Defense Counsel Journal
Emerging Artificial Intelligence Risk Management Considerations for Law Firms
Volume 91, No. 3
October 10, 2024
Mark J. Fucile
Mark J. Fucile
IADC member Mark Fucile of Fucile & Reising LLP in Portland advises lawyers, law firms, and legal departments throughout the Pacific Northwest on professional responsibility and risk management. Before co-founding his current firm in 2005, Mark served as an in-house ethics counsel for a large Northwest regional law firm. Mark also teaches legal ethics as an adjunct for the University of Oregon School of Law at its Portland campus.
“As we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say, we know there are some things we do not know. But there are also unknown unknowns—the ones we don’t know, we don’t know.”
Donald Rumsfeld, Feb. 12, 2002, United States Secretary of Defense1https://www.youtube.com/watch?v=REWeBzGuzCc.
Artificial intelligence—“AI”—has long been predicted to fundamentally reshape the legal profession.2See generally Anthony E. Davis, The Future of Law Firms (and Lawyers) in the Age of Artificial Intelligence, 27 Prof. Lawyer 3 (2020).
Although AI has existed in various forms for some time,3Id. at 4-5 (describing early applications in law practice).
the public perception of AI changed notably with the release of ChatGPT in late 2022.4See, for example, Kevin Roose, The Brilliance and Weirdness of ChatGPT, N.Y. Times, (Dec. 5, 2022) (available at https://www.nytimes.com/2022/12/05/technology/chatgpt-ai-twitter.html).
The use—and the emerging risks—of AI in law practice were underscored soon after when a lawyer and his law firm were sanctioned by a federal court in New York for using ChatGPT to write a brief that included citations to non-existent cases generated by the “chatbot.”5See Benjamin Weisner and Nate Schweber, The ChatGPT Lawyer Explains Himself, N.Y. Times, (June 8, 2023) (available at https://www.nytimes.com/2023/06/08/nyregion/lawyer-chatgpt-sanctions.html); Mata v. Avianca, Inc., 678 F. Supp.3d 443 (S.D.N.Y. 2023) (hereinafter, “Mata”).
The increasing public notoriety of AI has spawned a wide spectrum of studies examining its potential impacts generally6See, for example, White House Office of Science and Technology, Blueprint for an AI Bill of Rights, (available at https://www.whitehouse.gov/ostp/ai-bill-of-rights/); European Commission, European Approach to Artificial Intelligence (available at https://digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence).
and on the delivery of legal services in particular.7See, for example, ABA Task Force on Law and Artificial Intelligence (available at https://www.americanbar.org/groups/leadership/office_of_the_president/artificial-intelligence/).
The guidance offered to lawyers and law firms thus far is comparatively general, because many advanced AI-enabled tools—“AI tools” for short—are just entering practice.8See, for example, ABA Formal Op. 24-512 (2024); State Bar of Cal., Standing Comm. on Pro. Resp. & Conduct, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (Nov. 16, 2023); D.C. Bar, Ethics Op. 388 (2024); N.Y. State Bar, Report and Recommendation of the New York State Bar Association Task Force on Artificial Intelligence (2024).
In that sense, the guidance to date echoes the opening quote from Donald Rumsfeld: it addresses “known knowns” and “known unknowns,” rather than “unknown unknowns.” With that qualifier, this article will summarize the emerging risk management considerations for law firms using AI tools as they exist today. For purposes of this article, “AI tools” are defined broadly to include products and services that are both “stand alone” and those enhanced through the incorporation of AI.9There is not a single definition of AI. Here, the term is intended to reflect both older “machine learning” that analyzes data and “generative” AI that creates new data. See generally Adam Zewe, Explained: Generative AI, MIT News, (Nov. 9, 2023) (discussing history and terminology of AI) (available at https://news.mit.edu/2023/explained-generative-ai-1109).
Because the ABA Model Rules of Professional Conduct offer a useful organizing structure for analysis,10All 50 states and the District of Columbia now have professional regulations based on the ABA Model Rules. See https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/alpha_list_state_adopting_model_rules/.
this article will survey law firm risk management considerations when using AI tools in three principal areas: (1) competence under Model Rule 1.1; (2) confidentiality under Model Rule 1.6; and (3) billing under Model Rule 1.5. Although the ABA Model Rules are primarily a model regulatory code enforced through state-adopted rules of professional conduct, they also broadly reflect the standard of care and fiduciary duties that are enforced through civil litigation against law firms.11See generally Ronald E. Mallen, Legal Malpractice, chs. 20 (standard of care), 15 (fiduciary duties) (rev. ed. 2021).
Before proceeding, however, three caveats are in order.
First, this survey of these three areas should not suggest that they represent an exclusive list. Rather, these are simply some of the more common areas that lawyers and their law firms are grappling with at this point.12See, for example, Florida Bar Op. 24-1 at 7 (2024) (discussing use of AI-enabled “chatbots” in client intake and related marketing); DC Bar Ethics Op. 388, supra note 8, at 15-17 (addressing considerations for candor toward tribunals when using AI-enabled tools in court-filed documents).
Supervision of both lawyers and staff under, respectively, ABA Model Rules 5.1 and 5.3 will be integrated into the discussion of the principal areas examined rather than addressed as a separate topic.13At least as the ABA Model Rules are currently written, “nonlawyer assistants” means humans rather than “virtual” assistants. See generally ABA Formal Op. 23-506 (2023) (addressing lawyer responsibility for nonlawyer assistants).
That said, while individual lawyers face disciplinary risk, their firms share the risk of sanctions and civil damages for failures in the areas surveyed.14See People v. Crabill, 23-PJD067, 2023 WL 8111898 (Colo. Nov. 22, 2023) (unpublished) (lawyer disciplined for including cites to non-existent cases generated by ChatGPT in motion); Mata, supra note 5, at 443 (firm sanctioned along with firm lawyers for including citations to non-existent cases in briefing).
Second, although the focus here is on law firms, AI may reshape other areas in the delivery of legal services—particularly for those who do not currently have ready access to lawyers as they navigate the legal system pro se.15See generally ABA Task Force on Law and Artificial Intelligence, AI and Access to Justice (compiling resources) (available at https://www.americanbar.org/groups/centers_commissions/center-for-innovation/artificial-intelligence/access-to-justice/).
Third, other areas of substantive law—such as copyright—may enter the mix depending on the particular tasks involved.16See, for example, Congressional Research Service, Generative Artificial Intelligence and Copyright Law (Sept. 19, 2023) (surveying issues); United States Copyright Office, Copyright and Artificial Intelligence (available at www.copyright.gov/ai/) (same).
These other areas may be one of the principal sources of “unknown unknowns” as AI influences—or replaces—tasks now commonly performed by humans in law firms.17See generally State Bar of Texas Taskforce for Responsible AI in the Law, Interim Report to the State Bar of Texas Board of Directors (2024) (available at https://www.texasbar.com/AM/Template.cfm?Section=Meeting_Agendas_and_Minutes&Template=/CM/ContentDisplay.cfm&ContentID=62597) (surveying potential interface of AI and several substantive legal areas).
I. Competence
ABA Model Rule 1.1 sets the benchmark for competence:
A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.
Comment 8 to Model Rule 1.1 notes that this includes technological competence:
To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology[.]18The comment on maintaining competence was amended to include technology in 2012. See ABA, A Legislative History: The Development of the ABA Model Rules of Professional Conduct, 1982-2013, 42-43 (2013) (detailing history).
Two early cases involving ChatGPT that drew national media attention illustrate the point that a lawyer using technology will be held responsible for understanding it.
The first resulted in sanctions against both the lawyer and the lawyer’s law firm. Mata v. Avianca, Inc.19678 F. Supp.3d 443 (S.D.N.Y. 2023).
involved an experienced personal injury lawyer navigating what for him was unfamiliar procedural terrain. The lawyer’s client had been injured on an international airline flight inbound to New York City. The lawyer filed a personal injury claim in state court, but the defendant airline removed the case to federal court and moved to dismiss the claim as time-barred under the Montreal Convention governing claims arising on international flights. The lawyer was not familiar with the Montreal Convention but had heard through friends and family of a new “super search engine”—ChatGPT. He used the chatbot to first research the Montreal Convention and later to produce a brief that included multiple case citations that seemed directly on point. Significantly, the lawyer did not check the citations himself. Even more significantly, the citations were to non-existent cases that the chatbot had simply invented. Because the lawyer was not admitted in federal court, he had his partner sign and file the response. His partner didn’t check the cites either. When the court discovered that the citations were to non-existent cases, it sanctioned both lawyers and their law firm.
The second resulted in discipline. People v. Crabill2023-PJD067, 2023 WL 8111898 (Colo. Nov. 22, 2023) (unpublished).
involved a junior associate at a law firm assigned to prepare a motion to set aside a civil judgment for a client on a tight budget. The associate had not handled that kind of motion before and had just heard of ChatGPT. He used the chatbot to both research the issues and write the brief. Like the lawyer in Mata, the associate did not check the citations generated by ChatGPT. Again like Mata, the chatbot made up citations. When the situation came to light, the associate was disciplined under, in relevant part, Colorado Rule of Professional Conduct 1.1. According to media reports, he also lost his job.21Clayton Sandell, Attorney Fired for Using AI Is Turning a Negative into a Positive, Scripps News (Apr. 30, 2024) (available at https://www.scrippsnews.com/science-and-tech/artificial-intelligence/attorney-fired-for-using-ai-is-turning-a-negative-into-a-positive).
Mata and Crabill, in many respects, are technology-enabled versions the apocryphal lawyer of an earlier generation who read the headnotes in a paper reporter, but not the cases themselves, before including them in a brief. As Chief Justice Roberts observed about Mata in his 2023 Year End on the Federal Judiciary, not confirming citations is “[a]lways a bad idea.”22United States Supreme Court, 2023 Year-End Report on the Federal Judiciary, 6 (2023) (available at https://www.supremecourt.gov/publicinfo/year-end/2023year-endreport.pdf).
In that sense, Mata and Crabill may say more about human nature than they do about technology.
For lawyers and their law firms, however, Mata and Crabill underscore the very real consequences of not understanding technology before using it. Given that human dimension, use of AI tools in law practice suggests drawing on three core law firm risk management approaches developed during earlier eras of significant technological change.23See generally ABA Formal Ops. 99-413 (1999) (electronic communications), 17-477R (2017) (electronic data storage and transmission), 18-483 (2018) (cybersecurity threats). ABA Model Rules 5.1(a) and 5.3(a) impose duties on law firm managers to create an ethical infrastructure within law firms.
First, firms should evaluate AI tools before using them. In some instances, review can be performed by internal technology staff. In others, firms may need to consult with outside resources to gauge the benefits, risks, and potential uses of emerging AI tools. As will be discussed further in the next section, any external review should include a careful review of any applicable contractual assurances of confidentiality—or the lack of such assurances. Further, given the rapid technological evolution in this area, “review” should be an ongoing process as the technology, and associated risks, will undoubtedly change over time.
Second, firms should set clear policies for the use of AI tools. Firm lawyers and staff should not be left to guess which AI tools are—or are not—permitted. As with other technology policies, the advent of hybrid models where lawyers and staff work part-time in home offices rather than full-time in “brick and mortar” offices has sharpened the premium on clear guidance.24See generally ABA Formal Op. 21-498 (2021) (addresses “virtual” practice). See also ABA Formal Op. 20-495 (2020) (remote work).
Third, firms should train lawyers and staff on the benefits and risks of AI tools before using them on firm work. Although particular training will vary with the tool and the law firm involved, law firms will typically bear the financial cost of misuse of technology that results in client harm. While that risk cannot be completely eliminated through training, it can be reduced through reasonable steps.
These three approaches do not encompass the universe. Competence in this context, for example, also includes knowing and following any applicable court rules on the use or disclosure of AI tools.25For a compilation of court rules and standing orders addressing AI, see https://guides.lib.uchicago.edu/AI/Practice.
Researching AI tools before using them, setting clear policies, and training lawyers and staff on their use, however, are all practical steps to managing risk in this rapidly developing area.
II. Confidentiality
ABA Model Rule 1.6(a) succinctly summarizes the bedrock duty of confidentiality: “A lawyer shall not reveal information relating to the representation of a client[.]”
The term “information relating to the representation” is broad and, under Comment 3 to the Rule, embraces the attorney-client privilege and work product along with principles of lawyer confidentiality drawn from professional ethics. Under ABA Model Rule 1.6(c), the duty of confidentiality also includes taking reasonable steps to prevent disclosure:
A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.
Comments 18 and 19 to ABA Model Rule 1.6 are subtitled “Acting Competently to Preserve Confidentiality” and weave competence into the duty of confidentiality. Given that complementary tie, it is not surprising that law firms have been held responsible for safeguarding client confidentiality when using technology.26See, for example, Guo Wengui v. Clark Hill, PLC, 440 F. Supp.3d 30 (D. D.C. 2020) (allowing claims for breach of fiduciary duty and legal malpractice to proceed involving data breach).
While not involved directly in the sanction the court entered, Mata also illustrates the confidentiality risks involved with at least some AI tools. In Mata, the lawyer used a “free” version of ChatGPT. Notwithstanding the fact that it includes a warning that information shared is not treated as confidential, the lawyer entered an increasingly specific series of search prompts that could have revealed client confidential information.27See Mata, supra note 5, at 456-457 (describing the lawyer’s search prompts).
In the same general vein, ABA Formal Opinion 498 on virtual practice cautioned that “smart speakers” can include an “always listening” feature (so they can respond to voice commands) that may share otherwise confidential conversations with the vendor.28ABA Formal Op. 21-498, supra note 24, at 6.
Although the Model Rules do not prohibit the use of general consumer-oriented products in law practice, the confidentiality considerations under ABA Model Rule 1.6 and state equivalents may introduce a constraint. Accuracy aside (which remains the duty of the lawyer to confirm), there is nothing necessarily wrong with using a consumer-oriented product like the “free” version of Chat GPT to research general information, just as there is nothing inherently wrong with using Google for the same purpose. The line of demarcation under Model Rule 1.6 is that a lawyer should not share client confidential information with a non-confidential technological medium. ABA Formal Opinion 498 recommends disabling the “always listening” function if a “smart speaker” is being used in a law practice setting.
With AI tools tailored to law practice, appropriate use often turns on their contractual assurance of confidentiality consistent with lawyers’ duties under ABA Model Rule 1.6. Conceptually, this is no different than the exercise firms should undertake when, for example, evaluating a cloud-based electronic file storage vendor.29See ABA Formal Op. 17-477R, supra note 23, (discussing cloud-based electronic file storage); see also Jill D. Rhodes, Robert S. Litt, and Paul S, Rosenzweig, eds., The ABA Cybersecurity Handbook, 273, 282-283 (3d ed. 2022) (discussing management of outside vendors of law firm technological services).
Although client consent would not ordinarily be required to use an AI tool that included a satisfactory contractual assurance of confidentiality, Comment 19 to Model Rule 1.6 notes that clients can request additional security measures. Therefore, firms need to take into consideration the sensitivity of the client information concerned when using technological tools—whether enhanced with AI or not.
III. Billing
Billing disputes are among the most intractable irritants in lawyer-client relationships. ABA Model Rule 1.5(a) sets the baseline for fees and expenses: A lawyer shall not make an agreement for, charge, or collect and unreasonable fee or an unreasonable amount for expenses. At least at this point, AI tools may raise billing issues in two distinct areas.
First, harkening back to the era when “computerized” legal research was new, some lawyers and law firms may be inclined to allocate the pro rata cost of AI tools to individual client bills as an itemized expense rather than simply incorporating those costs into overhead that is reflected in the firm’s hourly rates. Comment 1 to ABA Model Rule 1.5 generally permits expenses to be itemized in that way—provided the client agreed in advance and the amount allocated to an individual client is reasonable.30Comment 1 to Model Rule 1.5 reads, in relevant part:
A lawyer may seek reimbursement for the cost of services performed in-house, such as copying, or for other expenses incurred in-house, such as telephone charges, either by charging a reasonable amount to which the client has agreed in advance or by charging an amount that reasonably reflects the cost incurred by the lawyer.
See also ABA Formal Op. 93-379 (1993) (billing for expenses).
Particularly when AI is simply added to an existing tool that a law firm already treats as general overhead reflected in hourly rates—such as an AI-enhanced legal research service or an electronic case management platform—obtaining client consent to bill these instead as itemized expenses may be difficult on a practical level.31See ABA Formal Op. 11-458 (2011) (modification of fee agreements); see also Restatement (Third) of the Law Governing Lawyers § 18 (2000) (noting that fee agreements are largely governed by contract law).
Other clients may have corporate counsel guidelines that specify what they will—and will not—pay for as expenses.
Second, AI tools promise to make some billable tasks more efficient—either by taking less time or eliminating human involvement altogether. Lawyers may generally charge for the time spent using AI tools to accomplish an underlying task. For example, a lawyer would ordinarily be able to bill for the time creating research prompts for a given case in the same way the lawyer bills for doing other legal research. In fact, lawyers are expected to use reasonably available means that save clients’ money. For example, charging a client today for “Shepardizing” citations by hand would likely be considered unreasonable under Model Rule 1.5(a) now that more efficient electronic means are readily available.32See generally Absher Const. Co. v. Kent School Dist. No. 415, 917 P.2d 1086, 1090 (Wash. App. 1995) (“The use of computer-aided legal research is a norm in contemporary legal practice. Properly utilized, it saves the client attorney fees which would otherwise be incurred for more time-consuming methods of legal research.”).
By contrast, Model Rule 1.5(a) generally prohibits lawyers from charging for the “time saved” by using an AI tool because the time has not actually been incurred.33See generally American Bar Association, Annotated Model Rules of Professional Conduct, 96-98 (10th ed. 2023) (cataloging cases nationally involving charges for work not actually performed).
IV. Summing Up
Many aspects of AI tools becoming available today share risk management attributes similar to earlier waves of law practice technology. From the perspective of law firm risk management, these AI tools can likely be used “safely” by following practical steps developed during earlier eras of significant technological change: evaluating AI tools before using them, including contractual assurances of confidentiality; setting clear policies on their use; and training lawyers and staff on how to use them. Returning to the opening quote from former Secretary of Defense Rumsfeld, those risks are the “known knowns” and the “known unknowns.” To the extent AI tools promise at some point to substitute or replace lawyer professional judgment in whole or in part, however, those risks for now are in the realm of “unknown unknowns.”
View Article
Back