Before your firm buys another AI tool, make it answer a few uncomfortable questions.
A practical approval worksheet for small law firms that want the benefits of AI without turning client data into a science experiment.
Review criteria are grounded in Florida Bar Ethics Opinion 24-1, the NIST AI Risk Management Framework, and OWASP guidance for LLM applications.
The AI vendor demo is always beautiful. The answers are fast. The dashboard glows. Someone says “efficiency” three times and suddenly the managing partner is reaching for a credit card.
Slow down. Shiny software is not an AI policy. A sales deck is not a confidentiality review. And “enterprise-grade” is not a legal answer. That phrase has done more cardio than most lawyers.
AI tools are walking into law firms through the side door.
Not usually through a formal technology committee. Not after a careful vendor review. Not after someone reads the contract, checks the data policy, tests the output, and decides what client information can safely go where. Proof Before Purchase shows how to test a tool before you pay for it.
They arrive because a lawyer heard about a tool on LinkedIn. A paralegal tried something that saved twenty minutes. A practice group wants a faster way to summarize documents. None of that is wrong.
But in a law firm, “it worked once” is not the standard.
For the fuller review process, use the Vendor AI & Data Governance Audit Playbook.
This worksheet gives your firm a simple gate before approval.
The AI Vendor Evaluation Worksheet is designed to help small law firms decide whether a new AI tool should be approved, restricted, piloted, or rejected.
It is not a 90-page procurement memo written by someone who bills by the fog machine. It is a working document your firm can actually use.
Vendor identity
Track the product, evaluator, practice area, proposed use cases, and approved data tiers before the tool becomes part of daily work.
Contract basics
Check for no-training-on-customer-data terms, a signed DPA, deletion rights, breach notice, and sensitive-data handling.
Data classification
Decide whether the tool is approved only for public information, anonymized facts, client identifiers, or higher-sensitivity matter data.
Output testing
Run anonymized practice-area prompts and test the tool for legal accuracy, citation reliability, procedural currency, and verifiability.
Adoption and cost
Ask whether lawyers and staff will actually use it, what it costs, and whether the firm has run a limited pilot before signing.
Final decision
Document approval, restrictions, data tiers, next review date, and AI Policy Supervisor sign-off.
Use it before the firm approves any AI tool for client matters.
This is especially useful when the tool may touch intake notes, client communications, pleadings, discovery, contracts, financial information, medical records, settlement terms, or anything else that would make your malpractice carrier sit up straighter.
- Evaluate tools before lawyers and staff start using them informally.
- Create a repeatable approval process instead of one-off judgment calls.
- Separate low-risk public uses from higher-risk client-data uses.
- Force the vendor contract questions that usually get skipped.
- Make output verification part of the approval process, not an afterthought.
- Document restrictions so “approved” does not become “anything goes.”
Which level of help fits? This worksheet is a first-pass gate for one proposed tool. If several vendors or client-data flows are involved, use the full vendor audit packet. If the firm needs a prioritized plan across its tools and workflows, see the AI Workflow Assessment.
The goal is not to scare your firm away from AI.
The goal is to stop treating every AI tool like it belongs in the same bucket. Some tools are fine for public marketing research. Some may be useful for anonymized drafting. Some should never see sensitive client matter data. The worksheet helps your firm draw that line before the line draws itself.
The four questions your firm should answer before approval.
Every AI vendor conversation should eventually come back to these questions. For a fuller evidence file, use the Vendor AI and Data Governance Audit.
- Does this tool have a contractual no-training-on-your-data clause?
- Where does client data go, and who can access it?
- Can a lawyer verify the output before it reaches a client or a court?
- Would you be comfortable if the Florida Bar, the judge, or the counterparty knew you used this tool for this purpose?
If the answer is “I think so,” that is not an answer. That is a shrug in a blazer.
Get the AI Vendor Evaluation Worksheet.
Use it before approving any new AI tool for client matters. Give it to the managing partner, administrator, practice head, or person responsible for tool approval.
Free PDF. No email required.
Download the Worksheet
Get the practical approval checklist for evaluating AI vendors before they touch client work.