Can Law Firms Use ChatGPT? Confidentiality, ABA Opinion 512, and Safer AI Intake
Generative AI can save a firm real time on intake, drafting, and research. It can also expose client confidences or put a fabricated citation in front of a judge. Here is what the professional rules say, and how to use AI without putting your license at risk.
The direct answer: Yes, lawyers can use ChatGPT and other generative AI tools. But the rules of professional conduct apply to AI exactly as they apply to any other tool. The risks that matter are confidentiality, unverified output, and unsupervised use. This article is general information, not legal advice. Check your own state bar's guidance.
What ABA Formal Opinion 512 says
In July 2024 the American Bar Association issued Formal Opinion 512 on generative AI tools. It does not ban them. It applies existing Model Rules to them, and the duties that come up most are:
- Competence (Rule 1.1). You need a reasonable understanding of what the tool can and cannot do, including that it can produce plausible but wrong output.
- Confidentiality (Rule 1.6). You must make reasonable efforts to prevent unauthorized disclosure of information relating to a representation. Putting client information into a tool is a disclosure question.
- Communication (Rule 1.4). In some situations you must tell clients you are using AI, and the opinion says consent for entering client information into certain tools must be informed. Boilerplate in an engagement letter generally will not do.
- Supervision (Rules 5.1 and 5.3). Partners and supervisors must set policies and train staff on AI use, and remain responsible for the output.
- Candor and meritorious claims (Rules 3.1 and 3.3). You are responsible for every statement and citation you file.
- Fees (Rule 1.5). You cannot bill for time you did not spend because AI did the work.
The confidentiality problem in plain terms
The risk is not that ChatGPT is "unsafe." It is that you may not know what happens to what you type. Depending on the product and settings, a vendor may retain inputs, allow its staff to review them, or use them to improve its models. If a prompt contains information relating to a client matter, any of those outcomes could be an unauthorized disclosure.
Before any tool touches matter data, find out in writing: whether inputs are retained and for how long, whether they are used for training, who at the vendor can access them, where they are stored, and what contract terms govern them. Enterprise and API offerings often differ from the free consumer product on exactly these points. The difference is in the settings and the contract, not the brand name.
The fabricated-citation problem
In Mata v. Avianca (S.D.N.Y. 2023), lawyers filed a brief with cases a generative AI tool had invented, and the court sanctioned them. Courts have seen similar problems since. Language models predict plausible text, not true text, so they can produce citations, quotations, and holdings that do not exist.
The working rule is simple: AI output is a draft written by someone who has never read the case. Every citation, quotation, and factual statement has to be checked against the source before it goes to a court or a client.
Setting up AI intake safely
Intake is one of the better uses of AI for a firm, because the work is repetitive and the value of a fast response is high. It is also where the guardrails matter most, because the person on the other end is a prospective client, and prospective clients are owed confidentiality too. A sound setup does these things:
- Says what it is. The chatbot states plainly that it is an automated assistant, not a lawyer, and that using it does not create an attorney-client relationship.
- Does not give legal advice. It collects facts and answers questions about the firm, and hands anything that sounds like advice to a person.
- Collects only what it needs. Enough to check for conflicts and route the inquiry, not a full account of the matter.
- Runs where you control the data. You know where transcripts are stored, who can read them, and how long they are kept.
- Routes to a human quickly, with a clear handoff and a record of what the prospect was told.
A short AI policy every firm should have
- Approved tools only, with the approved settings documented.
- No client-identifying or matter information in any tool that has not been vetted.
- A named person who verifies every citation and quotation before filing.
- Rules for when and how clients are told about AI use.
- Training for everyone with access, reviewed at least yearly.
Where Truvaldi fits
We build intake chatbots, lead-qualification tools, and practice-area content for law firms, designed around these rules, with security review led by a CISSP-certified practitioner. See our AI chatbots for law firms, our AI consulting for Phoenix law firms, and our broader approach to AI for regulated industries. We do not provide legal or ethics advice, so have your own counsel or your bar's ethics hotline review the final configuration.
Elija leads security and compliance strategy at Truvaldi. As a CISSP-certified practitioner, he architects HIPAA-aware AI systems for medical, aesthetics, and financial practices — and delivers the Security Risk Assessments that keep them audit-ready.
Frequently asked questions
Can lawyers use ChatGPT for client work?
Yes, but the professional rules still apply. ABA Formal Opinion 512 (2024) says lawyers using generative AI must meet their duties of competence, confidentiality, communication, supervision, and candor to the court. Entering information about a client matter into a tool is a disclosure decision, and for some tools it requires the client's informed consent.
Is it a confidentiality violation to paste client information into a public AI tool?
It can be. Under the confidentiality rule, a lawyer must make reasonable efforts to prevent unauthorized disclosure of information relating to a representation. If a tool stores inputs, lets staff at the vendor review them, or uses them to train a model, entering client information may be an unauthorized disclosure. Read the vendor's terms and configure the tool before you use it with matter data.
Do I have to tell clients I use AI?
It depends on the use and your jurisdiction. ABA Opinion 512 says disclosure and consent may be required, for example when client information is entered into a tool that could expose it to others, and that boilerplate language in an engagement letter is generally not enough. Check your state bar's guidance and your engagement terms.
What happened in the case where lawyers cited fake cases from ChatGPT?
In Mata v. Avianca (S.D.N.Y. 2023), attorneys filed a brief citing cases that a generative AI tool had invented, and the court sanctioned them. The lesson is that AI output is a draft. A lawyer must verify every citation and statement before it reaches a court or a client.
Can a law firm use an AI chatbot for client intake?
Yes, with guardrails. A well-designed intake chatbot states clearly that it is not a lawyer and does not create an attorney-client relationship, collects only the information needed to evaluate the inquiry, avoids giving legal advice, and routes the lead to a person. It should also run on infrastructure where the firm controls how the data is stored and used.
Want AI intake your ethics counsel can sign off on?
We design AI intake and content tools around confidentiality and advertising rules, with security review led by a CISSP-certified practitioner.