Attorney's checklist

Questions to ask before using any AI tool

Your duties did not change. The tools did.

Use these questions with any vendor, ours included, before client information goes into an AI tool. They are grouped by the duty each one serves.

Confidentiality and data

1. 1

   Where does my client's information go, and who can see it?

   Find out where the data is stored and processed, who at the vendor can access it, and under what conditions. Rule 4-1.6(e) asks for reasonable efforts to prevent unauthorized disclosure of or access to client information.

2. 2

   How long does the tool keep what I put in, and can I delete it?

   Opinion 24-1 tells lawyers to research a program's policies on data retention. Ask about prompts, uploaded files, outputs and backups, and whether deletion on request or on termination is possible.

3. 3

   Is my data shared with anyone else, or used to train the tool?

   Opinion 24-1 names data sharing and self-learning as the policies to investigate. Ask whether client content can be used to train or improve models, and whether that answer is in the contract or only on a web page.

4. 4

   If the file includes health information, will the vendor sign a business associate agreement?

   Medical and personnel records are common in PI and employment files. Ask whether a BAA is available before upload. Whether HIPAA applies to your firm is a question for your own counsel.

Accuracy and verification

1. 5

   Can I trace every answer to a source page and check it?

   An answer you cannot trace to a page is an answer you cannot verify. Ask whether each statement points to the exact document and page it came from.

2. 6

   Who verifies the work before it is relied on or filed?

   Opinion 24-1 says the lawyer remains responsible for the accuracy of AI-assisted work, including research. Decide in advance who checks citations and facts, and how.

Supervision

1. 7

   Do I review the output before it leaves my office?

   The lawyer, not the tool, signs the work. Build a review step into every workflow that touches a client deliverable or a court filing.

2. 8

   Does my firm have a written policy on which AI tools staff may use?

   The Comments to Rules 4-5.1 and 4-5.3 ask lawyers to consider safeguards for the firm's and assistants' use of generative AI. A one-page policy naming approved tools is a start.

3. 9

   Have I considered whether the client should be told or asked for consent?

   Opinion 24-1 recommends obtaining the affected client's informed consent before using a third-party generative AI program if its use would involve disclosing confidential information. Rule 4-1.4 governs what the client must be told.

Vendor honesty

1. 10

   Does the vendor say plainly what it gets wrong?

   Look for a vendor that documents its tool's limits and failure modes in plain language. Be wary of any tool that claims it never makes mistakes.

2. 11

   Will the vendor notify me of a breach or legal demand, and what happens when I leave?

   Opinion 24-1 builds on the cloud-computing guidance of Opinion 12-3: the provider should be obligated to preserve confidentiality and security and to notify the lawyer of a breach or of service of process seeking client information. Ask about export and deletion on exit.

General information, not legal advice. Check the current rules and your own facts, and consult your own counsel or the Florida Bar for specific questions.