← All articles

Generative AI for Lawyers: Use It Under Governance

Katie Pham
·
November 1, 2026

Generative AI is already inside your organization. Lawyers draft with it, summarize with it and research with it, whether or not a policy permits it. The question for a general counsel or legal ops leader is no longer adoption. The question is control. Who used which tool, on which matter, with what data, and who checked the output. If you cannot answer that from a log, you do not have governance. You have a memo.

This article takes a position. Generative AI belongs in legal work. It does not belong there ungoverned. The rest of the page explains the duties that apply, the failure modes that matter, and the controls that hold up when a regulator, a court or a client asks questions.

Neota Logic
Put Legal AI Under Governance
Neota adds governed, auditable workflows to the AI tools legal teams already use, with logged steps and human checkpoints.
Explore Neota Logic

TL;DR

  • Generative AI is useful for drafting, summarizing, classification and contract analysis. It is not a source of legal judgment.
  • ABA Formal Opinion 512 ties AI use to competence, confidentiality, communication and fees. Supervisory duties apply on top.
  • Courts now require disclosure and certification in some matters. Responsibility for filings stays with the lawyer.
  • A policy document does not enforce itself. Audit trails, versioning, explainability and human checkpoints do.
  • Put deterministic rules on every decision that cannot be wrong. Let AI handle the work that benefits from it.

Table of Contents

Generative AI is a subcategory of AI that produces new output, such as text, images, audio or video, from input data. The Law Society lists the legal uses that matter most: contract analysis, drafting or summarizing documents, e-discovery and improving internal knowledge databases.

Those uses share a pattern. Each one is high volume. Each one is language work. Each one ends with a lawyer who can review the result. That is where generative AI earns its place.

For in-house teams, the practical map looks like this:

  • Intake and triage. Classify incoming requests, extract the facts, route to the right lawyer.
  • Drafting. Produce first drafts of NDAs, amendments, notices and standard correspondence.
  • Contract review. Compare a counterparty draft to your playbook and propose redlines.
  • Summarization. Condense long agreements, regulatory text or matter files.
  • Knowledge retrieval. Surface prior positions and precedent from internal repositories.

For law firms, the same list applies, with the added pressure of client outside-counsel guidelines and matter-level confidentiality walls.

Where generative AI fails

The failure modes are well documented. The University of Washington law library lists outdated knowledge, hallucinations, bias and the absence of real legal judgment as common limitations. The same source records the view of legal experts that these are fundamental characteristics of the technology, not bugs awaiting a patch.

Take that seriously. If a limitation is structural, you cannot prompt your way out of it. You design around it.

Designing around it means separating two kinds of work.

  1. Work where an error is tolerable and catchable. A first draft. A summary a lawyer will read against the source. A classification a human will confirm.
  2. Work where an error is a liability. Whether a conflict exists. Whether a contract needs approval. Whether a jurisdiction triggers a notice duty. Whether a request falls inside delegated authority.

The first category suits generative AI. The second category needs a deterministic rules engine. A rules engine returns the same answer to the same facts, every time, and can show you the rule that produced it. A language model cannot make that promise.

The duties that already apply

No new statute is needed to make AI use a professional responsibility issue. The existing Model Rules already cover it.

ABA Formal Opinion 512 says lawyers using generative AI should consider Model Rule 1.1 on competence, Rule 1.6 on confidentiality, Rule 1.4 on communications and Rule 1.5 on fees. Four rules. Each one produces a control requirement.

Competence and supervision

Competence means you understand what the tool does and where it breaks. Supervision goes further. Under Rules 5.1 and 5.3, supervisory lawyers must establish clear policies and training on the safe, ethical use of generative AI tools. If you lead a department or a practice group, that duty is yours.

Confidentiality and privilege

Under Rule 1.6, client information stays confidential unless the client gives informed consent. The ABA business law analysis of Opinion 512 adds two points that GCs should note. Boilerplate consent in an engagement letter is often insufficient for generative AI use. And the opinion cautions that when several lawyers use the same tool, client information can be used and disclosed inadvertently across matters.

Privilege is where this gets expensive. Uploading privileged material to a tool with weak terms invites a waiver argument. Privilege dies quietly. Nobody announces it. An opposing party simply points to the data flow and asks what reasonable measures you took. If your answer is a policy PDF with no log behind it, the argument writes itself.

Communication and fees

Rule 1.4 pushes you to tell clients when AI use is material to the representation. Rule 1.5 limits billing. Under Opinion 512, lawyers generally cannot charge clients for time spent learning to use a generative AI tool, unless the client specifically requests that tool for the matter. Your time records and your AI usage records need to agree.

Judgment cannot be delegated

The State Bar of California’s practical guidance states that professional judgment cannot be delegated to generative AI and remains the lawyer’s responsibility. That sentence should sit at the top of your AI policy.

What courts require

Courts have moved from warnings to orders. Requirements differ by judge and district, so read the standing orders for every forum where you file.

Two examples show the range:

  • The U.S. District Court for the District of Hawaii requires parties to disclose the generative AI tool used and to certify that they checked the accuracy of AI-drafted content, including citations and legal authority.
  • The Eastern District of Texas issued a 2025 standing order that holds parties responsible under Federal Rule of Civil Procedure 11 and professional-conduct rules for the contents of filings prepared with generative AI.

The common thread is accountability. The tool is not a defendant. You are.

This creates a record-keeping problem. If a court asks you to certify that a filing was verified, you need evidence of the verification. A lawyer’s recollection is weak evidence. A time-stamped log that shows who reviewed which citations, against which source, is strong evidence.

Verification is a workflow, not a reminder

The California guidance is direct on verification. Lawyers should review outputs for accuracy, verify citations and authorities, and supplement AI-generated research with human-performed research and analysis. Verification means cross-checking citations and legal interpretations against authoritative sources to prevent reliance on fabricated data.

Most firms handle this with an instruction in a training deck. That fails for a simple reason. Instructions depend on memory and time. Both run short on a Thursday night before a filing.

A workflow does not depend on memory. It makes verification a required step before the next step can happen.

A workable verification sequence:

  1. The AI produces a draft or a research summary.
  2. The system extracts every citation and authority into a checklist.
  3. A named reviewer confirms each one against the primary source.
  4. The system records the reviewer, the time and the result.
  5. Only then does the document move to the approval stage.

If step 3 is skipped, the document does not advance. That is the difference between a policy and a control.

Policy is necessary and not sufficient

Every framework points the same direction. The California guidance tells firms to set clear policies on permissible uses, train staff, consult IT or cybersecurity experts and review product terms for confidentiality, security and data retention. The NIST AI Risk Management Framework, released in January 2023, offers a voluntary structure for managing AI risks, including safety, security and privacy. NIST also stresses that governance must be integrated through an organization’s risk management processes across the full AI lifecycle.

Read that last point again. Governance is integrated into processes. It is not a separate document. A policy that lives beside the work does not govern the work.

The gap shows up in three places.

Shadow use

Lawyers adopt tools faster than committees approve them. A ban pushes use to personal accounts, where you have no visibility at all. A governed pathway that is easier than the workaround wins.

Tool sprawl

Most organizations now run more than one model. One team prefers a legal-specific platform. Another uses a general-purpose assistant. Each has different data terms, different logging and different behavior. Without a layer above them, you govern each tool separately, or you do not govern them.

Unexplainable decisions

When an AI output drives a decision, such as approving a vendor or escalating a risk, someone will later ask why. “The model said so” is not an answer a regulator or a board accepts.

What governed generative AI looks like

Governance is the differentiator. Features are not. Any tool can draft a clause. The test is whether you can prove, after the fact, what happened and why.

Three properties define a governed deployment.

Audit trails

Every action is logged: the request, the model used, the prompt, the output, the human who reviewed it, the decision taken. Logs are tied to the matter. They are retrievable. They answer the questions a court, a client or a regulator will ask.

Six fields recorded in a legal AI audit trail

Versioning

Prompts change. Playbooks change. Rules change. Models change. You need to know which version of each applied to a given output on a given day. Without versioning, you cannot reproduce a result, and a result you cannot reproduce is a result you cannot defend.

Explainability

Explainability does not mean explaining how a neural network works. It means showing the path to a decision. Which rule fired. Which facts triggered it. Which person approved the exception. A deterministic rules engine delivers this by design, because every outcome traces to a stated rule.

These three properties sit on top of the models. They do not replace them. You keep the AI tools your lawyers already use. You add the layer that makes their use accountable.

Where humans belong in the loop

“Human in the loop” is often a slogan. Make it a design decision.

Place a checkpoint wherever one of these is true:

  • The output leaves the organization, such as a filing, a client advice letter or a regulator submission.
  • The output changes a legal position, such as an approval, a waiver or a settlement authority.
  • The output touches privileged or regulated data.
  • The confidence of the model is not the issue, but the consequence of error is.

Place no checkpoint where one adds only delay. Over-review trains people to click through. A checkpoint that everyone approves in two seconds is worse than none, because it creates a record of review that did not happen.

The firm decides where checkpoints sit. The system enforces them.

Perspective

We see the same pattern in every legal department that comes to us. The AI tools are already in use. The policy exists. The control does not.

Our position is simple. Do not ask a language model to make a decision that cannot be wrong. Put that decision in a deterministic rules engine, where the same facts produce the same answer and the rule behind it is visible. Use AI for what it does well: drafting, classification and summarizing. Then place a human checkpoint where your risk tolerance says one belongs.

This is why we built Neota Logic as governed AI infrastructure for legal and compliance teams. It is not a point solution. It is not a chatbot. It sits on top of the AI tools you already run, including Harvey, ChatGPT and Claude, and it logs every step. Our rules engine structurally cannot hallucinate on the decision path. Human checkpoints are built in, not bolted on.

We do the build with our own legal engineers, so your team stays on client work. We have spent twenty years deploying in law firms. We are not learning on your matters.

The firms that treat governance as the product will defend their AI use. The firms that treat it as paperwork will explain it later, under worse conditions.

Patrick

Start with what you already have. Then add control in order of risk.

  1. Inventory every tool in use. Include the unapproved ones. You cannot govern what you have not found.
  2. Classify use cases by consequence. Separate drafting and summarizing from decisions that carry legal or regulatory weight.
  3. Map each use case to the Model Rules. Competence, confidentiality, communication, fees, supervision. Note the control each one demands.
  4. Move the high-consequence decisions into rules. Approval thresholds, conflict triggers, jurisdictional obligations, escalation criteria. Write them once, version them, and let the engine apply them.
  5. Wrap the AI steps. Log inputs and outputs. Require verification before documents advance. Route sensitive matters to named reviewers.
  6. Review the vendor terms. Confidentiality, security and data retention need to be checked, as the California guidance directs.
  7. Align to a framework. The NIST AI RMF gives you a shared vocabulary for the board, audit and outside counsel.
  8. Review the logs on a schedule. Governance that nobody reads is decoration.

This sequence works for a corporate legal department and for a law firm. The firm adds client-level consent and outside-counsel guideline checks. The department adds business-unit intake and delegated authority.

How Neota Logic fits

Neota Logic gives legal and compliance teams a control layer above the AI they already use. The platform combines a deterministic rules engine, governed AI steps, human checkpoints and a full audit log. Our legal engineers scope and build each solution, so you get a working application in weeks and your team stays on client work.

The relevant starting points:

Neota Logic

If your organization runs generative AI without a log, a version history and a checkpoint, the exposure is already accumulating. See how the Neota platform and deployment services work and book a demo.

FAQ

Can lawyers ethically use generative AI?

Yes. ABA Formal Opinion 512 applies the existing Model Rules on competence, confidentiality, communication and fees to generative AI use. The duty is to use it with understanding, protect client information and review the output. Delegating professional judgment to the tool is not permitted.

The confidentiality rule requires informed consent before client information is disclosed in ways the rule does not otherwise permit. The ABA business law analysis of Opinion 512 says boilerplate engagement letter language is often insufficient. Address AI tools and their confidentiality risks with the client specifically.

Are courts requiring disclosure of AI use?

Some are. The District of Hawaii requires disclosure of the tool and certification that AI-drafted content was checked. The Eastern District of Texas holds parties responsible under Rule 11 for AI-assisted filings. Check the standing orders of each judge and district before you file.

Separate decisions from drafting. Put decisions that cannot be wrong in a deterministic rules engine. Use AI for drafting, classification and summarizing. Log every step, version every rule and prompt, and place human checkpoints where consequence is highest. Align the program to the NIST AI RMF.

Can lawyers bill for time spent learning an AI tool?

Generally no. Under Opinion 512, learning time is not billable to the client unless the client specifically requests that tool for the matter. Keep your AI usage records consistent with your time entries.

Sources

Ready to make your AI workflows defensible?

Book a demo and we'll walk one of your real processes through Neota.

Book demo