AI for Lawyers

Most law firms are already using AI somewhere in the week, whether or not the firm has decided anything. A trainee asks a chatbot to tidy a letter. An associate pastes a clause into a free tool to see what it means. Nobody is being reckless, and nobody has written down what is allowed.

This guide is for the person who has to decide. It sets out what AI is good for in a legal practice, which tasks to hand over first, where client information must stay out, why fake citations have become a regulatory problem, and how to check the work before it reaches a client or a court. It is written for small and mid-sized firms, where there is no technology committee to take the decision for you.

It is general information, not legal advice. Professional rules differ by country and by regulator, so read your own regulator’s current guidance alongside this.

What can lawyers use AI for?

AI is good at work made of language and patterns, and poor at work that depends on being exactly right from memory. That split explains most of what is worth doing in a law firm.

The tasks that tend to work well:

• Summarising. Long documents, disclosure bundles, email chains on one matter, a lease or a set of terms, with a lawyer reading the source for anything that matters.
• First drafts. Client letters, file notes, internal memos, engagement wording and plain-language explanations of a legal point for a client who does not speak law.
• Structuring. Turning a rough set of notes into a chronology, an issues list, a checklist for a transaction or a list of questions for a client call.
• Comparing. Pointing out the differences between two versions of a document so a person can look at them.
• Rewording. Making a dense paragraph shorter, clearer or more suited to a particular reader.

The tasks to be careful with are those where a wrong answer is expensive and the tool cannot show its working: stating the law, citing authority, calculating a deadline or a figure. A language model produces text that sounds right. When it is wrong, the sentence still reads smoothly, and in legal work that is the danger.

A useful rule is to ask whether you could check the result in under a minute. If you can, it is a good candidate. If checking takes as long as doing the job, the tool has saved nothing, and our guide to what an AI workflow actually costs to run shows how to count that honestly.

Which AI Tools do Law firms use?

Three kinds of tool cover most of what a practice does, and the difference between them is mainly about where client information goes.

General-purpose assistants. Products such as ChatGPT and Claude answer questions, draft text and explain documents you give them. They are flexible and quick to start with. Their risk is that people use free personal accounts, where the supplier’s terms on storage and training may not suit client work. If you are weighing two of them, our comparison of Claude vs ChatGPT for business covers how they differ.

Assistants inside software you already pay for. Microsoft 365 Copilot, for example, works across the documents, email and files in your existing licence, inside the firm’s own environment. For many practices this is the easiest to defend, because the data does not leave a system you have already assessed. It is only as safe as the permissions on your files, so tidy those first. Our comparison of ChatGPT vs Microsoft Copilot for business sets out the trade-offs.

Dedicated legal products. Research and drafting tools built for lawyers often work against a controlled body of material rather than the open internet, and some use retrieval-augmented generation, which means the tool looks up passages in a defined set of sources and answers from them. That reduces invented answers but does not remove them, so the checking duty stays.

Do not choose by what is popular. Choose by the task, then by what the supplier will say in writing about your data: where it is stored, for how long, who can see it and whether it is used to train models. The American Bar Association’s opinion points firms to the kind of due diligence they would already do when outsourcing, including reference checks and vendor credentials. If a supplier cannot answer clearly, think carefully before buying.

Is it Safe for lawyers to put client Data into AI Tools?

Not by default. This is the question that matters most, and the answer depends on the account, the settings and what you type in.

Lawyers owe clients confidentiality, and that duty does not change because the recipient is software. The guide from the Council of Bars and Law Societies of Europe, published on 2 October 2025, is direct: lawyers may not input personal, confidential or client-related information into generative AI tools. The American Bar Association’s formal opinion on generative AI takes a similar line from a different direction. Before entering client information into a tool, a lawyer must evaluate the risk that it will be disclosed to or accessed by others outside the firm. For self-learning tools, the opinion says informed consent is required before information relating to the representation is entered, and that boilerplate waivers will not suffice.

In the EU and UK, data protection law adds its own layer. Under the GDPR, personal data must be processed securely, and a supplier that handles it for you is a processor that needs a proper contract. Privilege adds a further question: whether placing privileged material in a third-party service puts that privilege at risk is not something to leave to guesswork, so take advice on your own jurisdiction before it becomes a live issue.

Four habits keep you on safe ground:

1. Keep identifying details out. Replace names with “Client A” and “Counterparty B”, remove reference numbers and strip anything that points to a real person or company. Often the tool needs the shape of the problem, not the identity.
2. Use accounts the firm controls. A business account with clear terms on storage and training is a different thing from a free personal login. If the firm has no approved account, that is the gap to close first.
3. Do not paste what you could not hand to a stranger. Privileged advice, witness statements, settlement positions, personal data about third parties and anything under a court order or a client’s own restrictions stay out. Our guide to what is safe to paste breaks this down by type of information.
4. Write the rule down. A rule people have not read is no rule. A simple red, amber and green sort works for a firm of any size: green for generic questions, amber for anonymised facts, red for anything identifiable.

Banning the tools is not the answer. Staff who find them useful keep using them, privately, on devices you cannot see. That is shadow AI, and the case against banning AI tools at work is that a ban removes your visibility without removing the behaviour. The same applies to AI meeting notes: a recording tool joining a client call raises consent, confidentiality and retention questions that are worth settling before someone switches one on.

Can AI make up legal cases?

Yes, and it has already happened often enough to reach the High Court. In R (Ayinde) v London Borough of Haringey, decided on 6 June 2025 with a connected case against a bank, the Divisional Court dealt with legal arguments that cited authorities that did not exist or did not say what was claimed. The court described the risk plainly: freely available generative AI tools “are not capable of conducting reliable legal research”.

The reason is hallucination. A language model predicts plausible text. It does not look a case up. So it can produce a name, a neutral citation, a judge and a tidy holding for a case that was never decided, in the same confident tone as a real one. Our explanation of hallucination covers why this happens and why it is hard to spot, and how to reduce AI hallucinations covers the habits that lower the rate.

The court was clear about where responsibility sits:

• Checking is a professional duty. Lawyers have a professional duty to check the accuracy of such research by reference to authoritative sources, such as the legislation database, the National Archives case law database, the official law reports and reputable legal publishers.
• It applies even if someone else did the work. The duty covers lawyers who do the research themselves and lawyers who rely on others who did it.
• Clients are not a safeguard. A lawyer is not entitled to rely on a lay client for the accuracy of citations of authority.
• Guidance alone is not enough. The court said promulgating guidance on its own is insufficient to address the misuse of AI, and that those in leadership roles, such as heads of chambers and managing partners, must take practical and effective measures.

It also referred the lawyers involved to their regulators, which is the part that should concentrate minds. Fake citations are not a technical embarrassment. They are a conduct issue.

The workable method is simple. Treat every authority an AI tool gives you as a lead, not a source. Find the case or provision in a trusted database, read the passage that matters and confirm it says what the draft claims, then record where you checked.

Can AI review and draft contracts?

It can help, and the useful framing is “first reader”, not “reviewer”. An AI tool can read a long agreement and list the clauses that deal with termination, liability, payment and governing law, summarise obligations in plain English, flag clauses that differ from your standard wording and suggest alternative phrasing for a lawyer to judge.

What it cannot do reliably is decide what a clause means in the context of this deal, this jurisdiction and this client’s risk appetite. It may miss an unusual clause, treat two different terms as the same or tidy up wording in a way that changes the legal effect. The American Bar Association’s opinion puts the principle neatly: AI tools cannot solely substitute for a lawyer’s competent legal work, and the level of verification depends on the tool and the task.

A practical routine for contract work:

1. Give it your own checklist. Ask it to find specific provisions rather than “tell me what is wrong”. A defined list produces checkable answers.
2. Ask for locations. Require the clause number and the quoted text for every point, so you can read the original in seconds.
3. Read the full document anyway. The tool narrows the search. It does not replace reading the parts that carry the risk.
4. Never accept redrafted wording unread. Compare it line by line against the original.

A well-written brief makes this far more reliable. The method in our guide to how to brief an AI tool like a new hire applies directly: say what role the tool is playing, what it may use, what format you want and what to do when it is unsure.

How do you check AI output before it leaves the firm?

Build the check into the process so it happens every time, not only when someone remembers. A sound routine has four parts.

1. Source check. Every case, statute, date and quotation is traced to the authoritative source it came from. If the tool cannot point to one, the claim is a lead, not a fact.
2. Accuracy check. Names, parties, amounts and dates are checked against the file, not accepted from the draft.
3. Scope check. Does the answer deal with this client’s situation and this jurisdiction, or a generic one? Tools often answer the question they expected rather than the one asked.
4. Sign-off. A named, qualified lawyer approves anything that leaves the firm. This is human in the loop in practice: the tool drafts, the lawyer decides.

Match the depth of checking to the risk. A reworded reminder letter needs a glance. A skeleton argument or an advice letter needs a full trace of every authority. Our guide to how to check AI output before it goes to a customer sets out a checklist you can adapt, and it is worth printing one version for the whole team.

Independence matters too. The European guide warns about sycophancy, the tendency of some tools to agree with whatever the user seems to want. If you ask a tool whether your argument is strong, it may say yes. Ask it to argue the other side instead, and treat the answer as a prompt for your own thinking.

Do lawyers have to tell clients they use AI?

The rules vary by country and regulator, so there is no single answer and you should not guess. The American Bar Association’s opinion draws a few lines worth knowing. Informed consent is required before client information is put into a self-learning tool, and boilerplate in an engagement letter does not count as informed consent. Consent is not needed where a lawyer uses a tool without entering client information, such as for brainstorming. Advance informed consent is also needed where AI use is relevant to the basis or reasonableness of a fee.

In England and Wales, the Law Society’s guidance and the regulator’s expectations are the place to start, and the 2025 High Court judgement makes clear that courts will look closely at how AI is used in material put before them. In the EU, check your bar’s guidance and the CCBE guide, and your obligations under data protection law where personal data is involved.

Even where nothing requires it, being open tends to help. A sensible position for a small firm is a short paragraph in the engagement terms, in plain language, that says which tools the firm uses, that client information is handled under its confidentiality obligations and that a qualified lawyer reviews all work. It costs little and answers the question before a client asks it.

Can a Law firm bill clients for time AI saved?

Not for time that was not spent. This is the question that changes how a firm prices, and the American Bar Association’s opinion is explicit that hourly billing is limited to the actual time worked, and that a lawyer may not charge clients for time needed because of their own inexperience. Expense charges for tools must be reasonable, and generally a firm should not add a surcharge to the actual cost.

That leaves two honest options. Bill the shorter time, and keep the client who notices the quality and the speed. Or move suitable work to fixed fees, where the price reflects the outcome and the saving is shared. Either way, agree the approach with the client in advance, not on the invoice.

What should a Law firm’s AI Policy say?

Keep it to one page. Long policies go unread. The American Bar Association’s opinion says managerial lawyers must establish clear policies on a firm’s permissible use of generative AI, and the 2025 High Court judgement said guidance alone is not enough. For a practice, that translates to six short headings:

• Approved tools. The list, and who may add to it.
• Client information. What may and may not be entered, with examples, and what needs client consent.
• Checking. Who verifies output, how deep the check goes for each type of work, and the rule that every authority is confirmed in a trusted source.
• Disclosure and billing. What you tell clients, and how AI use is reflected in fees.
• Incidents. What to do if client information goes somewhere it should not, or a fake citation reaches a filing, and who to tell, including any regulator or client you must notify.
• Ownership. One named person responsible for keeping the policy current.

That last item is the one most firms skip, and it decides whether the policy survives. Our guide on how to write an AI use policy for your team gives a template, and the overview of AI governance explains how to keep the whole thing light. For a firm that wants an outside view of what staff are already doing, an AI audit maps current use and shows where the real risks sit.

Firms in the EU should also note the EU AI Act, which includes a duty on organisations that use AI to make sure their staff have a sufficient level of AI literacy. That is a reason to train, not just to write rules.

Which AI tasks should a Law firm start with first?

Start with one internal task that is frequent, easy to check and harmless if the first attempt is wrong. Avoid anything client-facing, anything that touches advice and anything filed with a court until you have evidence of how well your checking works. Good first candidates:

• Summarising long email threads on a matter before a partner meeting.
• Turning meeting notes into an action list and a follow-up note.
• Drafting standard letters and file notes from a template, with a person sending them.
• Producing a first-pass chronology from documents you already hold, checked against the originals.

Before you begin, write down how long the task takes now, so you can see whether anything improved. After two weeks, time the whole cycle, including checking. If it saved time, keep it or move to a neighbouring task. If it did not, stop and say so. Our guide to which AI tasks a small business should start with first walks through the choice step by step.

How do you train a legal team to use AI?

Training works best when it uses the firm’s own work. Generic sessions on prompts are quickly forgotten, whereas an hour spent on your own letters, your own precedents and your own checking routine sticks.

Cover four things: what the tools are good and bad at, what must never be pasted, how to write a clear instruction, and how to check the result. Include a real example of a fabricated citation, and make clear that the person who files the document owns the contents, whoever drafted it. Then let people try it on a low-risk task and share what they found.

For structured help, there is a course on responsible and compliant AI use. If you want a view of where AI would help in the firm and where it would not, an outside check looks at the work already running.

What follows

Pick one internal task, anonymise what goes in, name the person who signs off the output and write a one-page rule for the firm, including the rule that every authority is confirmed in a trusted source. Everything else, including research, contract work, client-facing drafts and any change to how you bill, can wait until you have a month of evidence about how your own team checks and corrects what the tools produce.

Sources

• National Archives, R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin): the Divisional Court judgement of 6 June 2025 on fake citations, which says freely available generative AI tools are not capable of conducting reliable legal research, that lawyers must check output against authoritative sources, that a lawyer cannot rely on a client for the accuracy of citations, and that those with leadership responsibilities must take practical and effective measures.
• The Bar Examiner, “Generative artificial intelligence tools” (Fall 2024): a summary of the American Bar Association’s Formal Opinion 512, covering the risk evaluation before entering client information, informed consent for self-learning tools, the point that boilerplate waivers will not suffice, supervision and policies, and billing limited to actual time. It is a summary, so check the opinion itself before relying on exact wording.
• eucrim, “CCBE issues guidance on generative AI use in legal practice” (October 2025): reports the European bars’ guide of 2 October 2025, which says lawyers may not input personal, confidential or client-related information into generative AI tools, that outputs must be independently verified and that bias and sycophancy are risks to independent judgement.
• Law Society, “Generative AI: the essentials”: the professional body’s guide for solicitors in England and Wales on using generative AI; it is updated as regulation and case law change, so read the current version.
• EUR-Lex, Regulation (EU) 2016/679 (GDPR): the legal text on secure processing of personal data and on the contract needed with a supplier that processes it for you.
• EUR-Lex, Regulation (EU) 2024/1689 (EU AI Act): the legal text, including the duty on organisations using AI to ensure a sufficient level of AI literacy among their staff.