AI Compliance in Legal Tech: Managing Risks in Automated Document Review

Law firms have more reasons than most businesses to move carefully with AI. A hallucinated statistic in a marketing email is embarrassing. A hallucinated case citation in a court filing can get an attorney sanctioned, disqualified, or referred for discipline. And unlike most industries, legal work carries a duty that most AI tools weren't built to respect: privilege. This guide covers the three areas legal teams need to get right before automating document review, research, or drafting with AI.

The bar associations have already weighed in

If your firm is waiting for official guidance before setting AI policy, that guidance already exists. The American Bar Association issued Formal Opinion 512 in mid-2024, mapping existing professional conduct rules onto AI use and naming the duties that apply directly: competence, confidentiality, communication, candor, fees, and supervision. Since then, more than a dozen states have issued their own formal opinions, including California, Florida, Texas, Pennsylvania, and New York, and California updated its guidance again this year to cover agentic AI specifically, not just chatbot-style tools.

The opinions differ on details, particularly around whether a lawyer must disclose AI use to a client. But they agree on the core point: no bar has banned AI in legal work, and none of them let AI use excuse a lawyer from their existing ethical obligations. Florida's opinion goes as far as stating that lawyers may not bill clients for time saved through AI use, while several states now require lawyers to independently verify anything an AI tool produces before relying on it. If your firm doesn't have a written AI policy yet, that's the first gap to close, since several states now factor AI competence into continuing education requirements as well.

Hallucinations in case law research carry real, documented consequences

This is no longer a hypothetical risk you can wave off. Courts have sanctioned lawyers across dozens of cases for submitting briefs built on AI-fabricated citations, and the penalties are climbing. A federal judge in Oregon applied a per-infraction fee schedule to one attorney, charging separately for each fabricated citation and quotation in a case that ultimately totaled tens of thousands of dollars in sanctions and costs. A Kansas federal judge fined five attorneys in a single patent case after they admitted relying on AI-generated case law without verifying it. Two Tennessee attorneys were sanctioned by the Sixth Circuit after citing more than two dozen fake cases in one brief. One research effort tracking these incidents worldwide has counted roughly 1,200 cases of AI-fabricated citations reaching courts, with the majority occurring in the United States.

The pattern across nearly every one of these cases is the same: an attorney used a general-purpose AI tool for legal research and filed the output without independently checking that the cases and quotations actually existed. The fix isn't avoiding AI research tools. It's treating their output the way you'd treat a first-year associate's memo, useful, often accurate, but not something you file with the court unread.

Practical safeguards worth building into your workflow:

• Verify every citation against a primary source before it appears in a filing, regardless of how confident the AI tool sounds or how minor the case seems to the overall argument.
• Use legal-specific research tools with citation checking built in, rather than general-purpose chat tools, when the task involves case law. Tools designed for legal research are more likely to ground answers in verified databases rather than general training data.
• Document your verification process. Several courts have specifically asked firms to show what steps were taken to check AI-assisted work, so having a documented process helps if your firm's use of AI is ever questioned.

Client confidentiality and privilege are the sharpest edge of this problem

The hallucination risk gets attention because it's visible in court filings. The privilege risk is quieter and arguably more serious, because it can undo a client's protection before anyone notices anything went wrong.

The core issue is how public AI tools handle the data you give them. Many consumer-facing tools use submitted content to train their models, retain it on external servers for a period of time, and route it through infrastructure a law firm doesn't control. Under privilege law, voluntarily disclosing confidential information to a third party can waive privilege entirely, and a growing body of legal opinion treats submitting client information to a public AI tool as exactly that kind of disclosure.

This isn't theoretical anymore. A federal court in the Southern District of New York ruled in United States v. Heppner that a defendant's interactions with a consumer AI chatbot were not protected by privilege, pointing specifically to the AI provider's privacy policy, which permitted data retention, model training, and disclosure to third parties, as eliminating any reasonable expectation of confidentiality. The case didn't involve a lawyer, but the reasoning applies directly to any attorney considering the same kind of tool for client work. The terms of service, not a data breach, were enough to waive protection.

The same risk extends beyond chatbots. AI note-taking tools used in client meetings raise a related problem: introducing a third-party AI service into a privileged conversation can itself be treated as disclosure to an outsider, and the transcripts these tools generate become permanent, discoverable records of conversations that previously existed only in memory.

What this means in practice for legal teams:

• Never enter client information into a general-purpose, free-tier AI tool. Assume anything submitted may be retained, reviewed, or used for training unless the provider's terms explicitly and specifically say otherwise for your account type.
• Choose legal-specific AI tools with zero data retention agreements, contractual guarantees against training on client data, and recognized security certifications. Several vendors built for the legal industry now offer this by default, which general-purpose consumer tools typically do not.
• Be cautious with AI notetakers in client meetings. If a matter involves privileged discussion, consider whether a cloud-based transcription tool is appropriate for that specific conversation, or whether it should be handled without one.
• Get informed consent where required. Some jurisdictions now expect lawyers to explain AI use to clients when it plays a significant role in the representation, including what safeguards are in place.

Building a compliance framework that holds up

A workable AI compliance policy for a law firm generally needs to cover four things: which tools are approved for which types of work, a mandatory verification step for anything AI-assisted that will be filed, cited, or sent externally, clear rules on what client information can and cannot be entered into which tools, and a record of how each of those decisions was made. None of this needs to be complicated to be effective. It needs to be written down, communicated to everyone using AI at the firm including support staff, and revisited as bar guidance and tools both continue to change.

The firms getting into trouble right now are rarely the ones avoiding AI. They're the ones using it without a policy, without verification, and without understanding what happens to the data they've submitted. The technology isn't the liability. Ungoverned use of it is.

Stay current on legal AI compliance without doing all the tracking yourself

Bar guidance, court sanctions, and privilege rulings tied to AI are moving fast, and a policy written six months ago may already be behind. Subscribe to The AI Report for regular coverage of how AI compliance is evolving across industries, including legal, so your firm's policies keep pace with where the rules actually stand.

‍