Most law firm AI policies contain a section that looks roughly like this:
Attorneys shall not enter confidential client information into AI tools. Attorneys shall not file AI-generated content without verification. Attorneys shall not use unapproved tools.
Reasonable rules, clearly stated. And in practice, that section is where the policy starts to come apart — because it treats every rule as identical, and real firms do not operate that way.
Some rules bend. Say which ones.
Consider two prohibitions that typically sit in the same flat list.
The first: never enter a client's full Social Security number into any AI tool. That rule has no legitimate exception. No partner should be able to approve it, no deadline should override it, and no client instruction should change it.
The second: do not use AI tools on matters governed by a protective order. That rule does have exceptions — some protective orders permit it, some clients consent, some tools are covered by an appropriate agreement. It needs a path to yes.
When both rules appear in the same undifferentiated list, one of two things happens. Either the firm treats everything as absolute, and attorneys quietly work around a policy that blocks legitimate work. Or the firm treats everything as flexible, and the rule that should never bend gets bent by someone under deadline pressure at eleven at night.
What our Acceptable Use Policy does differently
The Defensible AI™ AI Acceptable Use Policy splits prohibitions into two classes.
Absolute prohibitions admit no exception. No approval process exists, because there is nothing to approve.
Context-specific prohibitions are waivable — but only with written sign-off from both the AI Governance Officer and the supervising partner on the matter. The path to yes exists, it is narrow, and it leaves a record.
That structure does two things a flat list cannot. It tells an attorney instantly which category a situation falls into, and it produces documentation every time an exception is granted — which is exactly the artifact you want when someone later asks why a particular tool was used on a particular matter.
What else is in it
The policy is a complete fifteen-section firm-wide instrument covering permitted uses, attorney supervision under Rules 5.1 and 5.3, the Vendor Evaluation Process and Approved AI Tool Registry, client confidentiality under Rule 1.6, incident reporting, recordkeeping, and jurisdictional awareness for courts with AI disclosure standing orders. It defines the AI Governance Officer role and threads that accountability through every section rather than naming it once and moving on.
It is mapped throughout to ABA Model Rules 1.1, 1.4, 1.6, 5.1, and 5.3 and to Formal Opinion 512 — not as citations dropped in a footer, but as the reasoning behind each requirement.
Who needs it
Every firm using AI, at any size. This is the foundation document; most of the others assume it exists. If your firm is using AI today and has nothing in writing, start here.
AI Acceptable Use Policy — $597
Delivered as an editable Word document, ready to customize with your firm's name, designated governance officer, and effective date. Includes twelve months of updates as guidance evolves.