, or by consulting someone with sufficient expertise. Texas Opinion 705 adds that Rule 1.01 almost certainly does not require the use of generative AI for any particular purpose. Both are ethics opinions, which are advisory rather than binding.

What does reasonable supervision of an AI agent actually look like in practice?

A written policy, trained people, tested outputs, and a human release point before anything leaves the firm. ABA Formal Opinion 512 says managerial lawyers must establish clear policies regarding the firm's permissible use of generative AI, and that supervisory obligations include ensuring subordinate lawyers and nonlawyers are trained in the ethical and practical use of the tools relevant to their work.

It does not mean reviewing everything twice. Opinion 512 gives a worked example: a lawyer who had previously tested a summarizing tool against a manually reviewed subset of documents, and found the summaries accurate, would not necessarily have to manually review the whole set. The hard floor is that lawyers may not leave it to generative AI tools alone to offer legal advice to clients, negotiate clients' claims, or perform other functions that require a lawyer's personal judgment or participation.

California goes furthest on autonomy. The State Bar of California's 2026 Practical Guidance, which replaced the 2023 version and was revised at the California Supreme Court's request to address agentic AI, says lawyers must not deploy agentic systems in a manner that allows the system to make substantive legal determinations, communicate legal advice, prepare and file pleadings, or otherwise act in a representative capacity without meaningful lawyer supervision and review, and that the greater the level of system autonomy, the greater the lawyer's obligation to implement oversight. It also says reasonable efforts to protect client confidences require more than reliance on generalized marketing assurances. That is guidance for California licensees, so read it as a direction of travel rather than a rule that binds your firm.

Do we have to disclose AI use in our court filings?

That depends on the individual judge, not just the district, and mandatory disclosure is still the minority position. The Ropes and Gray AI court order tracker tagged 174 items as requiring disclosure or verification, 451 as suggesting cautious use, and 5 as prohibiting AI, when we read it in September 2026. Those are counts of orders, local rules and decisions across state and federal courts, not counts of judges, so do not convert them into a percentage of the bench, and the tracker keeps growing.

Some courts have declined to impose anything. The Fifth Circuit proposed a certification rule and then decided not to adopt one, reminding parties and counsel that filings must be carefully checked for truthfulness and accuracy as the rules already require, and that saying you used AI will not be an excuse for an otherwise sanctionable offense.

Where orders do exist they differ in detail. Judge Leslie Kobayashi in the District of Hawaii requires disclosure that AI was used and the specific AI tool, plus certification that the filer has checked the accuracy of any AI drafted portion, including all citations and legal authority. Clearing a district rule is necessary, not sufficient. Check the judge before each filing.

Can an AI agent do client intake and run our conflicts check?

Yes for the clerical half, no for the judgment half. An agent can take a web or phone intake, normalise party and entity names, search your document management and accounting systems for prior and adverse parties, and hand a lawyer a ranked conflicts candidate list with the source documents behind every hit. It cannot clear a conflict, and it must not answer the legal question the caller is asking.

Two published constraints shape the build, and both are jurisdiction specific rather than national law. Florida's Opinion 24-1, which carries the Bar's own note that advisory ethics opinions are not binding, says a lawyer must inform prospective clients that they are communicating with an AI program and not with a lawyer or law firm employee, warns that an overly welcoming chatbot can create a prospective client or even a lawyer client relationship without the lawyer's knowledge, and suggests screening questions that limit the chatbot's communications when a person is already represented by another lawyer (Opinion 24-1). The State Bar of California's 2026 practical guidance, revised at the request of the California Supreme Court, names autonomously facilitating client intake as an example of agentic AI and says lawyers must not deploy agentic systems in a manner that allows them to make substantive legal determinations or communicate legal advice without meaningful lawyer supervision and review (COPRAC guidance).

Control gate: a lawyer clears every conflict and signs the engagement. The agent writes to a conflicts queue, never to the prospective client.

Can an agent review contracts against our playbook without a lawyer reading them?

No. It produces a first pass redline and an exceptions list, and a lawyer approves every deviation. In practice the build reads the agreement against your own playbook, marks each clause on standard, off standard or missing, cites the playbook rule it applied, and drafts fallback language for a lawyer to accept or reject.

Three constraints are explicit in the published guidance. ABA Formal Opinion 512, which interprets the Model Rules and binds only through the states that have adopted them, says lawyers may not leave it to generative AI tools alone to offer legal advice to clients, negotiate clients' claims, or perform other functions that require a lawyer's personal judgment or participation (Opinion 512). Florida's advisory Opinion 24-1 says a lawyer should not instruct or encourage a client to rely solely on the work product of generative AI, such as a due diligence report, without the lawyer's own personal review (Opinion 24-1). California's 2026 guidance says a lawyer must not deploy an agentic system in a manner that permits autonomous external transmission of client information without appropriate safeguards and human review, which means the agent does not send the markup (COPRAC guidance).

The failure mode we design around is cross document context. A clause read in isolation, without the amendment that changed it, produces a confident wrong answer.

Control gate: the responsible lawyer signs the redline and every playbook exception.

Can we trust an agent to summarise a deposition or a client call?

For orientation yes, for anything a decision rests on the lawyer reads the source. The risk is omission rather than invention, which is why a summary feels safe when it is not. A summary that is right about everything except the indemnity carve out is worse than no summary.

The New York City Bar addressed this for AI tools that record, transcribe and summarise conversations with clients. Attorneys should independently review any recording, transcript or summary to ensure it accurately reflects the conversation, should not simply rely on work products prepared by AI tools without independently verifying their accuracy, and where the tool has generated a legal analysis or a recommended course of action should independently confirm that the analysis and recommendations are sound (Formal Opinion 2025-6). The same opinion flags what firms miss: these records may be relied on sometimes even years later, and a client later involved in litigation may be able to use the evidence as part of an advice of counsel defense, so retention is a decision to make before deployment rather than after.

ABA Opinion 512 supplies a calibration method rather than a rule, test the tool against a hand reviewed subset first (Opinion 512).

Control gate: the lawyer who will rely on the summary reads the underlying record and signs it.

Can an agent review our prebills and time entries?

It can flag, it cannot rewrite time upward, and the larger point is that using AI changes what you may bill. What follows is ethics guidance interpreting each jurisdiction's own rules, and the ABA Model Rules bind only where a state has adopted them. On hourly work ABA Opinion 512 permits charging for the time actually spent, for example the minutes spent putting the relevant information into the tool and the time spent reviewing the resulting draft for accuracy and completeness, while repeating the older rule that a lawyer may not bill for more hours than were actually expended (Opinion 512). Texas Opinion 705 says it directly, a lawyer may not charge hourly fees for the time that was saved by using the generative AI program (Opinion 705). Florida's Opinion 24-1 adds that use of generative AI does not permit improper billing practices such as double billing (Opinion 24-1). California's 2026 guidance treats subscriptions for general office functionality as overhead to be absorbed in the fee, allows costs incurred specifically for a matter to be billed where the fee agreement discloses it, requires those charges to reasonably reflect the lawyer's actual cost, and prohibits a markup or profit element without the client's informed written consent (COPRAC guidance).

So the agent does mechanical work: flag block billing, missing time, narratives that reveal privileged detail, and entries that breach outside counsel guidelines. Write off decisions and narrative rewrites stay with a person.

Control gate: the billing partner approves every proposed change. The agent writes to a review queue, never to the invoice.

Should we build a custom AI agent or just buy Harvey or CoCounsel?

Buy first when the work lives inside a product's own content and workflow. That is where the commercial tools are hardest to beat, and we will say so rather than quote you a project.

Thomson Reuters describes CoCounsel as an assistant for research, analysis and drafting that reasons from Westlaw content, Practical Law guidance and your organization's own knowledge. Harvey sells purpose built agents for law firms and in house legal teams, with its own document store and shared workspaces. Relativity documents aiR for Review as generative AI and large language models examining extracted document text against your prompt instructions, returning document citations with associated rationale, inside the review platform your litigation team may already license.

If your question is first pass document review, citation checked research, or anything else already sitting in a platform you pay for, start with the product. Nobody can tell you what a build would cost against that before they have seen your systems, and that includes us.

What does running the model in our own cloud actually change for confidentiality?

It changes who holds the data and what the terms permit. It does not make the cloud provider disappear, and it does not settle privilege.

Microsoft states that for models sold by Azure your prompts, completions, embeddings and training data are not available to OpenAI or other model providers and are not used by those providers to improve their models or services, and that data stored for service features sits at rest in the Foundry resource in your own Azure tenant, within your chosen geography, deletable by you at any time. The same page adds a limit worth reading: unless you are approved for modified abuse monitoring, a sample of prompts and completions may be stored and reviewed, including by authorized Microsoft employees. AWS states that because model providers have no access to the model deployment accounts, they do not have access to Amazon Bedrock logs or to customer prompts and completions.

That is a narrower claim than it first sounds. Your own tenant still means a cloud provider holds the data, so the question is which third party and on what terms, not whether there is one. Florida Ethics Opinion 24-1 notes that confidentiality concerns may be mitigated by use of an in house generative AI rather than an outside one where the data is hosted and stored by a third party, and that where use of the program does not involve disclosure of confidential information to a third party, informed consent is not required under Rule 4-1.6. Whether a tenant hosted by a cloud provider counts as in house for that purpose is not spelled out, and Florida states on the face of the opinion that advisory ethics opinions are not binding.

Privilege is less settled still. In United States v. Heppner, No. 1:25-cr-00503-JSR (S.D.N.Y. 2026), the court held that documents a defendant produced by prompting a consumer chatbot on his own initiative were neither privileged nor work product, reasoning in part from the consumer product's published privacy terms. A law firm summary of the split reports that another court, in Warner v. Gilbarco in the Eastern District of Michigan, reached the opposite result on work product for a self represented litigant's chatbot drafts. Neither decision binds any other court, and we found no decision addressing an enterprise deployment inside an organization's own tenant.

Can it connect to Clio, iManage, NetDocuments, SharePoint and Relativity?

Yes, all five publish developer interfaces, and the connector is the easy part.

Clio documents two routes, the Clio Platform for Clio Grow APIs and a separate Clio Manage developer portal. Relativity publishes a REST API for building web, mobile and cross platform applications against its resources. SharePoint, OneDrive, Outlook and Teams are all reachable through a single endpoint, graph.microsoft.com, per Microsoft Graph. iManage and NetDocuments both document administrative and API surfaces of their own.

The time goes elsewhere. It goes on deciding which system is authoritative when three of them hold a version of the same matter, on reconciling client and matter identifiers that were never designed to line up, and on carrying each user's entitlements through every hop. Being able to read a system is not the same as being allowed to read it. Opinion 512 says lawyers should read and understand the terms of use, privacy policy and related contractual terms and policies of any tool they use, to learn who has access to what the lawyer inputs, or consult a colleague or external expert who has read and analyzed those terms. That review belongs at the start of an integration, not after go live.

How do we measure whether the agent actually worked?

Against a sample your own lawyers coded before the agent saw it, and before anyone relies on the output.

Relativity's best practices for aiR for Review describe a method you can copy: have human reviewers code the documents in advance, run the prompt criteria on a saved search of 50 to 100 test documents that contains a diverse range of documents, compare the results to the human coding, look for documents the application coded differently than the humans did and investigate possible reasons, then repeat until the application produces results that reasonably align with the coding decisions for the test documents. ABA Formal Opinion 512 accepts the same logic for verification, saying a lawyer who relies on a tool to review and summarize numerous lengthy contracts would not necessarily have to manually review the entire set if the lawyer had previously tested the tool's accuracy on a smaller subset by manually reviewing those documents, comparing them to the summaries and finding the summaries accurate.

Measure the money separately. Texas Opinion 705 states that a lawyer may not charge hourly fees for the time that was saved by using the generative AI program, so on hourly matters a working agent shrinks the invoice rather than the hour. That is the number partners will ask for, and it is the one nobody can supply for you before your own pilot runs.