A vendor demo runs about thirty minutes. The tool answers a mock client inquiry, drafts an engagement letter and summarizes a deposition while you refill your coffee. Then the salesperson asks when you'd like to start.

Slow down at that moment. In ABA Formal Opinion 512, issued in July 2024, the ABA reminded lawyers that the duties of competence and confidentiality apply to generative AI the same way they apply to any other tool. Model Rule 1.6(c) asks you to make reasonable efforts to prevent unauthorized access to client information. You can't make reasonable efforts if you don't know where the information goes.

We spent years on the security side of enterprise IT before we started building automation for small firms. A managing partner can take these questions into any vendor call without a technical background. Ask for the answers in writing.

1. What client information will the tool see, and can we limit it?

Vendors ask for broad access during setup because it makes their job easier. Ask for a list of every system the tool connects to and every permission it requests. An intake assistant needs your calendar and a place to record new leads. It has no reason to read your whole document management system. If the vendor can't narrow the access, you have your answer.

2. Where does our data go, and who processes it?

Many AI products run on a model from another company, store files with a cloud provider and send email through a third service. Client information sits in each of those places. Ask for the list of subprocessors and the regions where they keep data.

3. Will our data train anyone's model?

Ask the question in those words, and ask for the contract clause that answers it. The consumer and business versions of the same AI product often carry different terms. You want a clear statement that your prompts, documents and outputs won't train models other customers use.

4. How long do you keep it, and how do we delete it?

Logs help when something goes wrong. They also leave a copy of client information that outlives the matter. Ask how long the vendor keeps conversation logs, uploaded files and backups. Then ask what happens if you cancel: can you export everything, and will they confirm deletion in writing?

5. Who at the vendor can see our information?

Support staff sometimes need access to fix a problem. Ask whether that access requires your permission, whether the vendor logs it and whether you can review the log. A good vendor describes a process. A weak one says "only authorized personnel" and moves on.

6. What happens when the tool gets it wrong?

Every AI tool makes mistakes, so the real test is whether a person catches them in time. Ask how the tool hands a conversation to a human, how it flags answers it isn't sure of and whether it can act on its own, such as emailing a client or booking a consultation. A lawyer or staff member should approve anything that could create an attorney-client relationship or set a deadline. Opinion 512 leaves no doubt that you stay responsible for the output.

7. If you're breached, when do we hear about it?

Look for the notification timeline in the contract, not on the marketing page. Ask whether the vendor carries cyber insurance and whether an independent auditor has reviewed its security, for example through a SOC 2 report. Many small vendors don't have one yet. That shouldn't rule them out, but it should limit what you hand them.

What to do with the answers

File the vendor's answers with your engagement letter templates and your existing policies. If the tool touches client information, your clients may expect you to tell them. Opinion 512 discusses when you need informed consent, and the answer depends on how the tool uses their information. Make that call before launch rather than after a client asks.

Then start small. Pick one workflow, give the tool the least access it needs and have a person review its output for the first few weeks. A vendor who resists a narrow pilot is showing you how they'll treat you after you sign.

Keep the written answers in your file. When a client, an insurer or a bar investigator asks how you vetted the tool, you'll have them ready.

This article is general information, not legal advice. Check your state's rules and ethics opinions, which may go further than the ABA's.