AI policy your bar association wrote is for BigLaw; here’s what solo, small firms should do instead

This Insight originally appeared in the September 2026 issue of the ABA Journal.

Bar associations throughout the country have steadily issued ethics opinions regarding artificial intelligence.

The ABA issued Formal Opinion 512 in July 2024. The Florida Bar issued Opinion 24-1 in January 2024. The State Bar of Texas issued Opinion 705 in February 2025. The North Carolina State Bar issued 2024 Formal Ethics Opinion 1 in November 2024. The Oregon State Bar issued Formal Opinion No. 2025-205 in February 2025.

State after state is working through the same question: What do competence, confidentiality, supervision and candor require when attorneys use generative AI?

The guidance is generally sound. The problem is not in what it says. It is how they, almost universally, assume an infrastructure that most law practices do not have.

The ABA’s Formal Opinion 512 requires attorneys to understand the capabilities and limitations of the AI tools they use, conduct vendor due diligence on confidentiality practices and data retention, supervise AI-assisted work product, maintain training records, document vendor selection decisions, and keep a written AI governance policy. The checklist runs to a dozen items before the attorney has even decided which tools to use.

At a large firm, this is a committee project. A partner convenes a working group. IT security reviews the vendor agreements. The general counsel drafts the policy. At a solo practice, the attorney is all those people. According to the ABA, the majority of lawyers in the United States practice in firms of five attorneys or fewer. The AI obligations fall equally on a 500-lawyer firm and on a solo practitioner.

What the guidance actually requires

The vendor due diligence requirement precisely illustrates the gap. Formal Opinion 512 asks attorneys to check references and credentials, review security policies, confirm confidentiality agreements, and determine whether the provider retains rights to submitted content. Enterprise vendors maintain compliance teams to respond to exactly these inquiries. Consumer-grade tools, the kind that are actually affordable at solo and small firm billing rates, often provide terms of service written by lawyers for the other side of the transaction. The answer to the most important question, whether client information becomes training data for the model, often turns on a distinction between a free consumer product and an enterprise subscription that most solo practitioners do not know exists or simply cannot afford.

The supervision requirement creates a parallel problem. Formal Opinion 512 correctly applies Model Rules 5.1 and 5.3 to AI-assisted work products. But when the solo practitioner is both the supervisor and the only person doing the work, the compliance structure must be built from scratch and maintained by the only person it applies to. The obligation extends further than many solos realize: If a paralegal or a virtual assistant is using AI tools independently, the supervising attorney is responsible for that output whether or not the attorney knows it is happening.

Malpractice carriers are now adding another layer. Insurers are asking about AI use on renewal applications and, in some cases, conditioning coverage on the existence of a documented policy. For a solo practitioner, a coverage gap is not an inconvenience. It is the end of the practice.

The ethics obligations apply regardless

The principles in Formal Opinion 512 are the right principles. Attorneys who submitted AI-generated citations without verification have faced court sanctions, client complaints and professional discipline.

Mata v. Avianca was not a large firm failure. It was a small firm attorney who trusted AI output without checking it. The ABA Model Rules most directly in play are Rule 1.1, which requires understanding the technology being used; Rule 1.6, which governs every input involving client data; Rule 3.3, which makes the attorney responsible for everything submitted to a court; Rule 5.3, which extends supervision obligations to nonlawyer staff; and Rule 8.4, under which submitting fabricated authority is dishonesty regardless of how it was generated.

These are the right rules. They do not, however, automatically translate into workable compliance frameworks for attorneys operating without enterprise infrastructure, and that gap deserves an honest conversation.

What a realistic framework looks like

A one-page written policy is sufficient—it can even be suggested or generated by AI. Identify the AI tools you use for client work, confirm that you do not input confidential client information into consumer AI tools without appropriate protections, and describe how you review AI output before it goes out under your name. This is a professional responsibility document, not a technology document.

Vendor due diligence follows the same logic. Treat it what it really is, a contract review exercise, rather than a technical one. Read the privacy policy and terms of service for plain-English answers to a few questions: Does the vendor train on my inputs? Can I opt out? How long is data retained? And who can see it?

If the answers are buried or ambiguous, resolve the ambiguity against use, then document the review with a short memo to the file. No technical expertise required—only the skeptical reading every lawyer already practices.

Supervision works the same way. Review the AI output as you would work from a capable but unlicensed law clerk—useful as a starting point but final only when you say so. Read every citation, confirm every factual assertion, and edit until the language is your own. The supervision record is your review, your edits and your name on the work, and it covers your staff’s AI use, as well as yours.

Training records are simpler still. A dated calendar entry confirming that you reviewed updated terms of service or read a new ethics opinion is sufficient. Approximately 15 minutes per quarter spent on the latest bar guidance, noted in a running one-page log, demonstrates ongoing competence better than an elaborate program that exists on paper and is never used.

What the bar should do differently

Three things would make an immediate difference.

First, create model policies sized for solo practice, not aspirational frameworks but fill-in-the-blank instruments with plain-English explanations of each provision.

Second, maintain a regularly updated vetted tool list, so practitioners are not conducting individual due diligence on every product that launches.

Third, establish a good-faith compliance safe harbor for attorneys who implement a reasonable documented policy and follow it, even when the technology fails in ways they could not have anticipated.

The profession would benefit from guidance that explicitly addresses the solo and small firm context, not separate standards but honest acknowledgment that the implementation path looks different when one attorney is doing everything. The bar associations that issued these opinions have the credibility, the reach and the existing practitioner relationships to do better. The obligation to practice competently in an AI-enabled environment is not going to wait. Neither should the guidance.