The opinions, etc. focus on the use of generative AI to review and draft documents. Common themes across these jurisdictions include the duty of competence (understanding the technology), confidentiality (not entering client secrets into public AI models), and supervision/verification (lawyers must verify all AI outputs for accuracy).

To keep up with the latest in Artificial Intelligence (AI) use and trends in law firms, see our CLE webinars. CLE credit is available in numerous jurisdictions.

_{Originally Published: January 2, 2026             Last updated: July 25, 2026}

Here is the list of state bar associations that have issued specific guidance:

Alaska

• Issuing Body: Alaska Bar Association

• Document: Ethics Opinion 2025-1 (April 2025)

• Summary: Affirms that it is ethically permissible for lawyers to use generative AI to assist clients, provided the lawyer understands to a reasonable degree how the technology works, verifies the outputs to prevent hallucinations, and maintains client confidentiality.

• Link: Alaska Bar Association Ethics Opinion 2025-1

California

• Issuing Body: The State Bar of California

• Document: Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law

• Summary: Initially issued in late 2023, this comprehensive guide addresses duties of confidentiality, competence, and candor. It specifically warns against inputting confidential client information into non-secure AI tools and requires lawyers to review all AI-generated work product. The Bar suggests that, "this Practical Guidance should be read as guiding principles rather than as 'best practices.'" It was unpdated in May 2026 to specifically address "agentic AI" (AI models capable of planning steps and executing tasks autonomously). The update emphasizes that even with autonomous AI, lawyers cannot delegate legal judgment and must manually review any AI-generated filings or decisions.

• Link: California State Bar Practical Guidance (May 2026); California State Bar Practical Guidance (2023 superceded)

District of Columbia

• Issuing Body: D.C. Bar Legal Ethics Committee

• Document: Ethics Opinion 388: Ethics Issues in the Use of Generative Artificial Intelligence

• Summary: Released in April 2024, this opinion emphasizes that lawyers must have a "reasonable understanding" of the technology's capabilities and limitations (specifically hallucinations) and must protect client confidences when using generative AI tools. The opinion make sthe important distinction that, "Lawyers should understand that GAI [generative AI] products are not search engines that accurately report hits on existing data in a constantly updated database. The information available to a GAI product is confined to the dataset on which the GAI has been trained."

• Link: D.C. Bar Ethics Opinion 388

Florida

• Issuing Body: The Florida Bar Board of Governors

• Document: Advisory Opinion 24-1

• Summary: Approved in January 2024, this opinion permits the use of generative AI but mandates that lawyers verify the accuracy of the work product, ensure confidentiality (recommending client consent for third-party AI use involving confidential data), and avoid improper billing practices (e.g., double-billing). The opinion also addresses the use of AI chatbots on attorney websites, advising that, "generative AI chatbots that communicate with clients or third parties must comply with restrictions on lawyer advertising..."

• Link: Florida Bar Advisory Opinion 24-1

Illinois

• Issuing Body: Attorney Registration and Disciplinary Commission (ARDC) of the Supreme Court of Illinois

• Document: The Illinois Attorney’s Guide to Implementing AI

• Summary: Released in late 2025, this guide serves as a practical resource for implementing AI in alignment with ethical duties, including flowcharts and checklists for vetting AI tools.

• Link: ARDC Illinois Attorney's Guide 

Kentucky

• Issuing Body: Kentucky Bar Association

• Document: Ethics Opinion KBA E-457

• Summary: Issued in March 2024, this opinion provides a FAQ-style guide on competence, confidentiality, and billing. It reinforces the lawyer's duty to review the AI output for accuracy and clarifies that lawyers cannot bill for the time spent learning how to use AI, only for the actual benefit provided to the client.

• Link: Kentucky Bar Association Ethics Opinions

Michigan

• Issuing Body: State Bar of Michigan Standing Committee on Judicial Ethics

• Document: Ethics Opinion JI-155

• Summary: While primarily focused on judicial officers, this opinion (October 2023) establishes that judges and lawyers must maintain competence with advancing technology, including AI, to ensure fair and accurate legal proceedings.

• Link: State Bar of Michigan Opinion JI-155

Mississippi

• Issuing Body: Mississippi Bar

• Document: Ethics Opinion 267 (November 2024)

• Summary: Outlines how attorneys can use AI tools ethically, placing a specific focus on navigating confidentiality risks, managing honest billing practices (billing for actual time spent rather than time saved), and client disclosure.

• Link: Mississippi Bar Ethics Opinion No. 267

New Jersey

• Issuing Body: New Jersey Courts / Supreme Court of New Jersey

• Document: Notice to the Bar: Preliminary Guidelines on the Use of Artificial Intelligence by New Jersey Lawyers

• Summary: Released in January 2024, this notice clarifies that the Rules of Professional Conduct apply to AI. It specifically highlights the duty to verify citations (citing the Mata v. Avianca case) and the prohibition against generating false evidence.

• Link: NJ Courts Preliminary Guidelines (PDF)

New Mexico

• Issuing Body: State Bar of New Mexico

• Document: Formal Ethics Opinion 2024-004 (September 2024)

• Summary: Addresses the ethical duties mapped to AI use, focusing on competence, safeguarding data against third-party self-learning models, and the prohibition against submitting unverified AI output to tribunals.

• Link: State Bar of New Mexico Formal Opinion 2024-004

New York

• Issuing Body: New York State Bar Association (NYSBA)

• Document: Report and Recommendations of the NYSBA Task Force on Artificial Intelligence

• Summary: An extensive report (April 2024) detailing the impact of AI on the legal profession, offering regulatory guidelines, and suggesting that while no new ethics rules are immediately needed, existing rules (competence, supervision) must be strictly applied.

• Link: Formerly at NYSBA Task Force Report; not currently available online

• Issuing Body: New York City Bar Association (NYCBA)

• Document 1: Formal Opinion 2024-5 (August 2024)

  • Summary: General guidance on the ethical use of generative AI, noting that routine embedded AI tools (like those in standard legal research software) may not require client disclosure.

  • Link: Formal Opinion 2024-5: Generative AI in the Practice of Law

• Document 2: Formal Opinion 2025-6 (December 2025)

  • Summary: Focuses specifically on the use of AI to record, transcribe, and summarize conversations with clients. It stresses that attorneys should obtain informed consent before using AI meeting assistants (like Copilot or Zoom AI), evaluate the privilege/confidentiality risks of the vendor's data retention policies, and independently review AI-generated transcripts for accuracy.

  • Link: Formal Opinion 2025-6: Ethical Issues Affecting Use of AI to Record, Transcribe, and Summarize Conversations with Clients

North Carolina

• Issuing Body: North Carolina State Bar Council

• Document: Formal Ethics Opinion 2024-1

• Summary: Adopted in late 2024, this opinion focuses on the "competency" requirement, stating that a lawyer must understand the risks of "hallucinations" and data privacy before utilizing AI tools in practice, stating plainly, "A lawyer may not abrogate her responsibilities under the Rules of Professional Conduct by relying upon AI."

• Link: NC State Bar 2024 FEO 1

Oregon

• Issuing Body: Oregon State Bar

• Document: Formal Opinion No. 2025-205 (February 2025)

• Summary: Concludes that Oregon lawyers may use generative AI tools if they take reasonable steps to become competent in the technology. It imposes ongoing obligations to supervise the technology (treating it similarly to a non-lawyer assistant), securely store information to prevent privilege waivers, and consult with clients before using AI if the representation requires it.

• Link: Oregon State Bar Formal Opinion No. 2025-205

Pennsylvania

• Issuing Body: Pennsylvania Bar Association & Philadelphia Bar Association

• Document: Joint Formal Opinion 2024-200

• Summary: This joint opinion outlines best practices, emphasizing that lawyers "must verify all citations and legal analysis" generated by AI and must be transparent with clients about the use of AI if it significantly impacts the representation. It advises lawyers that, "[i]n particular, the use of AI applies to the lawyer’s duties of (1) confidentiality, (2) competence, (3)
  candor, (4) truthfulness, (5) supervision, (6) communication, (7) conflicts of interest, and (8) the unauthorized practice of law..." 

• Link: PBA Joint Formal Opinion 2024-200

Texas

• Issuing Body: State Bar of Texas Professional Ethics Committee

• Document: Opinion 705

• Summary: (Addressed in early 2025) This opinion confirms that while attorneys may use AI, they are ultimately responsible for the work product. It specifically warns against "unthinking reliance" on AI outputs and mandates rigorous verification of case law. In conclusion, it advises that, "lawyers should acquire basic technological competence before using any generative AI tool, should always ensure that the tool does not imperil confidential client information, should always verify the accuracy of any responses received from a generative AI tool, and should not charge clients for the time “saved” by using a generative AI program."

• Link: Texas Opinion 705

Virginia

• Issuing Body: Supreme Court of Virginia / Virginia State Bar

• Document: Legal Ethics Opinion 1901 (November 2025)

• Summary: Clarifies the rules around reasonable fees and generative AI. It states that lawyers are not ethically obligated to reduce a flat fee simply because they completed the work more efficiently using AI. It reinforces a value-based billing approach, so long as the overall fee remains reasonable under the factors of Rule 1.5.

• Link: Virginia State Bar Legal Ethics Opinion 1901

West Virginia

• Issuing Body: Lawyer Disciplinary Board of West Virginia

• Document: Legal Ethics Opinion 24-01 (June 2024)

• Summary: Emphasizes that AI must "supplement, not replace" legal reasoning. Notably, it takes a strict stance on communication, advising that lawyers should consult with clients prior to using artificial intelligence tools during representation and obtain the client's consent for use in writing.

• Link: Lawyer Disciplinary Board of West Virginia Legal Ethics Opinion 24-01

American Bar Association (ABA)

While not a state bar, the ABA's guidance is cited by many states as a baseline.

• Document: ABA Formal Opinion 512 (July 2024)

• Summary: "Lawyers using GAI tools have a duty of competence, including maintaining relevant technological competence, which requires an understanding of the evolving nature of GAI. In using GAI tools, lawyers also have other relevant ethical duties, such as those relating to confidentiality, communication with a client, meritorious claims and contentions, candor toward the tribunal, supervisory responsibilities regarding others in the law office using the technology and those outside the law office providing GAI services, and charging reasonable fees. With the ever-evolving use of technology by lawyers and courts, lawyers must be vigilant in complying with the Rules of Professional Conduct to ensure that lawyers are adhering to their ethical responsibilities and that clients are protected. 

• Link: ABA Formal Opinion 512

The post Ethics Opinions Covering Lawyers’ Use of Generative AI (Artificial Intelligence) appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Currently, state bar associations possess the primary authority to investigate and discipline the lawyers they license, including even those who work for the federal government who are licensed to practice in their respective jurisdictions. However, the DOJ’s new proposal, published in the Federal Register, seeks to grant the department the authority to intercept and review these ethics complaints "in the first instance," effectively asking state bars to stand down while the DOJ conducts its own review.

This policy proposal has sparked a debate about federalism, professional accountability, and the protections required for federal attorneys to execute their duties. Here is a breakdown of the proposed rule, the rationale behind it, and the arguments from both sides of the aisle.

The Mechanics of the Proposed Rule

At its core, the proposed regulation aims to give the Justice Department priority in reviewing ethics allegations against its current and former attorneys. If finalized, the rule establishes a new protocol for whenever a third party files a grievance with a state bar, or whenever a state disciplinary authority independently initiates an investigation into a DOJ lawyer.

Key mechanisms of the proposal include:

• Right of First Review: The Attorney General or a designated official would be granted the explicit right to review the complaint and the underlying allegations before the state bar proceeds.
• Suspension of State Proceedings: The DOJ would officially notify the applicable state bar of its intent to review the matter and request that the state authority suspend any parallel investigations or procedural steps that require the involvement of the DOJ attorney.
• Enforcement Action: In a clause that has drawn significant attention, the proposed rule stipulates that should a state disciplinary authority refuse the Attorney General's request to pause its probe, the DOJ "shall take appropriate action" to prevent the state bar from interfering with the internal federal review. What constitutes “appropriate action” remains undefined.

The DOJ’s Stated Rationale: Preventing "Weaponization"

The Justice Department contends that this regulatory shift is a necessary protective measure for its workforce. The primary argument hinges on the assertion that the state bar complaint process has become increasingly politicized.

According to the notice of proposed rulemaking, the DOJ argues that there has been an "unprecedented weaponization" of ethics complaints by political activists and watchdog groups. The department asserts that this dynamic creates a hostile environment for career and appointed federal attorneys, threatening to chill the "zealous advocacy" they are expected to provide on behalf of the United States, its agencies, and the executive branch.

From the DOJ's perspective, forcing federal lawyers to constantly defend their law licenses against state-level complaints based on their official government work undermines the Attorney General's broad statutory authority to manage and supervise the department. By conducting an internal review first, the DOJ aims to filter out frivolous or politically motivated grievances, ensuring that attorneys can perform their duties without the looming threat of unwarranted professional ruin.

Pushback from the Legal Community

The proposed rule has been met opposition from various corners of the legal community, including legal scholars, non-partisan watchdogs, and state bar associations. Critics argue that the proposal fundamentally misunderstands the role of state bars and threatens to erode essential accountability mechanisms.

The primary concerns raised by opponents include:

• Evading Independent Oversight: Critics of the proposed rule, such as the New York State Bar Association and groups like Lawyers Defending American Democracy (see the Bloomberg article), argue that subverting state bar authorities would effectively exempt an entire class of lawyers from independent disciplinary processes. They also point out that the DOJ department responsible for investigating such complaints has already suffered "significant attrition" and fear the DOJ could use its internal review to indefinitely stall investigations, protecting its attorneys from legitimate scrutiny.
• Federalism and Legal Precedent: All U.S. attorneys must be licensed by a state bar to practice law. Opponents point to long-standing federal statutes, such as the McDade Amendment, which explicitly require federal government attorneys to be subject to the same state ethical rules and disciplinary mechanisms as any other attorney practicing in that state.
• Context of Recent Complaints: The backlash is also contextualized by recent events. In the months leading up to this proposal, several high-profile ethics complaints were filed against DOJ leadership, including Attorney General Bondi and Deputy Attorney General Todd Blanche, regarding their management of the department. Some critics view this proposed rule as a direct response to those specific state bar complaints.

What Happens Next?

As with all proposed federal regulations, the rule is currently subject to a 30-day public comment period (ending April 6, 2026). During this time, legal professionals, state regulators, and the general public can submit their feedback, which the DOJ must review before issuing a final rule.

If the regulation is finalized in its current form, it is widely expected to face immediate legal challenges in federal court. State bar associations and legal advocacy groups will likely seek injunctions, arguing that the DOJ is overstepping its executive authority and violating established federal laws regarding attorney licensure and discipline.

Conclusion

The proposed shift in how ethics complaints against DOJ attorneys are handled represents a critical flashpoint in the intersection of legal ethics and federal authority. Whether viewed as a necessary defense against political weaponization or an alarming attempt to evade independent oversight, the outcome of this rulemaking process will have lasting implications for the legal profession and the Department of Justice.

If you wish to provide comments regarding this rulemaking, you must submit comments, identified by the agency name, via the Federal eRulemaking Portal:  https://www.regulations.gov.

All submissions received must include the agency name and Docket No. OAG199. Paper comments that duplicate an electronic submission are unnecessary. All comments received may be posted without change to https://www.regulations.gov, including any personal information provided.

The post Navigating the DOJ’s Proposed Rule on Attorney Ethics Complaints: Who Watches the Watchmen? appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

The opinions, etc. focus on the use of generative AI to review and draft documents. Common themes across these jurisdictions include the duty of competence (understanding the technology), confidentiality (not entering client secrets into public AI models), and supervision/verification (lawyers must verify all AI outputs for accuracy).

Here is the list of state bar associations that have issued specific guidance:

California

• Issuing Body: The State Bar of California

• Document: Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law

• Summary: Issued in late 2023, this comprehensive guide addresses duties of confidentiality, competence, and candor. It specifically warns against inputting confidential client information into non-secure AI tools and requires lawyers to review all AI-generated work product. The Bar suggests that, "this Practical Guidance should be read as guiding principles rather than as 'best practices.'"

• Link: California State Bar Practical Guidance

District of Columbia

• Issuing Body: D.C. Bar Legal Ethics Committee

• Document: Ethics Opinion 388: Ethics Issues in the Use of Generative Artificial Intelligence

• Summary: Released in April 2024, this opinion emphasizes that lawyers must have a "reasonable understanding" of the technology's capabilities and limitations (specifically hallucinations) and must protect client confidences when using generative AI tools. The opinion make sthe important distinction that, "Lawyers should understand that GAI [generative AI] products are not search engines that accurately report hits on existing data in a constantly updated database. The information available to a GAI product is confined to the dataset on which the GAI has been trained."

• Link: D.C. Bar Ethics Opinion 388

Florida

• Issuing Body: The Florida Bar Board of Governors

• Document: Advisory Opinion 24-1

• Summary: Approved in January 2024, this opinion permits the use of generative AI but mandates that lawyers verify the accuracy of the work product, ensure confidentiality (recommending client consent for third-party AI use involving confidential data), and avoid improper billing practices (e.g., double-billing). The opinion also addresses the use of AI chatbots on attorney websites, advising that, "generative AI chatbots that communicate with clients or third parties must comply with restrictions on lawyer advertising..."

• Link: Florida Bar Advisory Opinion 24-1

Illinois

• Issuing Body: Attorney Registration and Disciplinary Commission (ARDC) of the Supreme Court of Illinois

• Document: The Illinois Attorney’s Guide to Implementing AI

• Summary: Released in late 2025, this guide serves as a practical resource for implementing AI in alignment with ethical duties, including flowcharts and checklists for vetting AI tools.

• Link: ARDC Illinois Attorney's Guide 

Kentucky

• Issuing Body: Kentucky Bar Association

• Document: Ethics Opinion KBA E-457

• Summary: Issued in March 2024, this opinion provides a FAQ-style guide on competence, confidentiality, and billing. It reinforces the lawyer's duty to review the AI output for accuracy and clarifies that lawyers cannot bill for the time spent learning how to use AI, only for the actual benefit provided to the client.

• Link: Kentucky Bar Association Ethics Opinions

Michigan

• Issuing Body: State Bar of Michigan Standing Committee on Judicial Ethics

• Document: Ethics Opinion JI-155

• Summary: While primarily focused on judicial officers, this opinion (October 2023) establishes that judges and lawyers must maintain competence with advancing technology, including AI, to ensure fair and accurate legal proceedings.

• Link: State Bar of Michigan Opinion JI-155

New Jersey

• Issuing Body: New Jersey Courts / Supreme Court of New Jersey

• Document: Notice to the Bar: Preliminary Guidelines on the Use of Artificial Intelligence by New Jersey Lawyers

• Summary: Released in January 2024, this notice clarifies that the Rules of Professional Conduct apply to AI. It specifically highlights the duty to verify citations (citing the Mata v. Avianca case) and the prohibition against generating false evidence.

• Link: NJ Courts Preliminary Guidelines (PDF)

New York

• Issuing Body: New York State Bar Association (NYSBA)

• Document: Report and Recommendations of the NYSBA Task Force on Artificial Intelligence

• Summary: An extensive report (April 2024) detailing the impact of AI on the legal profession, offering regulatory guidelines, and suggesting that while no new ethics rules are immediately needed, existing rules (competence, supervision) must be strictly applied.

• Link: Formerly at NYSBA Task Force Report; not currently available online

North Carolina

• Issuing Body: North Carolina State Bar Council

• Document: Formal Ethics Opinion 2024-1

• Summary: Adopted in late 2024, this opinion focuses on the "competency" requirement, stating that a lawyer must understand the risks of "hallucinations" and data privacy before utilizing AI tools in practice, stating plainly, "A lawyer may not abrogate her responsibilities under the Rules of Professional Conduct by relying upon AI."

• Link: NC State Bar 2024 FEO 1

Pennsylvania

• Issuing Body: Pennsylvania Bar Association & Philadelphia Bar Association

• Document: Joint Formal Opinion 2024-200

• Summary: This joint opinion outlines best practices, emphasizing that lawyers "must verify all citations and legal analysis" generated by AI and must be transparent with clients about the use of AI if it significantly impacts the representation. It advises lawyers that, "[i]n particular, the use of AI applies to the lawyer’s duties of (1) confidentiality, (2) competence, (3)
  candor, (4) truthfulness, (5) supervision, (6) communication, (7) conflicts of interest, and (8) the unauthorized practice of law..." 

• Link: PBA Joint Formal Opinion 2024-200

Texas

• Issuing Body: State Bar of Texas Professional Ethics Committee

• Document: Opinion 705

• Summary: (Addressed in early 2025) This opinion confirms that while attorneys may use AI, they are ultimately responsible for the work product. It specifically warns against "unthinking reliance" on AI outputs and mandates rigorous verification of case law. In conclusion, it advises that, "lawyers should acquire basic technological competence before using any generative AI tool, should always ensure that the tool does not imperil confidential client information, should always verify the accuracy of any responses received from a generative AI tool, and should not charge clients for the time “saved” by using a generative AI program."

• Link: Texas Opinion 705

American Bar Association (ABA)

While not a state bar, the ABA's guidance is cited by many states as a baseline.

• Document: ABA Formal Opinion 512 (July 2024)

• Summary: "Lawyers using GAI tools have a duty of competence, including maintaining relevant technological competence, which requires an understanding of the evolving nature of GAI. In using GAI tools, lawyers also have other relevant ethical duties, such as those relating to confidentiality, communication with a client, meritorious claims and contentions, candor toward the tribunal, supervisory responsibilities regarding others in the law office using the technology and those outside the law office providing GAI services, and charging reasonable fees. With the ever-evolving use of technology by lawyers and courts, lawyers must be vigilant in complying with the Rules of Professional Conduct to ensure that lawyers are adhering to their ethical responsibilities and that clients are protected. 

• Link: ABA Formal Opinion 512

The post Ethics Opinions Covering Lawyers’ Use of Generative AI (Artificial Intelligence) appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Artificial Intelligence (AI) is no longer a futuristic concept; it is an active partner in the practice of law, promising efficiencies from legal research to document drafting.

However, the rapid adoption of AI in the practice of law is not without significant risk. For every efficiency gained, there is a potential pitfall that could jeopardize client trust, breach ethical duties, and expose the firm to malpractice liability or severe court sanctions. The excitement around AI must be tempered with vigilance and a clear-eyed understanding of the professional responsibility rules that govern the legal profession.

We must recognize that AI tools are just that - tools; they are not lawyers. The buck, ultimately, stops with the supervising attorney and the firm itself.

Here are the top five high-stakes pitfalls that US-based law firms must actively address when their lawyers utilize AI in the practice of law.

1. The Catastrophic "Hallucination" and the Failure of Competence

The most public and immediate threat posed by generative AI is its propensity for "hallucination," where the AI tool fabricates plausible but entirely nonexistent legal authorities, statutes, or facts. The consequences of submitting a brief to a court that relies on fake case law are severe, leading to judicial sanctions, fines, public reprimand, and a catastrophic loss of professional credibility.

This pitfall strikes at the core of ABA Model Rule 1.1: Competence. A lawyer who fails to verify the accuracy of AI-generated content - especially citations and legal analysis - is failing to provide "thoroughness and preparation reasonably necessary for the representation." In the eyes of the court, ignorance is no excuse; the lawyer remains responsible for every assertion made. Firms must understand that AI's confidence in its output is wholly uncorrelated with its accuracy. Attorneys cannot be lazy about these citations just because they are generated by AI. Now more than ever, what you learned in your first-year Legal Research and Writing class is true. "Cite-checking is important."

2. Breaching Client Confidentiality and Privilege

Law firms are custodians of their clients' most sensitive data. The unauthorized disclosure of confidential information is a fundamental breach of trust and a violation of ABA Model Rule 1.6: Confidentiality of Information.

The AI pitfall here lies in the input. Many popular, general-purpose AI tools (especially those publicly available) may use the data input by a user to train their underlying models. If a lawyer inputs confidential client documents, trade secrets, or litigation strategy into such a tool without ensuring the vendor has robust, legally-vetted privacy protocols, that information could inadvertently become part of the publicly accessible training data for the model. This is an unauthorized disclosure that could waive attorney-client privilege and subject the firm to immense liability and client flight.

3. Algorithmic Bias Leading to Discriminatory Outcomes

AI systems are trained on vast datasets, and if that data reflects historical or societal biases (for instance, in criminal justice records, demographic information, or financial data), the resulting AI output will perpetuate and even amplify those biases.

This pitfall is insidious because the discrimination is hidden behind a seemingly neutral "algorithm," violating a lawyer's obligations regarding fairness and non-discrimination. If a firm uses AI for tasks like predictive policing analysis, e-discovery prioritization, or even internal hiring and promotion decisions, and the tool produces biased results, the firm risks legal challenges under Title VII or other anti-discrimination laws. Worse, it erodes the public's trust in the integrity of the justice system itself. The firm could be seen as outsourcing its ethical responsibility to a "black box" technology.

4. The Erosion of Independent Professional Judgment

A major risk is the over-reliance on AI, where lawyers treat the technology not as a research assistant, but as a definitive authority. This creates an erosion of independent professional judgment, a key element of competent lawyering.

AI is designed to find patterns in data, but it struggles with legal nuance, jurisdictional subtleties, and the human element necessary for effective client strategy. If a junior attorney relies solely on AI for a complex contract clause or a novel legal theory, they may miss critical context, fail to exercise skepticism, and ultimately provide substandard advice. This over-dependence diminishes the value of the human lawyer and potentially increases the firm's exposure to malpractice claims. Firms are hired for their judgment and advice, not their ability to parrot a chatbot.

5. Failure of Supervisory and Training Duties

The adoption of AI necessitates firms to rethink how they approach supervising lawyers and staff, and reviewing their work product. This is especially important in light of ABA Model Rules 5.1 and 5.3 (Responsibilities of Partners, Supervisory Lawyers, and Nonlawyer Assistants).

The final pitfall is the failure of firm leadership to establish and enforce clear, mandatory policies for AI use. Leaving AI implementation to individual attorneys invites chaos. If a partner fails to adequately supervise a junior associate who is using an unauthorized, non-secure AI tool to draft a motion, the partner and the firm can be held professionally responsible for any resulting ethical breach or legal error. This liability extends to non-lawyer staff who may be using AI for administrative or document review tasks without understanding the confidentiality risks.

Solutions: How to Safeguard Your Firm

Avoiding these pitfalls requires a proactive, mandatory, and governance-first approach. Firms are wise to embrace AI, but must do so safely and ethically.

1. Mandate Human Verification and Oversight

• The "Zero Tolerance" Rule for Hallucinations: Enforce a mandatory, documented human review of all AI-generated citations, case law, and factual assertions before submission to a client or court. Treat AI output as a first draft from a highly capable (but fundamentally unreliable) individual.

2. Implement a Vetted-Only AI Policy

• Restrict Tool Usage: Create a firm-approved list of AI tools. This list should exclude all general-purpose AI platforms unless the firm has a dedicated enterprise license that contractually guarantees no client data is used for model training.

• The Confidentiality Triage: Lawyers must be trained to never input confidential, privileged, or personally identifiable client information into an unvetted AI system.

3. Prioritize Technological Competence Training

• CLE Requirements: Make ongoing, mandatory CLE on the benefits, risks, and ethical obligations of AI a requirement for every attorney and relevant staff member. Training must cover how to spot hallucinations and recognize algorithmic bias.

• CLEwebinars.com offers a variety of Continuing Legal Education webinars that cover the opics of law firm implementation of Artificial Intelligence and ways to avoid the kinds of pitfalls discussed here.

4. Establish Clear Supervisory Protocols

• AI Checklist: Incorporate AI usage into existing supervision workflows. Create a checklist for the "Verification of AI Input/Output". Require supervising attorneys to review this "Verification of AI Input/Output" checklist for any work product generated or assisted by AI. This can help ensure accountability under Model Rules 5.1 and 5.3.

5. Open Client Communication

• Informed Consent: Be transparent. If the firm plans to use AI in a material way that involves client data, the firm should consider obtaining informed consent from the client, explaining the benefits and, more importantly, the steps taken to mitigate the risks to confidentiality. This does also give the client the opportunity to opt-out of having AI employed for their matters. Be prepared.

By integrating robust policies, mandatory training, and diligent human oversight, firms can responsibly harness the power of AI while ensuring that the firm’s ethical obligations and commitment to excellence remain uncompromised.

The post Navigating the AI Frontier: Five Pitfalls US Law Firms Must Avoid appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

The Case of Mr. B.

In a groundbreaking case that is likely to have far-reaching implications for the legal profession, an Australian solicitor, Mr. B., is facing disciplinary action for filing fake case citations that were generated by artificial intelligence (AI). This increasingly common incident has raised serious questions about the ethical use of AI in legal practice and the potential consequences of relying on AI-generated content without proper verification.

The Allegations

According to the allegations, Mr. B. submitted court documents containing citations to non-existent cases. Upon closer examination, it was discovered that these citations were not merely incorrect, but were entirely fabricated by a sophisticated AI language model capable of producing human-quality text. It has been reported that Mr. B. used the UK-based generative AI tool LawY to create the document. 

Ethical Implications

The case of Mr. B. has sparked intense debate within the legal community about the ethical implications of using AI in legal practice. While AI can be a valuable tool for tasks such as legal research and document drafting, it is essential that lawyers exercise caution and ensure that AI-generated content is used responsibly. This, however, does not free a lawyer from their obligation to read, understand, and check the cites thay are including the documents they file.

One of the key concerns raised by this case is the potential for AI to be used to mislead the court or to deceive opposing counsel. If lawyers are not careful to verify the accuracy of AI-generated content, they could inadvertently make false or misleading statements in court. This could have serious consequences, both for the lawyer and for their clients.

The Role of Attorneys in Verifying AI-Generated Content

To mitigate the risks associated with using AI in legal practice, it is essential that attorneys take steps to verify the accuracy of AI-generated content. This includes:

• Fact-checking: Attorneys should carefully review AI-generated content to ensure that it is consistent with established legal principles and that it is supported by credible evidence.
• Cross-referencing: If AI-generated content cites to specific cases or statutes, attorneys should cross-reference these citations to ensure that they are accurate and that the cases or statutes support the claims made in the document. Every introductory Legal Research and Writing class teaches the importance of cite checking.
• Disclosure: If AI-generated content is used in court documents, attorneys should disclose to the court that AI was used and should explain the steps taken to verify the accuracy of the content.

The Future of AI in Legal Practice

The case of Mr. B. is a stark reminder of the importance of ethical considerations in the use of AI in legal practice. While AI has the potential to revolutionize the way lawyers work, it is essential that lawyers use this technology responsibly and with a deep understanding of its limitations.

As AI continues to evolve, it is likely that we will see even more innovative applications of this technology in the legal profession. However, it is imperative that the legal community develops clear ethical guidelines and best practices for the use of AI to ensure that this technology is used to enhance the justice system, rather than to undermine it.

Conclusion

The case of Mr. B. is a cautionary tale about the dangers of relying on AI-generated content without proper verification. By understanding the ethical implications of using AI in legal practice and by taking steps to verify the accuracy of AI-generated content, lawyers can help to ensure that this technology is used responsibly and effectively to serve the interests of justice.

US-based attorneys can learn more about the ethical implications of using AI in their practice through continuing legal education courses like these.

The post AI-Generated Legal Citations: A New Frontier in Legal Ethics appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

By Mark Rosch

As the legal profession grapples with the continually-shifting landscape of artificial intelligence (AI), the State Bar of California has taken a first-of-its-kind step forward to help lawyers use the technology in their practices by issuing comprehensive ethics guidance for attorneys who choose to use this powerful technology. This landmark document, titled "Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law," provides a roadmap for lawyers to navigate the ethical implications of AI and ensure that its use aligns with their professional obligations.

The Significance of Ethical Guidelines for AI in Legal Practice

The rapid advancement of AI is transforming the legal profession, offering a plethora of tools and resources to enhance efficiency, accuracy, and legal research. However, this technological revolution has also brought about a host of ethical concerns, particularly with regard to the potential for AI to perpetuate bias, infringe on client confidentiality, blur the lines between human and machine judgment, and introduce non-factual information.

The State Bar of California's new ethics guidance addresses these concerns head-on, providing a framework for lawyers to responsibly integrate AI into their practice while upholding their ethical duties to their clients and the legal system. The California Bar stopped short of creating binding standard of conduct that all California attorneys must adhere to when using AI - rather, the Bar advises that "[t]his Practical Guidance should be read as guiding principles rather than as 'best practices.'"

Key Principles of the State Bar's AI Ethics Guidance

The State Bar's AI ethics guidance is anchored in five fundamental principles:

• Competence: Attorneys must possess a thorough understanding of the AI tools they employ, including their capabilities, limitations, and potential biases.
• Client Confidentiality: Client information must be protected with utmost consideration, and lawyers should only use AI with vendors that have robust data security measures in place.
• Diligence: Attorneys must exercise due diligence in selecting, implementing, and monitoring AI tools, ensuring that they are appropriate for the specific legal task at hand.
• Supervision: Attorneys should establish clear policies regarding the permissible uses of generative AI in their practices. Those attorneys must also supervise their attorney and non-attorney staff to assure their use of AI tools conforms to those policies. 
• Communication: Attorneys should clearly communicate to their clients the role of AI in their representation, including the benefits, limitations, and potential risks of using this technology.

Specific Ethical Considerations for AI Use

The State Bar's ethics guidance delves into specific ethical considerations for the use of AI in various aspects of legal practice, including:

• Legal Research: AI can be a powerful tool for legal research, but attorneys must carefully evaluate the trustworthiness and accuracy of AI-generated results.
• Document Review: AI-assisted document review can expedite the review process, but attorneys must remain actively involved in reviewing key documents and ensuring the accuracy of AI-generated summaries.
• Legal Drafting: AI can assist in drafting legal documents, but attorneys must exercise judgment and expertise to ensure that the final product is tailored to the specific legal context and adheres to applicable legal standards.
• Client Communication: AI can be used to enhance client communication, but attorneys must ensure that AI-generated communication is clear, accurate, and tailored to the individual client's needs.
• Billing and Fee Arrangements: Attorneys should not charge clients for time saved by using AI, and billing practices should clearly reflect the human expertise and judgment involved in legal representation.

Conclusion: A New Era of AI-Powered Legal Practice

The State Bar of California's new ethics guidance marks a significant step forward in helping lawyers how they might use AI in their practices and guide them on how AI can be used responsibly and ethically within the legal profession. By providing a framework for attorneys to navigate the ethical implications of AI, these guidelines empower lawyers to harness the power of technology while upholding their fundamental obligations to their clients and the justice system.

As AI continues to evolve and become more prevelant in the legal landscape, the State Bar of California's ethical guidance on the use of Artificial intelligence will serve as an invaluable resource for attorneys, helping the profession to adapt to the changing technological landscape while maintaining its commitment to the ethical foundations of legal practice and commitment to client service.

The post Navigating the Ethical Landscape of Artificial Intelligence in Legal Practice: A First Look at the State Bar of California’s New Guidelines appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

CLEwebinars.com is hosting "The Ethics of Social Media Research" webinar on June 28th at 1:00-2:30 pm ET, presented by Carole Levitt, Esq. & Mark Rosch. (This webinar qualifies for 1.5 hours of Ethics credits.)

In this webinar, you will learn how to avoid potential ethical traps when you research social media profiles to uncover investigative/background information about parties, witnesses, experts, jurors, etc., and, in some cases, to use this information as evidence. This program reviews pertinent Ethics opinions issued by the ABA and bar associations in many jurisdictions; discusses relevant caselaw; reviews detailed Guidelines for social media research issued by the New York State Bar’s Commercial and Federal Litigation Section; and ties them into the ABA Model Rules of Professional Conduct.

The program will also explore:

• Who's your friend?
• Could "friending" violate the deception or ex parte communication ethical rules?    
• Whether it is ethical to research the social media profiles of parties and witnesses during discovery or trial?
• Is it ethical to research the social media profiles of potential jurors before trial or seated jurors during trial?
• Could advising clients to delete, deactivate, or adjust privacy settings on their social networking accounts lead to an ethical violation or spoliation charge against you?
• How to configure security/privacy settings in your own profile to avoid ethical breaches.

The seminar is partially based on the speakers' fifty-five page Social Media chapter from their book, "The Cybersleuth's Guide to the Internet."

The post CLE Webinar Covers Ethics of Social Media Research appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

In that order, counsel in the Northern District of California Oracle v. Google case agreed to Judge William Alsup’s proposed March 25, 2016 order that banned them from researching jurors’ internet presence. Oracle v. Google, No. C-10-03561, Document 1573 (N.D.Cal March 25, 2016), http://linkon.in/jurorgoogleoracle. If counsel had failed to agree with the proposed order, the judge stated that he would inform the jurors they were being researched by counsel.

The judge acknowledged that it is not unethical for counsel to conduct Internet searches on prospective jurors and to also view their public social media profiles. However, he then went on to say,  “That such searches are not unethical does not translate into an inalienable right to conduct them.”

He also discussed ABA Formal Opinion No. 466, where the ABA considered the extent to which an attorney may conduct Internet searches of jurors and prospective jurors without running afoul of ABA Model Rule 3.5(b) (which prohibits ex parte communication with jurors). In that Formal Opinion, the ABA said that judges may limit the scope of the searches that counsel could perform regarding the juror’s social media “[i]f a judge believes it to be necessary, under the circumstances of a particular matter . . . .” 

The judge based his juror research ban on three reasons:

• First, if they knew lawyers were researching them, Judge Alsup feared that jurors would stray from the court’s admonition to refrain from conducting internet searches on the lawyers and the case.
• Second, if the lawyers’ research uncovered certain juror preferences, they might shape their trial arguments and witness examinations to make improper personal appeals to the jurors based on those preferences.
• Third, the judge wanted to protect the privacy of the venire.

In the order, Judge Alsup discussed several ethics opinions related to lawyers conducting juror research, including:  “Formal opinion. No. 2013-189, issued by the Oregon state bar provides, unlike the ABA or the ABCNY, that a lawyer may affirmatively request access to private aspects of a juror’s social media profiles [emphasis added], provided the lawyer accurately represents his or her role in a case when asked by the juror.”

We think he misstated Oregon’s Formal opinion. No. 2013-189.

In footnote two, on page 578-579, the Oregon opinion actually said:

Although a lawyer may review a juror’s publicly available information on social networking websites, communication with jurors before, during, and after a proceeding is generally prohibited. Accordingly, a lawyer may not [emphasis added] send a request to a juror to access non-public personal information on a social networking website, nor may a lawyer ask an agent do to do so [emphasis added]. See Oregon RPC 3.5(b) (prohibiting ex parte communications with a juror during the proceeding unless authorized to do so by law or court order); Oregon RPC 3.5(c) (prohibiting communication with a juror after discharge if (1) the communication is prohibited by law or court order; (2) the juror has made known to the lawyer a desire not to communicate; or (3) the communication involves misrepresentation, coercion, duress, or harassment); Oregon RPC 8.4(a)(4) (prohibiting conduct prejudicial to the administration of justice). See, generally, §61:808, ABA/BNA Lawyers’ Manual on Professional Conduct and cases cited therein.

Read the Oregon Formal Opinion for yourself and see if you agree that Judge Alsup misinterpreted the Oregon Formal Opinion. You can find the Oregon Formal Opinion at: https://www.osbar.org/_docs/ethics/2013-189.pdf.

The post Oracle v. Google: The Social Media Research Ban appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Google Apps, for example, meets the security standards put in place for the online storage of government agencies' information set out in the Federal Information Security Management Act of 2000 (FISMA 44 U.S.C. § 3541, et seq.).

Cloud computing and "Software as a Service" (SaaS) are two terms used to describe similar services.  They allow you to access software, or store files, on computers that are not at your physical location or even in your physical control. Dictionary.com defines cloud computing as:

Internet-based computing in which large groups of remote servers are networked so as to allow sharing of data-processing tasks, centralized data storage, and online access to computer services or resources.

Wikipedia defines SaaS as:

"Software as a service (SaaS, typically pronounced [sæs]), sometimes referred to as 'on-demand software,' is a software delivery model in which software and its associated data are hosted centrally (typically in the (Internet) cloud) and are typically accessed by users using a thin client, normally using a web browser over the Internet."

Gmail and Flickr are examples of cloud computing or SaaS products because they give you access to e-mail software and message storage, and photo storage (respectively) on computers at a remote location.

In August 2012, the ABA House of Delegates adopted changes to the Model Rules of Professional Conduct dealing with the question of whether and how lawyers might deal with "confidentiality issues arising from technology." The changes were suggested by the ABA Commission on Ethics 20/20 and were, "designed to give lawyers more guidance regarding their confidentiality- related obligations when using technology."

Share this artice:          

The compilation below provides an overview of the existing Ethics Opinions produced, to date, by Bar Associations around the country.

So far, only a few State Bar Associations have issued formal ethics opinions on the questions. In reverse chronological order, those states include:

• Illinois State Bar Professional Conduct Advisory Opinion 16-06
• Board of Professional Responsibility of the Tennessee Supreme Court Formal Ethics Opinion 2015-F159
• Wisconsin Formal Ethics Opinion EF-15-01 (Ethical Obligations of Attorneys Using Cloud Computing) 
• Iowa Ethics Opinion 15-01
• Alaska Bar Association Ethics Opinion No. 2014-3
• Kentucky Bar Association Formal Ethics Opinion KBA E-437 (March 21, 2014)
• Connecticut Bar Association Professional Ethics Committee Informal Opinion 2013-07
• Ohio State Bar Association Informal Advisory Opinion 2013-03
• Virginia State Bar Legal Ethics Opinion 1872
• The Florida Bar Opinion 12-03
• Maine Board of Bar Overseers Professional Ethics Commission Opinion 207
• State Bar of California Standing Committee on Professional Responsibility and Conduct: Formal Opinion 2012-184
• Washington State Bar Association Ethics Advisory Opinion 2215
• New Hampshire Bar Association Ethics Committee Advisory Opinion 2012-13/4: "The Use of Cloud Computing in the Practice of Law"
• Massachusetts Bar Association Ethics Opinion 12-03
• Pennsylvania Bar Association Committee on Legal Ethics and Professional Responsibility Opinion 2011-200
• Oregon State Bar Association Formal Ethics Opinion Number 2011-188: "Information Relating to the Representation of a Client: Third-Party Electronic Storage of Client Materials"
• North Carolina State Bar Association Proposed 2011 Formal Ethics Opinion 6: "Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property" (10/20/11) - scroll down to read
• Alabama Bar Formal Ethics Opinion 2010-02
• Nevada Formal Ethics Opinion 33
• State Bar of Arizona Ethics Opinion 09-04
• Pennsylvania Bar Association Committee on Legal Ethics and Professional Responsibility: Formal Opinion 2011-200 (available online to Pennsylvania Bar members only)

In 2012 Opinion 2012-184, the Committee took its second look at technology and client confidentiality. Unlike its earlier opinion (Opinion 2010-179; see below) this time they actually used the term "cloud computing" . However, it added a new twist by focusing on a virtual law office practice ("VLO") and whether an attorney can "maintain a virtual law office practice ("VLO") and still comply with her ethical obligations if the communications with the client, and storage of and access to all information about the client’s matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")?"

The opinion explained that, "As it pertains to the use of technology, the Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner operating in the cloud than they do upon an attorney practicing in a traditional law office. While an attorney may maintain a VLO in the cloud where communications with the client, and storage of and access to all information about the client’s matter, are conducted solely via the internet using a third-party’s secure servers, Attorney may be required to take additional steps to confirm that she is fulfilling her ethical obligations due to distinct issues raised by the hypothetical VLO and its operation. Failure of Attorney to comply with all ethical obligations relevant to these issues will preclude the operation of a VLO in the cloud as described herein." The opinion refers attorneys back to Opinion 2010-179 for a fuller discussion on the analysis that the Committee believes attorneys should undertake when considering the use of a particular form of technology (see the quote below from Opinion 2010-179 for a synopsis of the analysis attorneys should undertake).

Massachusetts specifically addressed the question of “whether it [the use of cloud computing] would violate Lawyer’s obligations under the Massachusetts Rules of Professional Conduct to store confidential client information using “Google docs” or some other Internet based storage solution, and to synchronize his computers and other devices that contain or access such information over the Internet.”

In finding the use of cloud services permissible, the Massachusetts Opinion analogizes cloud services to “lawyer's use of unencrypted Internet e-mail to engage in confidential communications with his or her client” and third-party vendors accessing law firm networks in order to maintain the firm’s hardware or software that the Bar had found permissible in previous Opinions.

Like the earlier Opinions discussed below, Massachusetts instructs lawyers to undertake “reasonable efforts to ensure that the provider's terms of use and data privacy policies, practices and procedures are compatible with the lawyer's professional obligations, including the obligation to protect confidential client information reflected in Rule 1.6(a).” Unlike some other Opinions, the Massachusetts Opinion states that lawyers should get their clients’ prior consent before, “storing or transmitting particularly sensitive client information by means of the Internet.”

Specifically, the committee addressed the question, “May an attorney ethically store confidential client material in ‘the cloud’?” The committee’s conclusion is a qualified “yes.” Like some of the other opinions on this topic, Pennsylvania Opinion 2011-200 instructs attorneys that they “may ethically allow client confidential material to be stored in ‘the cloud’ provided the attorney takes reasonable care to assure that (1) all such materials remain confidential, and (2) reasonable safeguards are employed to ensure that the data is [sic] protected from breaches, data loss, and other risks.”

This opinion includes a bullet point list describing what “the standard of reasonable care for ‘cloud computing’ may include.” In addition to addressing the whole category of cloud computing services that lawyers might use, the Pennsylvania opinion also points to the use of web-based e-mail (naming Gmail among others) as “ordinarily permissible” for lawyers in most circumstances but, “may not be acceptable in the context of a particularly heightened degree of concern or in a particular set of facts.”

The full opinion is ordinarily available online to Pennsylvania Bar members only. However, some other organizations have posted it online.

In this Opinion, the Bar offered a "Yes, qualified" answer to the question of whether lawyers may contract "with third-party vendor to store client files and documents online on remote server so that Lawyer and/or Client could access the documents over the Internet from any remote location." In offering this guidance, the Opinion points to Oregon RPC 1.6 which cover the attorney's duty to "not reveal information relating to the representation of a client."

The opinion stated that, "[a] Lawyer may store client materials on a third-party server so long as Lawyer complies with the duties of competence and confidentiality to reasonably keep the client’s information secure within a given situation.² To do so, the lawyer must take reasonable steps to ensure that the storage company will reliably secure client data and keep information confidential. Under certain circumstances, this may be satisfied though a third-party vendor’s compliance with industry standards relating to confidentiality and security, provided that those industry standards meet the minimum requirements imposed on the Lawyer by the Oregon RPCs. This may include, among other things, ensuring the service agreement requires the vendor to preserve the confidentiality and security of the materials. It may also require that vendor notify Lawyer of any nonauthorized third-party access to the materials. Lawyer should also investigate how the vendor backs up and stores its data and metadata to ensure compliance with the Lawyer’s duties.³" (Note that the footnote material is not included here. To access the footnotes in this Ethics Opinion use the link above to the full text of the Opinion.)

Like New York Opinion #842 (below), this Opinion answers two separate questions regarding lawyers' subscribing to software as a service (SaaS) rather than purchasing and installing software from disks.

First, the Opinion tackles whether lawyers should even be using SaaS products for "for case or practice management, document management, and billing/financial management," or "the storage of a law firm’s data, including client files, billing information, and work product, on remote servers rather than on the law firm’s own computer and, therefore, outside the direct control of the firm’s lawyers." The Opinion answered this question by stating, "Yes, provided steps are taken to minimize the risk of inadvertent or unauthorized disclosure of confidential client information and to protect client property, including the information in a client’s file, from risk of loss." The Opinion point to Comments 17 and 18 of North Carolina's Rule of Professional Conduct 1.6 - "Comment [17] explains, 'A lawyer must act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer’s supervision.' Comment [18] adds that, when transmitting confidential client information, a lawyer must take “reasonable precautions to prevent the information from coming into the hands of unintended recipients.'"

Second, the Opinion tackles what measures lawyers should take to assess SaaS vendors to minimize potential security risks. Recognizing that criteria for assessing the security of these SaaS services would change with technology, the Opinion outlines a list of points lawyers should consider rather than spell out a specific set of guidelines lawyers must follow. The Opinion introduces this list thusly, "This opinion does not set forth specific security requirements because mandatory security measures would create a false sense of security in an environment where the risks are continually changing. Instead, due diligence and frequent and regular education are required." Some of the security measures the Opinions suggest to be considered are: 

• a specific agreement covering "how the vendor will handle confidential client information in keeping with the lawyer’s professional responsibilities" 
• the ability to retrieve the lawyer's data if "the SaaS vendor goes out of business, or the service otherwise has a break in continuity"
• careful review of the SaaS license agreement and security policy 
• evaluation of security measures, "including, but not limited to, firewalls, encryption techniques, socket security features, and intrusion-detection systems⁴ 
• evaluation of the SaaS vendors backup policies for the lawyer's data

The Iowa State Bar Ethics Opinion (Number 11-01) pointed to Comment 17 to Iowa's Rule 32:1.6 as establishing a "reasonable and flexible approach to guide a lawyer’s use of ever-changing technology. It recognizes that the degree of protection to be afforded client information varies with the client, matter and information involved. But it places on the lawyer the obligation to perform due diligence to assess the degree of protection that will be needed and to act accordingly." 

Comment 17 to Iowa's Rule 32:1.6 reads:

"[17] When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions. Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement. A client may require the lawyer to implement special security measures not required by this rule or may give informed consent to the use of a means of communication that would otherwise be prohibited by this rule."

Also, recognizing the changing nature of cloud computing services, the Iowa State Bar Association Committee on Ethics and Practice Guidelines chose to offer "basic guidance regarding the implementation of the standard described in Comment 17," in the form of a list of considerations lawyers should take into account when performing their due diligence in reviewing cloud services for their firms. 

Opinion, 2010-179 does not use the term "cloud computing," but the opinion can still be used to guide attorneys on their use of cloud computing because it deals with "using technology to transmit or store confidential client information when the technology may be susceptible to unauthorized access by third parties." The 2010-179 opinion explains that, "An attorney’s duties of confidentiality and competence require the attorney to take appropriate steps to ensure that his or her use of technology in conjunction with a client’s representation does not subject confidential client information to an undue risk of unauthorized disclosure. Because of the evolving nature of technology and differences in security features that are available, the attorney must ensure the steps are sufficient for each form of technology being used and must continue to monitor the efficacy of such steps." The opinion further states:

"Whether an attorney violates his or her duties of confidentiality and competence when using technology to transmit or store confidential client information will depend on the particular technology being used and the circumstances surrounding such use. Before using a particular technology in the course of representing a client, an attorney must take appropriate steps to evaluate: 1) the level of security attendant to the use of that technology, including whether reasonable precautions may be taken when using the technology to increase the level of security; 2) the legal ramifications to a third party who intercepts, accesses or exceeds authorized use of the electronic information; 3) the degree of sensitivity of the information; 4) the possible impact on the client of an inadvertent disclosure of privileged or confidential information or work product; 5) the urgency of the situation; and 6) the client’s instructions and circumstances, such as access by others to the client’s devices and communications."

The opinion explains that if client information is highly sensitive and a particular technology presents a risk of disclosure, then the attorney needs to consider other alternatives unless the client provides informed consent.

This Opinion tackled two questions:

• May a lawyer use an online system to store a client's confidential information without violating the duty of confidentiality or any other duty?
• If so, what steps should the lawyer take to ensure that the information is sufficiently secure?

The Opinion cited Rule 1.6 of the New York Rules of Professional Conduct that covers confidentiality, as well as Rule 1.0(j) that covers informed consent from clients in reaching the following conclusion:

"A lawyer may use an online data storage system to store and back up client confidential information provided that the lawyer takes reasonable care to ensure that confidentiality is maintained in a manner consistent with the lawyer’s obligations under Rule 1.6. A lawyer using an online storage provider should take reasonable care to protect confidential information, and should exercise reasonable care to prevent others whose services are utilized by the lawyer from disclosing or using confidential information of a client. In addition, the lawyer should stay abreast of technological advances to ensure that the storage system remains sufficiently advanced to protect the client’s information, and the lawyer should monitor the changing law of privilege to ensure that storing information in the 'cloud' will not waive or jeopardize any privilege protecting the information."

In this 2009 Ethics Opinion, the State Bar of Arizona addressed a question similar to the one addressed by Maine the previous year. In it, Arizona cited back to its 2005 Opinion and New Jersey’s 2006 Opinion to validate attorneys’ use of remote, electronic file storage systems, and stated that the “lawyer’s duty to take reasonable precautions does not require a guarantee that the system will be invulnerable to unauthorized access.”

The Bar went on to state that “the Committee also recognizes that technology advances may make certain protective measures obsolete over time. Therefore, the Committee does not suggest that the protective measures at issue in Ethics Op. 05-04 or in this opinion necessarily satisfy ER 1.6’s requirements indefinitely. Instead, whether a particular system provides reasonable protective measures must be ‘informed by the technology reasonably available at the time to secure data against unintentional disclosure.’ N.J. Ethics Op. 701. As technology advances occur, lawyers should periodically review security measures in place to ensure that they still reasonably protect the security and confidentiality of the clients’ documents and information.”

This New York State Bar Association’s Committee on Professional Ethics Opinion concluded that “A lawyer may use an e-mail service provider that conducts computer scans of e-mails to generate computer advertising, where the e-mails are not reviewed by or provided to other individuals.” While not named in the opinion, the question’s description of an “e-mail service provider that scans e-mails for advertising purposes” clearly describes Gmail.

The Maine Commission concluded that, “with appropriate safeguards, an attorney may utilize transcription and computer server backup services remote from both the lawyer's physical office and the lawyer's direct control or supervision without violating the attorney's ethical obligation to maintain client confidentiality.”

In this Opinion, the New Jersey Committee stated, “The critical requirement under RPC 1.6, therefore, is that the attorney ‘exercise reasonable care’ against the possibility of unauthorized access to client information. A lawyer is required to exercise sound professional judgment on the steps necessary to secure client confidences against foreseeable attempts at unauthorized access. ‘Reasonable care,’ however, does not mean that the lawyer absolutely and strictly guarantees that the information will be utterly invulnerable against all unauthorized access. Such a guarantee is impossible, and a lawyer can no more guarantee against unauthorized access to electronic information than he can guarantee that a burglar will not break into his file room, or that someone will not illegally intercept his mail or steal a fax.”

• Iowa State Bar Association Committee on Ethics and Practice Guidelines: Ethics Opinion 11-01: "Use of Software as a Service – Cloud Computing" (9/9/11)
• Pennsylvania Bar Association Committee on Legal Ethics and Professional Responsibility: Informal Opinion 2010-60 (1/11/11; available online to Pennsylvania Bar members only)
• Vermont Bar Association: Advisory Ethics Opinion 2010-06
• State Bar of California Standing Committee on Professional Responsibility and Conduct: Formal Opinion 2010-179 (2010)
• New York State Bar Association Committee on Professional Ethics: Opinion 842 (9/10/10)
• Alabama Disciplinary Commission Ethics Opinion 2010-02: Retention, Storage, Ownership, Production and Destruction of Client Files
• State Bar of Arizona Ethics Opinion 09-04: Confidentiality; Maintaining Client Files; Electronic Storage; Internet
• New York State Bar Association Committee on Professional Ethics: Opinion 820 (2/8/08) 
• Maine State Bar Professional Ethics Commission: “Client Confidences: Confidential firm data held electronically and handled by technicians for third-party vendors;” Opinion 194 (6/30/08)
• New Jersey Bar Advisory Committee on Professional Ethics: "Electronic Storage and Access of Client Files;" Opinion 701 (4/24/06)
• State Bar of Nevada Committee on Ethics and Professional Responsibility: Formal Opinion 33 (2/09/06)
• State Bar of Arizona Ethics Opinion 05-04: Electronic Storage; Confidentiality (07/05)

Most of the opinions already mentioned in this article point to a lawyer's duty to exercise "reasonable steps" to insure the confidentiality of their client's information. Many of them also refer back to Arizona Opinion 05-04 which states that lawyers should:

"take competent and reasonable steps to assure that the client’s confidences are not disclosed to third parties through theft or inadvertence. In addition, an attorney or law firm is obligated to take reasonable and competent steps to assure that the client's electronic information is not lost or destroyed. In order to do that, an attorney must be competent to evaluate the nature of the potential threat to client electronic files and to evaluate and deploy appropriate computer hardware and software to accomplish that end. An attorney who lacks or cannot reasonably obtain that competence is ethically required to retain an expert consultant who does have such competence."

Conclusion

The reality of computer security requires machines connected to the Internet to be maintained and patched on a regular basis. It’s important for lawyers to know what security measures are practiced by whatever cloud service provider they are considering, as well as where and how often vendors back-up the information stored with their services, among other concerns.  Regardless of whether lawyers are storing files "in the cloud" or on their office’s local network, they must make a  “reasonable effort” to keep that information secure  to insure that those computers are as protected as they can be.

Originally posted 10/30/2011. Last updated 11/8/15. Last updated 2/4/19.

The post Legal Ethics Considerations for Lawyers’ Use of Cloud Computing Services appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

• A lawyer may always view the public portion of a person’s social media profile and any public posts made by a person through social media.
• A lawyer may always view the public portion of a person’s social media profile and any public posts made by a person through social media.
• A lawyer acting on behalf of a client may not request permission to view a restricted portion of a social media profile or website of a person the lawyer knows to be represented by counsel in that same matter, without obtaining consent from that counsel.

[Note, the Committee stated, “Similarly, a lawyer may view or utilize information to which the lawyer already has access through the lawyer’s social media connections.” This might mean that if the lawyer was already Facebook friends with the represented party before litigation ensued, viewing the restricted portion would not be unethical because the lawyer already had access to it.]

• When requesting or obtaining information from a third person who has access to restricted portions of a social media profile or website of a party or witness, a lawyer is subject to the same standards as when requesting any other information in the hands of a third person.
• A lawyer may not request permission to view a restricted portion of a social media profile or website of a judge while the judge is presiding over a case in which the lawyer is involved as counsel or as a party, nor may a lawyer seek to communicate ex parte with a judge through social media concerning a matter or issue pending before the judge.
• A lawyer may not request permission to view a restricted portion of a social media profile or website of a prospective or sitting juror. 

[Note, the Committee stated that if the social media service has a technical feature whereby the social media service automatically communicates to the juror that you viewed their public profile, this would not be considered an impermissible communication by you to the juror. Various jurisdictions disagree with this, but the ABA agrees. However, the Committee stated that this could potentially violate Colo. RPC 4.4(a) if the lawyer knew about the automatic notification, engaged in repetitive viewing of the profile with no legitimate, and it rose to the level of harassment or intimidation.

• A lawyer must never use any form of deception to gain access to a restricted portion of a social media profile or website. 

The Committee, explained, “As stated in an article in the Colorado Supreme Court Attorney Regulation Counsel Newsletter, "donning an alias and ‘friending’ someone on Facebook to gain access to restricted information is prohibited."]

• Finally, a lawyer may not avoid prohibitions relating to the use of social media for investigative purposes by delegating investigative tasks to others.

[Note: The Committee recognizes that, “A lawyer may advise a client concerning the client’s legal rights to access a restricted portion of a social media profile or website. Also, consistent with Colo. RPC 4.2, a lawyer may advise a client concerning direct communications through social media that the client is legally entitled to engage in with another party the lawyer knows to be represented by counsel. See Colo. RPC 4.2, cmt. [4]. However, a lawyer may not simply use the client as a means of communicating directly with a represented party in circumvention of Rule 4.2. See also Colo. RPC 8.4(a).”]

To read the full opinion, see: http://linkon.in/cobarsminvest127.

The post Summary of the Colorado Bar Association Ethics Committee Formal Opinion 127: “Use of Social Media for Investigative Purposes” appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.