“Can I use ChatGPT in my law practice?”
“Am I allowed to put client information into an AI tool?”
“Do I have to tell my clients I’m using AI?”
“Which AI products has the State Bar approved?”
These are some of the questions lawyers are asking as artificial intelligence becomes part of everyday law practice. And they are good questions. Lawyers want to take advantage of technology that promises greater efficiency, improved client service, and perhaps even a little relief from the demands of practicing law. But they also want to know that they are meeting their professional obligations.
The good news is that the North Carolina State Bar has provided guidance. In 2024 Formal Ethics Opinion 1, the State Bar addressed lawyers’ professional responsibilities when using generative artificial intelligence.
But here’s something worth considering: The State Bar’s approach to AI isn’t particularly new.
In fact, if we look back more than a decade, we can see that the State Bar has been remarkably consistent in how it approaches emerging technology. The technology changes. Our ethical obligations do not.
We’ve Been Here Before
Remember when lawyers were debating whether it was ethical to store client files in the cloud?
Today, cloud-based practice management systems, document storage, email platforms, and billing software are so commonplace that we rarely stop to question whether we are permitted to use them.
But in 2011, the transition to cloud computing raised many of the same concerns we are hearing about AI today.
Could lawyers trust a third-party vendor with confidential client information? What if the vendor experienced a security breach? What if the technology failed or the company went out of business? Could lawyers fulfill their professional obligations when client information was stored on servers outside their control?
The North Carolina State Bar addressed those questions in 2011 Formal Ethics Opinion 6, which considered whether lawyers could use software as a service (SaaS).
The answer was yes, provided lawyers exercised reasonable care to protect confidential client information and safeguard client property.
What is particularly interesting is what the State Bar chose not to do. Rather than establish a mandatory list of security requirements, the opinion explained:
“This opinion does not set forth specific security requirements because mandatory security measures would create a false sense of security in an environment where the risks are continually changing. Instead, due diligence and frequent and regular education are required.”
Think about that statement in the context of today’s AI discussions.
Imagine if the State Bar had identified specific cloud storage products or security protocols that lawyers were permitted to use in 2011. Many of those products or protocols would likely be outdated today. Worse, lawyers might have continued relying on an approved checklist without recognizing that the technology and its associated risks had changed.
Instead, the State Bar established an enduring principle: Lawyers must exercise reasonable care, understand the risks associated with the technology they use, implement appropriate safeguards, and stay informed as technology evolves.
The opinion provided recommended security measures, but it did not attempt to anticipate every technological development or every possible risk.
That responsibility remained with the lawyer.
Fast-Forward to AI
Now consider 2024 Formal Ethics Opinion 1, which addresses lawyers’ use of generative artificial intelligence.
Once again, the State Bar did not attempt to identify approved AI products or establish a universal set of technical requirements. Instead, it focused on the professional responsibilities lawyers already have: competence, confidentiality, independent professional judgment, supervision, and appropriate communication with clients.
Sound familiar?
The State Bar isn’t telling lawyers which AI tools to purchase. It is telling lawyers that they must understand enough about the technology to use it competently and responsibly.
For example, a lawyer using AI to assist with legal research must recognize that generative AI can produce inaccurate information, including nonexistent cases and citations. The lawyer remains responsible for verifying the work.
A lawyer considering whether to enter confidential client information into an AI platform must evaluate how that information will be stored, protected, and potentially used by the vendor.
And a lawyer whose employees are using AI must establish appropriate expectations and supervision to ensure that their work complies with the firm’s professional obligations.
These aren’t entirely new ethical duties created by artificial intelligence. They are familiar duties being applied to a new technology.
Reasonable Care Doesn’t Mean Zero Risk
One of the most important lessons from these ethics opinions is that the Rules of Professional Conduct do not require lawyers to eliminate every conceivable risk associated with technology.
In 2011 FEO 6, the State Bar reiterated that lawyers are not required to use only perfectly secure methods of communication. Instead, they must exercise reasonable care in selecting methods appropriate to the circumstances.
This distinction matters, particularly when discussing AI.
Some lawyers are reluctant to use AI because they cannot be certain that the technology is completely safe or accurate. Others have embraced it enthusiastically without fully understanding its limitations.
Neither extreme reflects the thoughtful professional judgment contemplated by the ethics opinions.
Reasonable care is not a guarantee that nothing will go wrong. It is an obligation to make informed decisions, take appropriate precautions, and respond responsibly as circumstances change.
And reasonable care depends on context.
Using AI to brainstorm topics for a client newsletter presents different risks from uploading confidential documents into an AI platform or relying on AI-generated legal research in a court filing.
A tool that is appropriate for one task may be inappropriate for another. There is no single answer that applies to every AI product, every law firm, or every client matter.
Five Questions to Ask Before Using AI — or Any New Technology
Rather than asking whether the State Bar has approved a particular AI product, lawyers should consider their approach to technology decisions by asking five questions.
1. Do I understand what this technology does?
Lawyers don’t need to become computer programmers or AI engineers. But we do need to understand enough about a tool’s capabilities, limitations, and potential risks to use it competently. That may require training, independent research, or assistance from qualified technology professionals.
2. What are the potential risks to my clients?
Could confidential information be exposed? Could the technology produce inaccurate information? Could reliance on the tool compromise our independent professional judgment? What would happen if the technology failed?
3. What safeguards are reasonable under the circumstances?
Depending on the technology and how it will be used, reasonable safeguards might include reviewing vendor security practices, understanding data retention policies, restricting access to sensitive information, verifying AI-generated work, or establishing firm policies governing acceptable uses.
4. Who is responsible for supervising its use?
Technology doesn’t eliminate the lawyer’s responsibility to supervise work performed on behalf of clients. Lawyers must establish appropriate expectations for employees and other individuals assisting with legal services. That includes understanding how AI tools are being used within the firm and ensuring that appropriate review procedures are in place.
5. How will I stay informed?
This may be the most important question of all.
AI products are evolving rapidly. Features change, vendors update their terms of service, and new risks emerge. A technology that was appropriate when a firm first adopted it may require reevaluation as the product or its use changes.
Technology competence is not something we achieve once and check off our list. It is an ongoing professional responsibility.
These five questions aren’t a substitute for the Rules of Professional Conduct or the guidance provided in ethics opinions. But they offer a practical starting point for evaluating new technology through the lens of our existing obligations.
The Next Technology Is Already Coming
Artificial intelligence is generating enormous attention today, and for good reason. It has the potential to change how lawyers research, draft, communicate, manage their practices, and serve their clients.
But AI will not be the last technological development to challenge the way we practice law.
New tools will continue to emerge, promising greater efficiency while introducing unfamiliar risks. We cannot expect the State Bar to issue a new ethics opinion every time a product enters the marketplace. Nor should we want a regulatory framework so prescriptive that its guidance becomes obsolete almost as soon as it is published.
What we need are enduring principles that help us make sound decisions as circumstances change. Our ethical obligations don’t disappear when we adopt new technology. But those obligations don’t necessarily prevent us from embracing innovation, either.
Instead, they require us to bring the same diligence, competence, and professional judgment to our technology decisions that we bring to the representation of our clients.
So, the next time someone asks, “Is it ethical to use ChatGPT?” or “Which AI tool has the State Bar approved?” perhaps we should reframe the conversation.
The question isn’t whether the technology is ethical. The question is whether our use of the technology is ethical. And answering that question will always require more than checking a box.
Camille Stell is the Vice President of Risk & Practice Management for Lawyers Mutual and the co-author of the book, RESPECT – An Insight to Attorney Compensation Plans available from Amazon. Continue this conversation by contacting Camille at camille@lawyersmutualnc.com or 800.662.8843.
