AI Ethics Opinions: What 14 State Bars Say

Fourteen state bars have now issued formal ethics opinions on AI tool use by lawyers — and if you read them side by side, a clear operational checklist falls out.

The opinions span California, New York, Florida, Texas, the District of Columbia, Illinois, New Jersey, Pennsylvania, Michigan, Ohio, Virginia, North Carolina, Connecticut, and Minnesota. They do not agree on everything. But the overlap is large enough to tell a small-firm lawyer exactly what to check before onboarding any new AI tool — and what will get you in front of a grievance committee if you skip it. This piece maps the consensus, the disagreements, and the four-question checklist that comes out of the stack.

What the Opinions Actually Say: The Four Common Themes

Across all fourteen opinions, four duties show up every time. The framing differs; the substance does not.

Competence

Every opinion grounds AI use in the existing competence duty — most cite the equivalent of Model Rule 1.1 and its Comment 8 language about keeping up with relevant technology. The New York City Bar’s 2024 opinion is explicit: using an AI tool you don’t understand well enough to catch its errors is itself an ethics problem. California’s State Bar issued a detailed 2023 interim guidance that goes further, noting that “hallucination” risk requires lawyers to independently verify AI-generated citations and legal analysis before relying on them. Florida’s Bar opinion echoes this almost word for word.

For a solo or small firm, the operational read is this: you must understand the tool well enough to audit its output. That is not a high bar — it does not mean you need to understand transformer architecture. It means you need to know what the model is likely to get wrong in your practice area, and you need a review step in your workflow that catches it.

Confidentiality

This is where the opinions get most specific and most useful. Florida, Texas, New York, and DC all address the question of what happens to client data when it is submitted to an AI tool. The shared concern: consumer-tier AI products (the opinions sometimes say “publicly available” or “free-tier” products) may train on submitted data, store it, or share it in ways that breach Rule 1.6. Texas Disciplinary Rule 1.05 is cited explicitly in the Texas opinion. DC Ethics Opinion 388 from 2024 puts it plainly — lawyers must review vendor data-handling terms before inputting any client information.

Illinois goes the furthest here: its opinion explicitly states that using a free-tier generative AI product with default data-retention settings for client matters is presumptively problematic without additional safeguards. That is strong language. Most other bars stop short of a presumption, but all of them require that the lawyer actually read and understand the vendor’s data-use policy.

Billing

New York, Pennsylvania, and DC have the most developed positions here. The core question: if AI cuts a four-hour research task to forty minutes, can you still bill four hours? The answer, across all three opinions, is no — at least not without disclosure. New York’s opinion ties this to the existing prohibition on clearly excessive fees. DC’s opinion is the most operational: it distinguishes between billing for AI tool costs as a pass-through expense (requires client disclosure and consent) versus billing time spent supervising and verifying AI output (billable as attorney time, no special disclosure required beyond your normal engagement letter).

For flat-fee or subscription-model practices, the billing section is largely a non-issue. For hourly billers, the DC framework is worth reading in full — it is the clearest guidance available right now on how to structure your billing without creating a fee dispute.

Supervision

Every opinion that addresses multi-person firms extends the supervision duty to AI output — associates and paralegals using AI tools are supervised the same way they always were, and partners are responsible for what those tools produce in the firm’s name. For solos, this collapses into the competence question: you are your own supervisor. The Minnesota and Virginia opinions both explicitly note that delegation to an AI tool does not eliminate the lawyer’s responsibility for the work product.

Where the Opinions Diverge: The Disclosure Question

The sharpest split across the fourteen opinions is on client disclosure. Specifically: must you tell a client that you used an AI tool on their matter?

California and New Jersey lean toward yes — at least when AI plays a significant role in work product. California’s guidance suggests disclosure may be required when AI output is central to the work delivered, though it stops short of a bright-line rule. New Jersey’s 2024 opinion goes further, recommending that lawyers address AI use in the engagement letter, proactively.

Florida and Texas take the opposite position: disclosure is not independently required so long as the work product meets competence standards and confidentiality is protected. The tool is, in their framing, an internal work method — no different from using a legal research database or a spell-checker.

New York and DC land in the middle. Both suggest disclosure is prudent but decline to make it mandatory in all circumstances. DC’s opinion carves out AI-generated work product submitted to a tribunal as a higher-disclosure-risk situation — which tracks with the string of federal sanctions cases involving hallucinated citations.

The practical upshot for a small firm: if you have clients in California or New Jersey, update your engagement letter now. For everyone else, a disclosure clause costs you nothing and insulates you from the emerging consensus trend — which is moving toward disclosure, not away from it.

Close-up detail of hands resting on a mechanical keyboard, a legal document visible on screen only as soft rectangular s

What This Means for Tool Selection: The Operational Checklist

Reading all fourteen opinions as a software selection framework, four questions emerge. Run every AI tool you are considering through these before you give it a client file.

1. Does the vendor’s data policy allow training on your inputs?

This is the confidentiality question, and it is binary. OpenAI’s API (with zero data retention enabled), Microsoft Azure OpenAI, and Anthropic’s Claude API all allow you to turn off training on submitted data — but you have to configure it, and you have to be on a paid business or API tier. Consumer products — ChatGPT free tier, standard Bing Copilot without a business agreement, Google Bard before Gemini’s enterprise rollout — do not give you those controls by default.

Legal-specific tools like Casetext CoCounsel (now Thomson Reuters), Harvey, Westlaw AI, Lexis+ AI, and Spellbook all publish data-handling terms that address this directly. Check for: (a) whether your data trains the model, (b) how long inputs are retained, and (c) whether you get a data processing agreement. If a vendor won’t give you a DPA on request, that is your answer.

2. Does the vendor hold a current SOC 2 Type II report?

SOC 2 Type II is not a guarantee of security, but it is the floor — it means an independent auditor tested the vendor’s controls over a period of time, not just on a single day. Several of the ethics opinions (DC and Illinois most directly) reference the need to evaluate vendor security practices as part of the confidentiality analysis. Asking a vendor for their SOC 2 Type II report is a reasonable due diligence step. If they don’t have one, that matters more for a cloud-native AI tool handling client data than it does for a local tool that never phones home.

Established legal AI vendors — Casetext, Lexis, Westlaw, Contract Podium, Ironclad — generally have these. Newer single-feature tools built on top of open models may not yet. “We’re SOC 2 compliant” without a Type II report is a weaker statement than it sounds.

3. Does the tool produce an audit trail?

The supervision opinions — Minnesota, Virginia, New York — all implicitly require that a lawyer be able to show what an AI tool produced and what the lawyer did to verify it. That means you need some record. Some tools (Harvey, CoCounsel, Lexis+ AI) log queries and outputs within the platform. Others do not. If your tool of choice keeps no log, you need to create one yourself: screenshot, copy-paste to a matter file, a dated note in your practice management software. This is not optional if you want to defend your supervision process in a grievance.

4. Does your engagement letter address AI use?

This is the disclosure question operationalized. You do not need a separate AI disclosure form. A single clause in your standard engagement letter — something like “We use AI-assisted research and drafting tools; all work product is reviewed and verified by a licensed attorney before delivery” — satisfies the spirit of even the most disclosure-forward opinions (California, New Jersey) while adding nothing that would alarm a client. If you bill hourly, add a sentence on how AI time is handled. DC’s billing framework is a reasonable model.

What I’d Actually Do About This

Here is the short version of the checklist, in order of priority for a solo or small firm:

Update your engagement letter this week. One AI clause. Done. This covers disclosure, billing transparency, and the supervision paper trail in one sentence.
Run your current AI tools through the data-policy check. If you are using a free-tier product for anything client-related, either upgrade to a paid business tier with a DPA or stop using it for client matters. The Illinois presumption language should worry you if you are in that state; the Florida and Texas positions are more lenient, but the trend is tightening.
Ask your AI vendors for their SOC 2 Type II report. This is a one-email ask. If the vendor is responsive and has the report, file it. If they don’t have one, factor that into your risk assessment — especially if you handle sensitive matters (healthcare, family law, criminal defense).
Build a log habit for AI-generated work product. Whether your tool logs natively or you maintain a folder in your matter management system, you want a record that an attorney reviewed and verified the output. This is your supervision documentation.
Watch your state bar’s opinion queue. Fourteen opinions are out. More are coming. California has signaled it may issue a more formal opinion after its 2023 interim guidance. New York is likely to revisit its position as hallucination-related sanctions cases accumulate. Set a calendar reminder to check your state bar’s ethics opinion page every quarter.

None of this requires slowing down your AI adoption. It requires fifteen minutes of vendor due diligence, one engagement letter edit, and a log habit. The bars are not telling you to stop using these tools — every single opinion explicitly acknowledges that AI tools can serve clients competently. They are telling you how to use them without creating liability you don’t need.

The firms that will have problems are the ones that treated free-tier ChatGPT like a secure legal research platform and never read a vendor’s terms of service. That is a solvable problem. The checklist above solves it.

AI Ethics Opinions for Lawyers: What 14 State Bars Have Said About AI Tools