AI for Law Firms: How to Use AI Without Privileged Files Leaving Your Office

If you search "best AI for lawyers," you will find dozens of confident rankings of drafting assistants, research engines, and chatbots. Read closely and you will notice something: the duty that actually decides whether a lawyer can use any of these tools — client confidentiality — usually gets a single sentence, or none at all. That is our editorial read of the genre, not a ranking claim: the how-to-pick-AI-for-lawyers cluster is written to sell software, and confidentiality is the part that complicates the sale. So we will start where those guides stop.

The short answer: you can use AI in a law firm without a single privileged file leaving your office, but only if you decide before you type where each piece of text is allowed to go. The binding duty is Model Rule 1.6 confidentiality, and the ABA's first formal ethics opinion on generative AI is explicit that inputting client information into the wrong tool can breach it. There are three defensible setups — sort your usage, use an enterprise tier with the terms actually read, or run the model on hardware you own — and the rest of this guide walks each one, with the governing documents linked at every claim.

What Duty Actually Governs AI Use in a Law Firm?

Not a vague "be careful." A specific, named rule. In July 2024 the American Bar Association issued Formal Opinion 512, "Generative Artificial Intelligence Tools" — its first formal guidance on the subject — and grounded it in Model Rule 1.6, the confidentiality rule. The opinion's core instruction is unambiguous: a client's "informed consent is required prior to inputting information relating to the representation into such a GAI tool" that could expose it (ABA Formal Opinion 512). In plain English — you cannot paste a client's matter into a tool that might disclose it and sort out the ethics later. Consent comes first.

Opinion 512 explains why the tool matters so much. With self-learning systems, the ABA warns, information relating to one client's representation can be "later revealed in response to prompts by lawyers working on other matters, who then share that output with other clients, file it with the court, or otherwise disclose it" — and it cautions that such a tool "may disclose information relating to the representation to persons outside the firm who are using the same GAI tool." So the ABA places a second duty on top of consent: "all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use" to learn who has access to what they type. And under Model Rule 1.1 (competence), a lawyer must have a reasonable understanding of the tool's capabilities and limitations. Reading the ad copy is not enough; you have to understand the plumbing.

State bars are converging on the same shape. The State Bar of California's Practical Guidance for the Use of Generative AI — revised in 2026 at the California Supreme Court's request, and now addressing agentic AI — draws a bright line: "a lawyer must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent... as to the underlying risks." And it forecloses the shortcut of trusting a vendor's marketing: meeting the duty, it says, requires "more than reliance on generalized marketing assurances." Two authorities, one instruction: the duty attaches to the disclosure itself, and you own the homework of knowing where your text goes.

Lawyers say the same thing to each other, more bluntly. u/imangryignoreme wrote: "Reminder that giving client information to chatGPT is a violation of attorney-client privilege! DON'T DO THIS unless you're excited to meet your bar ethics committee." (No lawyer is known to have actually been disciplined over this — the fear is anticipated, not realized. But the rule it points at is real.)

Option 1 — Can You Use Consumer AI at All? Only for Non-Confidential Work

The cheapest setup is also the most misunderstood. Consumer ChatGPT is not banned for lawyers; it is banned for client confidences. The failure mode is not "using ChatGPT" — it is unsorted use, where privileged and harmless text flow through the same chat window with nobody deciding which is which.

So decide. Public legal research, rewriting your own firm's website copy, drafting a marketing email, brainstorming an argument in the abstract with no client facts — all of that carries no confidentiality problem because nothing confidential is in it. For that pile, a consumer plan is genuinely fine.

The reason it stays a pile and not a free-for-all is the default. OpenAI's own help documentation is clear that on consumer services like ChatGPT, it may use your content to train its models unless you opt out via Data Controls (OpenAI Help). That default is exactly the "self-learning" exposure ABA 512 warns about. Opting out helps, but it does not turn a consumer plan into a tool you can pour privileged files into — and it does not give you the read-the-contract posture both bars require. Sorting works only if the line holds every single time, under deadline, for every person in the office. That is harder than it sounds, which is why the other two options exist.

Option 2 — Is an Enterprise Tier Enough? Only With the Terms Actually Read

The standard "grown-up" answer is to move confidential work onto a business or enterprise tier and rely on a contract. This is legitimate — both the ABA and California explicitly contemplate cloud tools whose terms you have vetted. The key is that the defaults change.

OpenAI states plainly for its business products: "We do not train our models on your data by default," and that customers "retain all rights to the inputs" and own the outputs (OpenAI enterprise privacy). Retention is administrator-controlled on ChatGPT Enterprise; on ChatGPT Business, deleted or unsaved conversations are removed within 30 days unless the law requires longer; API inputs and outputs may be retained up to 30 days. That is a materially different posture from the consumer default — no training on your data, and retention you can reason about.

But note what the enterprise tier does not do: it does not remove the vendor from the chain. Your text still lives, for some period, on someone else's machines, under terms you are now obligated to read and understand — not skim. California's warning about "generalized marketing assurances" is aimed precisely here. The route is defensible, but it is defensible because you did the reading, obtained any required client consent, and can explain the data flow — not because a sales page said "secure."

Option 3 — What If Privileged Files Should Never Leave? Keep Them on Hardware You Own

The third option removes the vendor question by removing the vendor. Local AI means the model runs on a computer your firm owns — a desktop in your office instead of a provider's data centre — using free software such as Ollama, which describes itself as "the easiest way to build with open models." Downloaded once, an open model processes your text on your own machine; run it with the network off and the file never leaves the building. (For the full mental model, see What Is Local AI? and the side-by-side in Local AI vs Cloud AI.)

For a firm, the ethics math simplifies dramatically. There is no Terms of Use to vet, because there is no third party. There is no training default to toggle, no retention policy to monitor, no outside processor for a subpoena to land on. What remains is the part your firm already knows how to do: control who can log into the machine, keep backups, and supervise the AI's output the way you would a junior associate's. It is the setup u/JohnnyLovesData, a trial lawyer, was pointing at on r/LawFirm: "Yes, sharing that information with ChatGPT (OpenAI), is not a good idea. Using your own self-hosted language model would be better."

How Do the Three Options Compare?

	Consumer AI (sorted use)	Enterprise / business tier	Local AI (your own hardware)
Who receives the file	OpenAI's servers	The vendor's servers, under a contract	No one — it stays on your machine
Training on your data	May be used unless you opt out (OpenAI Help)	Not by default (OpenAI enterprise)	Nothing is sent when run offline
Terms you must read	Yes, and they favor the consumer default	Yes — the ABA/Cal Bar homework lives here	None — there is no vendor
OK for privileged files?	No	Only with terms read + client consent where required	Yes — no third-party disclosure
Up-front cost	$0–$20/user/mo	Per-seat, quote-based	Hardware: a capable Mac mini configured with extra memory (the base model starts around $799), up to ~$1,599 for M4 Pro headroom
Capability ceiling	Highest (frontier models)	Highest	A step behind the frontier, but strong for drafting, summarizing, document Q&A
What you still owe	Sorting discipline, competence	Contract review, consent, competence	Access control, backups, supervising output

The table stops short of two claims on purpose. It does not say local is the cheaper path for every firm — a solo practitioner or two-lawyer shop will usually pay less on a subscription than on a machine, and the cost guide and worksheet run that arithmetic for your own head-count. And it does not say an open model matches a frontier model on the hardest legal reasoning — for a knotty appellate brief, the cloud is still sharper. Custody is the one column where local wins outright. If your practice is HIPAA-adjacent — a personal-injury shop handling medical records, say — the same custody logic drives our ChatGPT and HIPAA guide, and the full options comparison lays every route side by side.

So What Should a Small Firm Actually Do?

Start by sorting, because you have to anyway: the ABA requires you to know which work carries client confidences before any of it touches a tool. Put the public, no-client-facts work on a cheap consumer plan and stop worrying about it. For the confidential pile, pick your lane deliberately — an enterprise tier whose contract you have genuinely read and can explain, or a model on hardware you own for the files you would rather never send anywhere. Many firms do both.

Be honest about the cost of the local lane: a machine to buy, a machine to maintain, and a model a notch below the frontier on the hardest reasoning. What you buy for that price is the disappearance of a question — for a privileged file, "what is this vendor doing with our client's matter?" simply stops being askable, because no vendor ever received it. That is the one confidentiality safeguard no Terms of Use can revoke and no subpoena aimed at a third party can reach: the file never left your office. Bar-confidentiality duties are worded differently in every jurisdiction — Model Rule 1.6 in the United States, its equivalents wherever you practise — but the custody logic underneath them is the same everywhere, because it turns on where the file physically sits, not on which regulator you answer to. Whether the trade is worth it depends on how much of your daily work touches privileged material, which is exactly what the readiness quiz estimates in two minutes.