AI in small law firms: what's safe to automate, and how to protect confidentiality and supervise it
Most small law firms meet AI informally: a few lawyers try a chat assistant, sometimes on client work, with no firm policy and no review step. Typically that saves the early adopters some time, but it creates confidentiality and supervision risks the partners can't see, which is why many firms then ban it outright.
Neither extreme serves the firm. AI can take a lot of routine reading and writing off your people, provided client information stays protected and a lawyer stays responsible for every output. This guide is for law firms of 10-60 people - a people business, meaning a business that sells its people's expertise and time, like lawyers, accountants, agencies and consultants. It covers where AI helps, where it doesn't, the professional duties that apply, and what a careful custom build looks like. It is general information, not legal advice.
Why it happens
Small firms struggle with AI for practical reasons:
Client data is in many places
Matters, contacts and documents live in the practice management system - Clio, PracticePanther or MyCase - and in NetDocuments or similar, with email alongside. A general chat assistant sees none of it unless a person pastes it in, and pasting client information into a tool the firm hasn't vetted is the risk regulators worry about most.
Nobody owns the decision
AI use spreads person by person, with no agreed tools, no rules on data, and no record of what was AI-assisted.
The riskiest work goes first
Legal research and drafting for court are where AI errors, such as invented citations, do the most damage, yet they're often what people try first.
The duties are real
In the UK, the SRA published a warning notice on AI use in August 2026, following reports of potential misuse including inaccurate citations, supervision failures and confidentiality breaches (Law Society of Ireland Gazette, August 2026). In the US, the ABA's Formal Opinion 512 (July 2024) says lawyers using generative AI must consider their duties of competence, protecting client information, communicating with clients, supervising others, advancing only meritorious claims, candour to the tribunal and charging reasonable fees.
The fix with what you already have
You can use AI safely without building anything, if you set it up deliberately.
- 01
Write a short AI policy
One page: which tools are approved, what client information may go into each (often none, unless the tool is covered by a contract and data terms the firm has reviewed), who must review AI output, and how AI use is recorded on the file. Make sure every fee-earner and support colleague has read it.
- 02
Prefer AI inside tools you already have terms with
Many practice management and document tools now include AI features, such as summarising documents or drafting emails. Because they run inside a vendor you've already vetted, they're often the safest place to start. Read each vendor's documentation on where data goes and whether it's used for training before switching anything on.
- 03
Start with low-risk, easily checked work
Good first uses:
- Summarising long correspondence threads before a lawyer picks up a file.
- Drafting routine client emails and letters from your templates.
- Turning attendance notes into task lists.
- First-pass classification and filing of incoming documents, confirmed by a person.
- Producing a plain-English explanation of a process for clients, reviewed by a lawyer.
- 04
Keep these with lawyers:
legal advice, legal research relied on without full verification, anything filed with a court, negotiation strategy and judgement calls on risk. AI can help a lawyer prepare; the lawyer decides and signs.
- 05
Verify everything that matters
Every citation, quotation and factual assertion from an AI tool should be checked against the source before it's relied on.
- 06
Supervise visibly
Supervisors should know which work was AI-assisted and review it with that in mind, especially from junior and non-qualified colleagues.
- 07
Start with an inventory
List the repetitive tasks in the firm and how long they take. Our free ops audit template gives you a structure.
Setting it up, step by step
- Name an owner. One partner owns AI use in the firm, with a practice manager or senior paralegal doing the day-to-day work. Without an owner, the policy goes stale within months.
- Take stock of what people already use. Ask everyone, without blame, which AI tools they've tried and for what. You'll usually find more use than partners expect, and it tells you where the demand is.
- List the AI features in tools you already pay for. Check what Clio, PracticePanther, MyCase, NetDocuments and your email and office software now offer, and which plan each feature needs. Note them in one short table.
- Read the data terms for each one. For every feature you're considering, find the vendor's documentation on where data is processed, whether it's kept, and whether it's used to train models. If you can't find a clear answer, treat the feature as not approved until you have one.
- Write the one-page policy. Approved tools, what data may go into each, who reviews output, how AI use is recorded on the matter, and who to ask when unsure.
- Pick two or three first uses from the low-risk list below, in one team, and switch on only the features those uses need.
- Decide how AI use is recorded. For example, a short note on the matter saying what was AI-assisted and who reviewed it. Make it quick, or people won't do it.
- Review after a month, then widen use one team at a time.
Common mistakes
Banning AI and assuming the ban works.
People with heavy workloads find their own tools. A clear, sensible policy is safer than a ban nobody follows.
Starting with legal research or court documents.
These are where errors do the most damage. Start where output is easy to check.
Approving a tool without reading its data terms.
"It's a big-name vendor" is not the same as knowing where your client data goes.
Treating review as a formality.
A reviewer who skims an AI draft is approving work they haven't checked. Review means reading against the source.
No record on the file.
If nobody can tell later which work was AI-assisted, supervision depends on memory.
Forgetting support staff.
Secretaries and paralegals often use AI most, and need the policy and training as much as fee-earners.
What good looks like
When AI use is working, everyone in the firm knows which tools are approved and what may go into them, without looking it up. AI handles routine reading and first drafts, and a person checks every output before it's relied on or sent. Each matter shows which work was AI-assisted and who reviewed it. Partners can answer a client or regulator who asks how the firm uses AI, in a sentence. And people spend the time they get back on the parts of the work only a lawyer can do.
When that stops working
A good policy and built-in features take most small firms a long way. These are the signs you need more:
The useful task needs data from several systems
, such as a matter summary drawing on the PMS, documents and email, and built-in features can't reach it.
People are working around the policy
because the approved tools can't do what they need.
There's no record
of what was AI-drafted and who reviewed it, so supervision depends on trust.
Each tool's AI behaves differently
, and nobody trusts any of them.
You want AI to use your own templates, precedents and tone
, not the vendor's.
What a custom build looks like
A careful custom AI build for a law firm is small, specific and supervised. It runs on your firm's own accounts, connects to your PMS and document system through their official connections, and never sends anything to a client or court without a lawyer's approval. We build these for law firms in four steps - scope, build, roll out, improve.
Examples:
- Matter briefings. A one-page summary of a matter from the PMS, documents and recent correspondence, with every point linked to its source so the lawyer can check it.
- Drafts from your precedents. Routine letters and emails drafted from your own templates and matter data, queued for a lawyer to review.
- Incoming document triage. New documents classified and filed to the right matter, with a person confirming.
- An approval trail. Every AI-assisted draft is labelled, and every review is recorded with who approved it and when, which makes supervision visible.
- Data rules built in. The build only sends the information each task needs, only to AI services your firm has approved under its own contract, and logs what was sent.
Internal tools like this often sit in a simple hub the team already opens, like the team hub we built for an agency. Rolling out matters as much as building: we train fee-earners and support colleagues, start with the people who'll use it most, and answer "will this replace me?" honestly. It won't. AI drafts; your people decide.
Our guide to AI automation agency pricing covers what the market charges. Forge's prices are on the pricing page: a two-week ops audit at $2,500 (£2,000), credited to your first month, then a monthly plan at $2,000, $3,500 or $7,500 a month (£1,600, £2,800 or £6,000), with your first build included. The software runs on your own accounts, so you own it and pay those tool costs directly; we keep it monitored and fixed.
A good first AI project is often intake, where the volume is high and every output is reviewed anyway. See our guide to client intake automation for law firms.
Who gets time back, and what they do with it
The early wins usually go to the people doing the most routine reading and writing: paralegals, trainees, secretaries and junior associates.
When thread summaries and routine drafts are prepared for them, your paralegal spends the time on the substantive parts of the file. Your associate picks up an unfamiliar matter in ten minutes instead of an hour, and spends the difference thinking about the client's problem - for example, spotting a limitation issue early because she had time to read the key documents properly. Your partners supervise with a clear record of what was AI-assisted, rather than wondering.
For example: three months at a 20-person firm
Take, for example, a 20-person firm with commercial property, employment and private client teams. A survey of staff finds that seven people already use a free chat assistant, two of them occasionally on client emails, and nobody has told a partner.
In the first month, the managing partner names herself as owner and asks Dan, the practice manager, to run the work. Dan lists the AI features already included in the firm's PMS and document system, reads each vendor's data terms, and drafts a one-page policy. The free chat assistant is not approved for any client information. The PMS's built-in summarising feature is approved for matter documents, because it runs under terms the firm has already reviewed.
In the second month, the employment team starts with two uses: summarising long email threads before a lawyer picks up a file, and drafting routine client update letters from the firm's own templates. Every output is reviewed by the lawyer on the matter, and a one-line note goes on the file.
In the third month, Dan reviews what happened. The thread summaries are saving associates real time and nobody has found an error that wasn't caught at review. The update letters needed more editing than expected, so the team rewrites the templates. Private client joins next. Nobody has pasted client information into an unapproved tool, because the approved one does the job.
Nothing in that example needs a custom build. It needs an owner, a short policy and features the firm already has, used carefully.
Rolling it out and training the team
Train by role.
Fee-earners need to know what to check and how to record review. Support staff need to know which tools are approved and what data may go in. Supervisors need to know how to spot AI-assisted work and review it.
Use real, anonymised examples.
Show a good summary, a summary with a subtle error, and a draft with an invented citation. People learn to check by seeing what goes wrong.
Keep the policy where people work
, linked from the PMS home page or intranet, not buried in a handbook.
Make it safe to ask.
Someone unsure whether a use is allowed should be able to ask the owner and get an answer that day.
Revisit training when tools change.
Vendors add AI features often; a quick update when something new is switched on beats a yearly refresher.
Answer the worry honestly.
Many people wonder whether AI means fewer jobs. In a firm that uses it well, it means less routine typing and more time on judgement, clients and craft.
How to know it worked
Track a few simple measures for a month before and for each month after:
Time on the routine task
, such as picking up a file or drafting an update letter.
Review findings:
how often reviewers corrected an AI output, and what kind of error it was.
Recording rate:
what share of AI-assisted work has a note on the file.
Policy questions:
what people ask the owner, which shows where the policy is unclear.
Unapproved use:
whether people still reach for tools outside the policy, and why.
If time falls, errors are caught at review and the record is complete, it's working. If unapproved use continues, the approved tools probably aren't meeting a real need, which is useful to know.
Supervision
Supervision of AI-assisted work is the same duty as supervision of any other work, applied to a new source of drafts. The supervising lawyer knows which work was AI-assisted, reviews it against the source, and is satisfied with it before it goes to a client or court. Junior and non-qualified colleagues get closer review while they learn what AI gets wrong. And the firm keeps the record, so a supervisor can see the trail later, not just trust that it happened.
Confidentiality and data protection
This section summarises the main professional duties that apply. It is general information, not legal advice; take advice on your own firm's position.
Where data lives
Anything we build runs on your firm's own accounts, stores data in your existing systems, and sends information only to AI services your firm has approved under its own terms. Nothing is held on Forge accounts.
Access controls
Tools follow your existing roles and matter permissions, so AI features can only see what the person using them can see.
UK firms
The SRA's guidance on confidentiality of client information explains that paragraph 6.3 of the Codes of Conduct requires you to keep the affairs of current and former clients confidential. The SRA's August 2026 warning notice highlights the risk of client information being entered into AI tools without adequate safeguards, and expects appropriate oversight and controls (Law Society of Ireland Gazette, August 2026). Under UK GDPR, the ICO's guide to data security explains the duty to use appropriate technical and organisational measures.
US firms
ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorised access to, or inadvertent disclosure of, information relating to a client's representation. ABA Formal Opinion 512 (July 2024) applies the duties of competence, confidentiality, communication, supervision and reasonable fees to generative AI. Check your state's rules and any state bar guidance on AI.
Supervision
Whatever the jurisdiction, a lawyer remains responsible for work produced with AI. Build the review step into the tool, not just the policy.
Questions, answered plainly
Is it safe for a small law firm to use AI?
It can be, with an approved list of tools, clear rules on what client information may go into them, a lawyer reviewing every output that matters, and a record of AI use. The SRA and ABA have both issued guidance; read it before you start.
What can a law firm safely automate with AI?
Lower-risk, easily checked work: summarising correspondence, drafting routine letters from your templates, turning notes into tasks, and first-pass document filing confirmed by a person. Keep legal advice, court filings and judgement calls with lawyers.
Can lawyers put client information into ChatGPT or similar tools?
Only into tools the firm has vetted and approved under suitable contract and data terms, and only where that's consistent with your confidentiality duties. Many firms prohibit client information in free consumer tools.
Who is responsible for AI-generated work in a law firm?
The lawyer. Regulators expect firms to have oversight and controls, verify AI output, and supervise colleagues who use AI, so the review step needs to be real and recorded.
How much does a custom AI build cost for a law firm?
Market prices vary; our AI automation agency pricing guide covers them. With Forge, a two-week ops audit is $2,500 (£2,000), credited to your first month, then $2,000, $3,500 or $7,500 a month (£1,600, £2,800 or £6,000) with your first build included.