ABA Formal Opinion 512 is the American Bar Association’s first formal ethics opinion on lawyers’ use of generative AI, issued on July 29, 2024. This guide covers what the opinion asks of law firms using AI with client data: competence, confidentiality under Model Rule 1.6, communication with clients, supervision and reasonable fees. It then explains why the confidentiality and vendor-diligence sections point toward a private deployment as one documented data path for the firm’s own review.
The ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512 to apply the existing ABA Model Rules of Professional Conduct to generative AI tools, and the ABA announced it as its first ethics guidance on a lawyer’s use of AI tools. The headnote says lawyers using these tools “must fully consider their applicable ethical obligations, including their duties to provide competent legal representation, to protect client information, to communicate with clients, to supervise their employees and agents, to advance only meritorious claims and contentions, to ensure candor toward the tribunal, and to charge reasonable fees.”
The opinion is based on the Model Rules as amended through August 2023. Each lawyer is bound by the rules of the jurisdictions where they practice, and the opinion expects state and local bar ethics committees to add guidance as tools develop. This article is a planning summary and is not legal advice. The compliance call on any AI tool stays with the firm’s own ethics counsel.
What ABA Formal Opinion 512 Covers
The opinion addresses generative AI, which it describes as technology that can create “various types of new content,” including text, images, audio, video and software code, in response to a user’s prompts. Drafting assistants, research tools and chat interfaces all fall within it, and each duty turns on the facts: the client, the matter, the task and the tool. The opinion builds on earlier ABA technology opinions it cites, including Formal Opinion 477R (2017) on securing client communications and Formal Opinion 498 (2021) on virtual practice.
Competence Under Model Rule 1.1
On competence under Model Rule 1.1, the opinion is direct: “lawyers need not become GAI experts.” They must have “a reasonable understanding of the capabilities and limitations of the specific GAI technology that the lawyer might use.” The conclusion adds that technological competence “requires an understanding of the evolving nature of GAI.”
Competence also covers output. The opinion warns that “uncritical reliance on content created by a GAI tool can result in inaccurate legal advice to clients,” and it says the appropriate amount of independent verification or review “will necessarily depend on the GAI tool and the specific task that it performs.” A first-pass summary of a public filing needs a lighter check than a factual assertion headed for a brief.
Confidentiality and Client Data Under Model Rule 1.6
Confidentiality is the section that shapes architecture decisions. The duty under Model Rule 1.6 covers “all information relating to the representation of a client, regardless of its source,” and Rule 1.6(c) requires “reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” Applied to AI, the opinion says that before lawyers input client data into a GAI tool, “they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm.” That analysis “will be fact-driven and depend on the client, the matter, the task, and the GAI tool used to perform it.”
Self-learning tools and informed consent
The opinion singles out self-learning tools, which use what lawyers enter to shape later output. Because many of them “are designed so that their output could lead directly or indirectly to the disclosure of information relating to the representation of a client, a client’s informed consent is required prior to inputting information relating to the representation into such a GAI tool.” For consent to be informed, the client needs the lawyer’s best judgment on why the tool is being used, the specific risks, the kinds of client information involved and the tool’s benefits to the representation. The opinion adds that “merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient.”
Disclosure inside the firm
The risk analysis reaches inside the firm too. The opinion notes that information can be disclosed improperly “even if the tool is used exclusively by lawyers at the same firm,” for example when one client’s information surfaces in a response to a lawyer on another matter, or reaches someone behind an ethical wall.
Reading the vendor’s terms
At a minimum, the opinion says, “all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms” of the tools they use. It also notes that lawyers “may need to consult with IT professionals or cyber security experts” to understand those terms and policies.
Communication With Clients Under Model Rule 1.4
The opinion leaves disclosure largely to the facts: “The facts of each case will determine whether Model Rule 1.4 requires lawyers to disclose their GAI practices to clients or obtain their informed consent to use a particular GAI tool.” Lawyers “must disclose their GAI practices if asked by a client how they conducted their work, or whether GAI technologies were employed in doing so,” and they must also disclose when the engagement agreement or the client’s outside counsel guidelines require it. Consultation is also necessary when GAI output “will influence a significant decision in the representation.”
Candor, Meritorious Claims and Court Filings
Rules 3.1, 3.3 and 8.4(c) apply to anything AI helps produce for a court. The opinion says output “must be carefully reviewed to ensure that the assertions made to the court are not false,” and that duties to the tribunal require lawyers, before submitting materials to a court, “to review these outputs, including analysis and citations to authority, and to correct errors.” It notes that some courts require lawyers to disclose GAI use and tells lawyers to check the applicable court’s local rules.
Supervision, Training and a Law Firm AI Policy
Under Model Rules 5.1 and 5.3, “managerial lawyers must establish clear policies regarding the law firm’s permissible use of GAI,” and supervisory lawyers must make reasonable efforts to ensure that lawyers and nonlawyers comply. The opinion says training could include the basics of GAI technology, the capabilities and limitations of the tools, ethical issues and “best practices for secure data handling, privacy, and confidentiality.” A written law firm AI policy is the practical vehicle for both.
The section also carries the vendor-diligence duty. Drawing on earlier outsourcing opinions, it says lawyers must ensure that a third party “will do the work capably and protect the confidentiality of information relating to the representation,” and states that “these concepts also apply to GAI providers and tools.” The factors it lists are:
- reference checks and vendor credentials;
- the vendor’s security policies and protocols;
- the vendor’s hiring practices;
- confidentiality agreements;
- the vendor’s conflicts check system, to screen for adversity among firm clients;
- the availability of a legal forum for relief if the vendor agreement is breached.
The opinion also points lawyers to whether a tool is configured to preserve the confidentiality and security of information, whether that obligation is enforceable, whether the lawyer will be notified of a breach or of process seeking client information, and whether the provider retains submitted information or asserts proprietary rights to it.
Reasonable Fees Under Model Rule 1.5
Lawyers who bill hourly “must bill for their actual time,” which means the time the work took with the tool. On flat fees, if a tool lets a lawyer finish much faster, it “may be unreasonable” to charge the same flat fee as without it. A lawyer “may not charge a client to learn about how to use a GAI tool or service that the lawyer will regularly use for clients.” A tool that functions like equipping a practice counts as overhead, while the out-of-pocket cost of a third-party GAI service used on a matter can ordinarily be billed as an expense.
ABA Formal Opinion 512 Duties at a Glance
The table maps each duty to its rule, what the opinion asks and what a firm typically documents.
| Duty | Model Rule | What Opinion 512 asks | What a firm typically documents |
|---|---|---|---|
| Competence | 1.1 | A reasonable understanding of the tool’s capabilities and limitations; review of output scaled to the task | Approved tools, approved uses and the review level set for each task |
| Confidentiality | 1.6 | Evaluate disclosure and access risk before inputting client data; informed consent for self-learning tools | The data path for each tool, the vendor terms reviewed and consent records where needed |
| Communication | 1.4 | Disclose when asked, when the engagement or guidelines require it, or when output drives a significant decision | A client-facing AI statement and outside counsel guideline answers |
| Candor and meritorious claims | 3.1, 3.3, 8.4(c) | Review analysis and citations before filing; follow court rules on AI use | A citation-check step and a list of local rules on AI disclosure |
| Supervision | 5.1, 5.3 | Clear firm policies, training and diligence on GAI providers | A law firm AI policy, a training log and a vendor file |
| Fees | 1.5 | Bill actual time, keep flat fees reasonable, no charge for learning tools used regularly | Billing guidance for AI-assisted work |
Why Confidentiality and Vendor Diligence Point to a Private Deployment
Read together, the confidentiality and supervision sections give a firm a list of facts to establish for every AI tool: where client data goes, who can access it, whether the provider learns from it or keeps it, how a breach is reported and which agreement governs. For a hosted tool, the answers sit in the vendor’s terms, security documentation and contract, which the firm’s counsel evaluates.
A private deployment answers the same questions with facts the firm controls. The model, the index and the logs run inside the firm’s own tenant or on its own servers, and client data is processed on systems the firm’s IT team already manages. The models learn from client data only if the firm chooses to fine-tune them, and retention follows the firm’s own policy. That gives the firm one documented data path to describe in its Opinion 512 evaluation, in an outside counsel guideline questionnaire and in a conversation with the client.
The opinion’s other duties stay with the firm whichever architecture it picks. A private deployment still needs per-matter access controls that mirror ethical walls, because the opinion flags disclosure between matters inside the firm. Competence, output review scaled to the task, a written policy, training, accurate billing and client communication all still apply. The private deployment simplifies the evidence for the confidentiality analysis, and the firm’s counsel makes the compliance call.
Firms can start with a private ChatGPT for business deployment for general drafting and research, then extend the same infrastructure to matter work, such as AI for litigation covering chronologies, deposition summaries and drafting from the record.
How Law Firms Using AI Put Opinion 512 Into Practice
- Inventory the tools. List every AI tool in use, including AI features inside existing software, and where each one sends client data.
- Classify the work. Separate tasks that use client information from tasks that use only public material.
- Run vendor diligence. Apply the opinion’s factors to each provider and keep the file.
- Set review levels. Match verification to the task, with a full citation check on anything filed.
- Write the policy and train to it. Cover approved tools, consent, disclosure, review and billing.
- Revisit it. Recheck tools, vendor terms and state bar guidance on a schedule.
Mapping your Opinion 512 review to a data path the firm controls? NeuralChainAI deploys private AI for law firms inside your own tenant, with per-matter access and an audit log your counsel can review. Book a strategy session to scope it.
