Use AI Without Betting the Firm
A practical guide for Florida lawyers who want useful AI without surrendering confidentiality, professional judgment, or client trust.
A former Big Law corporate equity partner at Steptoe (NYC Managing Partner) and Seyfarth Shaw • Florida-focused • Independent consultant • No software to sell
Last reviewed: September 30, 2026. This page is updated when Florida ethics guidance, court rules, or material risk controls change.
Looking for a specific answer? Start with 25 short answers to Florida AI ethics questions. This guide walks through the controls, data decisions, and first-month steps for a firm that is ready to set rules.
AI is already inside the software many firms use for email, documents, legal research, practice management, intake, transcription, and marketing. Lawyers and staff are also opening stand-alone tools on their own. The question is no longer whether AI will enter the firm. It is whether it enters through the front door with rules, or through a collection of browser tabs no one has reviewed.
Florida lawyers may use generative AI. But permission to use a tool is not permission to hand it professional judgment, expose client information, trust an unverified answer, or bill for time that was never spent.
The goal is not zero risk. Law practice did not have that feature before AI. The goal is controlled use: an approved tool, appropriate information, a defined task, an identified reviewer, and a verified result.
The short version
Five rules cover most of the ground.
- Use only tools and account plans the firm has reviewed and approved.
- Decide what information may enter the tool before anyone uploads a file.
- Keep lawyer judgment, client advice, and final approval with the lawyer.
- Verify facts, quotations, citations, calculations, and legal conclusions independently.
- Document the workflow, train the team, and revisit the decision when the tool changes.
Give your firm a sensible place to start.
Get the Opinion 24-1 guide, AI-readiness checklist, five workflows worth testing, tool-approval scorecard, daily verification checklist, sample client language, incident-response protocol, and 90-day implementation outline.
Get the Free Florida AI Starter Playbook →On This Page
The Real Choice: Controlled Use or Accidental Use
The usual debate (“Should our firm use AI?”) is already stale. If the firm has Microsoft 365, Google Workspace, a legal research platform, a PDF tool, a practice-management system, a transcription service, or a website intake product, AI features may already be present. Some may be turned on by default. Some may be used by individual lawyers or staff without a firm decision. If you want the short answers first, start with the 25 AI ethics questions.
That creates two risks at once. The cautious partners may believe the firm is not using AI. The rest of the team may be using it anyway, with personal accounts, unknown settings, and no review standard. A written ban that no one follows is not a control. It is office fiction.
Small firms do not need an innovation department. They need a short approved-tool list, clear data rules, a few hard stops, a named owner, and one workflow the team can test without improvising.
What Florida Bar Opinion 24-1 Actually Says
The Florida Bar adopted Ethics Opinion 24-1 on January 19, 2024. It is an advisory ethics opinion, not binding law. It does not ban generative AI. It explains how existing duties apply when Florida lawyers use it.
The opinion’s practical message is straightforward: lawyers may use generative AI, but they remain responsible for protecting client information, supervising use, verifying work, charging proper fees and costs, and complying with advertising rules. Read Florida Bar Ethics Opinion 24-1.
What the opinion does not say
- It does not require a firm to buy a legal-specific AI product.
- It does not declare every paid or enterprise account safe for client information.
- It does not require client consent for every use of AI.
- It does not allow a lawyer to rely on a tool’s confidence, citations, or polished tone.
- It does not let a lawyer charge fictional time because a task used to take longer.
- It does not make the vendor responsible for the lawyer’s professional judgment.
The opinion is guidance, not a complete operating manual. Your firm still must decide which tools are approved, which information may be used, which tasks are permitted, who reviews the work, and what happens when something goes wrong.
Keep the one-page ethics reference near the work.
Use the quick reference to spot confidentiality, supervision, accuracy, billing, and client-communication issues before a workflow goes live.
Open the AI Ethics Quick Reference →The Six Duties That Should Shape Every AI Workflow
1Protect all information relating to the representation
Florida’s confidentiality duty is broader than attorney-client privilege. The working question is not merely, “Is this privileged?” It is, “Does this information relate to a client’s representation, and what happens to it when it enters this system?”
Before confidential information enters a third-party AI tool, the firm should understand the specific product and account plan, contractual terms, retention, data reuse, access, deletion, security, vendor subcontractors, and breach procedures. Product names are not enough. Different plans under the same brand may have different protections.
Removing a client’s name may not solve the problem. A detailed fact pattern, transaction, medical history, location, opposing party, or document set can still identify the client or reveal sensitive information.
2Understand the tool well enough to make a professional decision
A lawyer does not need to become a software engineer. The lawyer does need to understand the features and risks that matter to the work: where information goes, whether it may be retained or reused, how the system can be wrong, what sources it can access, and how its output will be checked.
“The vendor said it was secure” is not an analysis. Neither is “everyone uses it.” A firm should save the relevant contract terms, privacy terms, security materials, written vendor answers, approval decision, restrictions, and next review date.
3Supervise lawyers, staff, vendors, and automated systems
Opinion 24-1 compares AI oversight to the supervision of nonlawyer assistants. The analogy is useful. A fast junior assistant can help. A fast junior assistant who never admits uncertainty and occasionally invents an answer needs review.
The firm should tell lawyers and staff which tools are approved, what information may be entered, which uses require a lawyer, how output must be checked, and where questions go. Training should include examples of prohibited uses, not just a policy link sent at 4:57 p.m.
4Verify the work independently
AI can fabricate authority. It can also make quieter errors: omit a key fact, misquote the record, use outdated law, misunderstand a defined term, reverse a party, miss an exception, or calculate a deadline incorrectly. Fluent prose does not reduce the risk. It can hide it.
The reviewer should compare the output with the actual source: the client document, record, current statute or rule, controlling case, authoritative citator, calculation, or firm-approved model. Asking the same AI whether it is sure is not independent verification. That is the same witness answering the same question twice.
5Charge for work actually performed
Efficiency does not permit inflated time. If AI reduces a task from three hours to one, an hourly bill should not quietly preserve the missing two hours. Opinion 24-1 also cautions against duplicate charges and charging clients to build the lawyer’s basic competence with the tool.
Opinion 24-1 says a lawyer intending to charge the actual cost of generative AI must inform the client, preferably in writing. The cost must be actual, reasonable, and nonduplicative. If a periodic subscription cannot be tied to the matter, it belongs in overhead, not a prorated client charge. Alternative fees may share efficiency gains but must comply with applicable rules and agreements.
6Communicate and advertise without creating a new problem
AI-generated client communications, website chatbots, intake systems, marketing copy, images, and videos remain the firm’s communications. The firm remains responsible for misleading claims, invented credentials, false comparisons, bad advice, and communications that create a mistaken impression about who, or what, is responding.
Opinion 24-1 says a generative AI chatbot communicating with clients or third parties must include a disclaimer: it is an AI program, not a lawyer or firm employee. It should avoid legal advice, warn visitors before sensitive facts are submitted, route legal questions to a lawyer, and never imply representation. Comparative AI claims require objective verification.
Client Consent: Avoid Both Blanket Answers
One blanket answer says, “We need consent every time a lawyer touches AI.” The other says, “Our terms protect the data, so consent never matters.” Neither is a sound operating rule.
Opinion 24-1 recommends obtaining an affected client’s informed consent before using a third-party generative AI program when the use would disclose confidential information. It also says consent is not required under Rule 4-1.6 when no confidential information is disclosed to a third party. The real analysis turns on the information, the system, the terms, the purpose, the risk, the client’s expectations, and any applicable exception.
Questions to answer before deciding
- Will any information relating to a client’s representation be disclosed outside the firm?
- What specific product, plan, configuration, and contract will process it?
- Is disclosure otherwise permitted, and is it reasonably necessary for the representation?
- What would the client reasonably expect the firm to handle personally or within existing providers?
- What material risks, benefits, limits, and alternatives would the client need to understand?
- Should the consent or disclosure be matter-specific rather than buried in general engagement language?
A generic paragraph in every engagement letter may help communicate firm practices. It does not decide whether informed consent is adequate for a particular tool, data set, or use. Consent is a decision process, not a magic eraser.
Before You Paste: A Five-Question Gate
- Is the tool approved? Identify the exact product, account plan, workspace, and settings, not just the brand.
- Is the information allowed? Classify the material before uploading or pasting it.
- Is the task appropriate? Decide whether AI may assist with this step and what it may not decide.
- Who will review it? Name the lawyer or trained reviewer and the sources that must be checked.
- What record will remain? Save the final work, sources, material corrections, and any required approval, not every casual experiment.
If the team cannot answer all five, stop. The answer is not necessarily “never.” It is “not yet.”
A Practical Data-Handling Framework
The categories below are operating aids, not legal classifications. They help a small firm make consistent decisions before someone uploads a document because a demo looked impressive.
| Working category | Typical examples | Operating rule |
|---|---|---|
| Public or fictional | Published statutes, public court opinions, firm website copy, fictional matters, blank forms. | Usually the best starting point. Still verify output and respect copyright, court, and advertising rules. |
| Internal, non-client | Firm procedures, generic checklists, training notes, internal templates with no client facts. | Use only in approved tools. Protect proprietary information and confirm no client material is embedded. |
| Client-confidential | Matter facts, communications, documents, strategy, intake information, billing records. | Do not use until the exact system and use are approved, confidentiality is addressed, and consent or disclosure is analyzed. |
| Restricted or high-impact | Credentials, wire instructions, trust data, highly sensitive personal data, privileged strategy, minors’ information. | Apply stricter controls or prohibit the use. Never let AI execute transactions, make final legal decisions, or bypass established security procedures. |
Where to Start and Where to Stop
Low-risk pilots
Start with public, fictional, or carefully constructed test material. The point is to learn the workflow before client information raises the stakes.
- Turn public CLE notes into an internal outline, then check it against the source.
- Create a generic checklist from a blank form or published procedure.
- Rewrite public website copy for clarity, subject to lawyer and advertising review.
- Test an intake-summary format using a fictional client and matter.
- Draft a meeting agenda or internal training exercise from non-client material.
- Compare two public versions of a rule or policy and verify every stated change.
Controlled client-work uses
After the firm approves the system, information, task, and review process, AI may assist with work such as first-pass summaries, chronologies, issue lists, draft client updates, document comparisons, recurring checklists, and controlled first drafts. “Assist” is doing work here. The output still needs a named reviewer and source-based verification.
Hard stops
- Do not put client information into a public, personal, trial, or otherwise unapproved account.
- Do not let AI deliver final legal advice or communicate it to a client without lawyer review.
- Do not trust a citation, quotation, deadline, calculation, or legal conclusion because it looks polished.
- Do not delegate privilege decisions, settlement authority, conflicts analysis, signature authority, or wire instructions.
- Do not let a chatbot imply that it is a lawyer or that representation has begun.
- Do not automate a workflow the firm does not understand well enough to check.
Florida Court Filings: The Signature Now Says More
Effective June 15, 2026, Florida Rule of General Practice and Judicial Administration 2.515(d)(2) provides that, on filing, each signer represents that the legal authorities identified “exist and are accurately cited.” The rule applies whether AI was used or not.
After notice and an opportunity to be heard, a court may impose sanctions for a filing inconsistent with the representation. The listed sanctions include reprimand, contempt, striking the document, dismissal, costs, attorneys’ fees, or other sanctions. A companion administrative order replaced the prior patchwork of circuit-level AI disclosure and certification requirements with this statewide rule.
AI disclosure is not the statewide test. Citation accuracy is.
The signer owns the filing. Build a verification record that works regardless of how the research or draft was produced.
- Open every authority in an authoritative legal source.
- Confirm the case, statute, rule, quotation, proposition, and pinpoint citation.
- Use a current citator and check later history or amendments.
- Compare record statements with the actual record.
- Have the responsible lawyer approve the final filing.
A Six-Step Verification Workflow
- Identify every checkable claim. Mark facts, quotations, authorities, dates, calculations, names, and procedural statements.
- Open the source. Do not rely on the AI’s excerpt or link description.
- Confirm meaning and context. Read enough surrounding material to know the source supports the statement.
- Check currency. Use the firm’s authoritative citator and current official sources.
- Correct the work. Fix the statement, not merely the citation format.
- Record final approval. Preserve the reviewed document and the firm’s normal source or research record.
Primary authority: Florida Rule 2.515 (current rules PDF) and Florida Supreme Court Administrative Order AOSC26-12.
Vendor Review: The Product Name Is Not the Answer
A firm can make a careful decision about one plan and a careless decision about another plan sold under the same brand. Review the product, account tier, contract, configuration, data flow, proposed use, and people who will have access. The Vendor AI and Data Governance Audit and the AI Vendor Evaluation Worksheet turn this into a repeatable process.
Ten questions worth asking in writing
- Will the vendor use customer inputs, files, or outputs to train or improve any model?
- What information is retained, for how long, and can retention be limited or disabled?
- Can vendor personnel or outside reviewers access customer content, and for what purposes?
- Where is information processed and stored, and which subcontractors receive it?
- What contractual confidentiality, security, and breach-notification obligations apply?
- What administrative controls, access logs, permissions, and authentication options exist?
- Can the firm export and permanently delete its information when the matter or subscription ends?
- Who owns the inputs and outputs, and what rights does the vendor claim?
- How will the firm learn about changes to AI features, terms, retention, or data use?
- Can the firm document an approval, restrictions, permitted data, responsible owner, and review date?
Use the AI Vendor Evaluation Worksheet for the first gate. Use the Vendor AI & Data Governance Audit when the vendor may touch client documents, email, intake, billing, financial, medical, or other sensitive information.
The Minimum Operating Controls for a Small Firm
You do not need a policy written for a global bank. You need rules short enough to use and specific enough to stop a bad decision.
- Name one owner. Give a partner or senior administrator responsibility for approvals, restrictions, training, and review dates.
- Inventory current use. Ask lawyers and staff which AI features, accounts, browser tools, notetakers, and add-ons they use.
- Keep an approved-tool register. Record the product, plan, settings, owner, allowed data, allowed tasks, restrictions, and next review.
- Adopt data rules. Tell the team what may enter each approved system and what may not.
- Define permitted uses and hard stops. Approval of a product is not approval of every task.
- Set review standards. Match the reviewer and verification steps to the consequence of error.
- Create a consent and disclosure protocol. Identify who decides, what is explained, and where the decision is recorded.
- Write the billing rule. Record actual time and actual, reasonable, nonduplicative costs.
- Prepare for incidents. Stop the use, preserve relevant information, assess exposure, correct external work, make required notifications, and document the response.
- Train and revisit. Train at onboarding and whenever an approved tool, material term, rule, or workflow changes.
Approved does not mean anything goes.
Every approval should state the exact plan, permitted users, allowed information, allowed tasks, required review, restrictions, owner, and next review date. A green checkmark without conditions becomes a permission slip no one intended to sign.
A 30-Day Plan That a Small Firm Can Finish
Week 1: Find the use already happening
- Ask lawyers and staff which AI tools and embedded features they use.
- List the account plan, owner, purpose, information used, and whether client work is involved.
- Pause client-data use in any tool the firm cannot identify or evaluate.
- Collect contracts, privacy terms, AI terms, security materials, and administrator settings.
Week 2: Make the first decisions
- Name the policy owner and decision-makers.
- Adopt the data categories and initial hard stops.
- Approve, restrict, pause, or reject each current tool.
- Choose one low-risk workflow with a clear baseline and reviewer.
Week 3: Test the workflow
- Use fictional or otherwise approved material before client information.
- Test common, difficult, ambiguous, and deliberately flawed inputs.
- Record errors, omissions, review time, and corrections, not just the best result.
- Train the people who will perform and review the work.
Week 4: Put one controlled workflow into service
- Finalize the written steps, approved inputs, hard stops, and review checklist.
- Decide where the final work and verification record belong.
- Measure time, quality, rework, adoption, and client impact against the baseline.
- Schedule a review in 60 to 90 days, or sooner if the product or rules change.
One working process beats a shelf of policies and a folder full of prompts. The firm is building a repeatable decision system, not trying to win a demo.
Eight practical resources. One sensible starting point.
Get the playbook after you submit. You will also receive occasional practical emails from Actionable AI. Unsubscribe anytime.
- Plain-English guide to Florida Bar Opinion 24-1
- Firm AI-readiness checklist
- Five workflows worth testing first
- AI tool-approval scorecard
- Daily lawyer verification checklist
- Sample client language
- Incident-response protocol
- 90-day implementation outline
Frequently Asked Questions
May Florida lawyers use generative AI?
Yes. Opinion 24-1 says lawyers may use generative AI if they protect confidentiality, supervise its use, verify the work, charge proper fees and costs, and comply with other professional duties. The opinion is advisory and does not resolve every fact pattern.
Must a Florida lawyer tell every client about every use of AI?
Opinion 24-1 does not impose a blanket disclosure rule for every use. It recommends informed consent before using a third-party generative AI program when that use would disclose confidential information. The decision depends on the information, system, purpose, risks, client expectations, and applicable rules.
Can I upload client documents to ChatGPT, Copilot, Claude, Gemini, or another tool?
The brand name does not answer the question. Review the exact product, plan, contract, settings, retention, data use, access, security, and proposed workflow. Do not upload client information until the firm has approved that system and use.
Does paying for a business or enterprise plan make the tool ethically safe?
No. A paid plan may offer better contractual or administrative protections, but the firm still must review them, configure the system, restrict permitted data and tasks, train users, and verify output.
May staff use AI for client work?
Staff may assist within firm rules and supervision. The firm should approve the tool and task, define allowed information, train the user, require escalation, and identify the lawyer responsible for review.
May I use AI for legal research or drafting a court filing?
AI may assist, but the lawyer must independently verify every authority, quotation, proposition, factual statement, and record reference. Since June 15, 2026, every signer of a Florida court filing represents that cited legal authorities exist and are accurately cited.
Do Florida courts require a general disclosure that AI was used?
As of September 30, 2026, the statewide rule focuses on the signer’s representations, including citation accuracy, rather than a general AI-use disclosure. AOSC26-12 replaced circuit-level AI disclosure and certification requirements with amended Rule 2.515(d)(2). Always check current rules and case-specific orders before filing.
Can a lawyer bill the time a task used to take before AI?
No. Hourly billing should reflect time actually spent. Fees and costs must remain reasonable and nonduplicative. A subscription that cannot be tied to a particular matter generally belongs in overhead under Opinion 24-1.
What should a firm do if lawyers and staff are already using unapproved tools?
Inventory the current use without turning the exercise into a disciplinary ambush. Pause client-data use in unknown systems, collect the terms and settings, evaluate each workflow, approve or restrict it in writing, and train the team on the decision.
Where should a small firm start?
Start with one recurring, low-risk task using public or fictional material. Define the input, output, reviewer, verification steps, success measure, and hard stops. Then decide whether the workflow is good enough to move into controlled client work.
Pick one recurring workflow that wastes time.
We will discuss what the firm already owns, what information the workflow uses, where lawyer review belongs, and whether AI is actually the right answer.
No sales presentation. No obligation. No demo from a man wearing a headset.
About Greg Yates
Greg Yates is the founder of Actionable AI and a former Big Law corporate equity partner at Steptoe (NYC Managing Partner) and Seyfarth Shaw. He helps Florida law firms with fewer than 25 lawyers improve recurring work using AI capabilities in software they may already own. He is independent, does not sell software, and will say when AI is not the answer.
Learn more about Greg, browse the Florida AI Guides, or review Actionable AI services.
Primary Authorities and Further Guidance
- Florida Bar Ethics Opinion 24-1: Generative AI, confidentiality, oversight, fees, and advertising.
- Rules Regulating The Florida Bar: Current professional-conduct rules and updates.
- Florida Bar Ethics Opinion 12-3: Cloud services, provider diligence, security, confidentiality, and access.
- Florida Rule of General Practice and Judicial Administration 2.515: Current rule text, including the 2026 citation-accuracy amendment.
- Florida Supreme Court Administrative Order AOSC26-12: Statewide treatment of AI disclosure and certification requirements.
- ABA Formal Opinion 512: Additional ethics guidance on generative AI tools.