CONFIDENTIALITY AND AI POLICY FOR IB LAW FIRM
1. POLICY OVERVIEW
1.1 Purpose This policy establishes guidelines for the responsible use of artificial intelligence tools and technologies in our legal practice to ensure compliance with professional obligations, protect client confidentiality, and maintain the quality of legal services.
1.2 UsersThis policy applies to all attorneys, paralegals, staff members, and contractors (collectively, "Users") who may use AI tools in connection with firm business or client matters.
1.3 AI ToolsAI Tools refer to computer systems and software applications that can perform tasks typically requiring human intelligence, including but not limited to:
- Machine Learning: Systems that learn and improve from data without explicit programming
- Natural Language Processing: Technology that understands, interprets, and generates human language
- Predictive Analytics: Tools that analyze data to forecast outcomes or identify patterns
- Document Analysis: Software that can read, categorize, and extract information from documents
- Voice Recognition: Systems that convert speech to text or respond to voice commands
AI Tools may include, without limitations: Generative AI, such as ChatGPT, Claude, or DeepSeek, Lexis+ AI, or similar tools; practice management tools, such as Clio, MyCase, billing software, or the like; document analysis tools, such as CoPilot features in MS Office or Adobe; transcription tools and other AI tools.
2. PERMITTED AI USES
2.1 Human oversight is crucial. For any of the below-listed instances of AI use, Users must always check the accuracy of the end product, including checking for accuracy all cited authorities, descriptions of facts, evidence, timelines, and any analytical summaries.
2.2 Research and AnalysisSubject to the terms of this Policy, Users may use AI Tools for research and analysis of current law, precedents, and potential legal arguments. The AI Tools use may include, without limitation:
- Legal research assistance and case law analysis
- Document review for discovery (with human oversight)
- Contract analysis and comparison
- Regulatory compliance research
- Citation checking and verification
2.3 Administrative TasksSubject to the terms of this Policy, Users may use AI Tools for administrative tasks, such as, without limitations:
- Meeting scheduling and calendar management
- Time entry assistance
- Internal document organization
- Template creation for routine documents
- Proofreading and editing assistance
2.4 Communication SupportSubject to the terms of this Policy, Users may use AI Tools in facilitating effective communication. For example, Users may, with the help of AI Tools:
- Create first drafts of emails (with attorney review)
- Analyze client intake forms
- Translate documents
- Transcribe and summarize meetings
3. PROHIBITED AI USES
3.1 Strictly ForbiddenUsers are strictly prohibited from submitting and/or sharing any product created
solely by AI Tools, in the following manner:
- Sending it to anyone without the supervising attorney's review
- Filing and/or submitting it in any institution or organization, including courts, court clerks, or governmental agencies, without human verification
- Inserting any person's signature on the product without that person's review
- Submitting in any manner the AI Tools product that involves privileged information, such as attorney-client privileged communications, attorney's work product, attorney's mental impressions and strategy, or information protected by protective orders or confidentiality agreements.
3.2 High-Risk Activities Requiring Special AuthorizationUsers may not use AI Tools for:
- Processing highly sensitive client data
- Analysis of international matters involving foreign data laws
- Analysis of information involving security clearance matters
- Any information involving minors
- Any confidential or proprietary information, including know-how, trade secrets, or otherwise protected information.
Notwithstanding the generality of the above sentence, Users may use AI Tools in the above-listed manner only on closed system AI Tools providers that abide by strict confidentiality and privacy rules aligned with IB Law Firm's Privacy and Confidentiality Policies, and provided that in each case that Users desire to use AI Tools according to this Paragraph, they must seek prior authorization of the supervisor for such use of AI Tools.
4. CLIENT CONFIDENTIALITY REQUIREMENTS
4.1 Data Protection StandardsSubject to the terms of this Policy, when using AI Tools in relation to a client's personal data (such as name, age, or any other identification information) Users must:
- Obtain client's consent before using AI tools with client's personal data
- Use only necessary information
- Avoid inputting unnecessary detail
- Remove, anonymize, or redact the identifying information when possible
4.2 Prohibited Platforms- Users may not use AI Tools that do not have data protection guarantees, do not comply with IB Law Firm's Privacy and Confidentiality Policies, or are known to be insecure.
5. SUPERVISION AND COMPETENCE
5.1 Competence Requirements All Users who are Attorneys must understand AI Tools' capabilities and limitations and strive to continuously educate themselves about current AI developments. Users, especially attorneys and paralegals, must know the applicable professional conduct standards as they relate to AI.
All Users must strive to obtain technical competence in using AI Tools responsibly.
All Users must familiarize themselves with AI Tools they are using, including each AI Tool's policies and practices of dealing with private or confidential information.
5.2 Supervision Requirements All AI-generated work must be reviewed by a licensed attorney before any submission or sharing of the work with anyone outside of IB Law Firm. This includes not only filing or submission, but also sending the work to clients, opposing counsel, or vendors. All Non-attorney Users must be properly supervised.
5.3 DocumentationAll Users must clearly indicate, to the extent practicable, on any intermediate work product or drafts, which portions were created with the use of generative AI Tools. For example, "Summary of facts created by ChatGPT," or "list of authorities created by Claude."
6. QUALITY CONTROL PROCEDURES
6.1 Verification RequirementsUsers must verify generative AI products for the sources of information, where possible. All AI prompts must contain a verification requirement, such as: "Please, include the supporting data," "provide references for your response," or "use only verifiable data for your response."
6.3 Error PreventionUsers shall
never rely solely on AI Tools for legal conclusions. Users must always verify citations and legal authorities and cross-reference AI research with primary sources. Where possible, Users must implement peer review for complex AI-assisted work.
7. VENDOR MANAGEMENT
7.1 AI Vendor RequirementsPrior to using vendors in the course of performance of legal services, and if it is reasonably foreseeable that such a vendor will use AI Tools in performing its vendor obligations, Users must reasonably verify that the vendor's use of AI Tools will not violate IB Law Firm's Privacy, Confidentiality, and AI policies. The verification may include, where applicable:
- Review of vendor agreements
- Review of vendor's data security policies
- Review of vendor's data retention/deletion policies
- Review of vendor's professional liability coverage
- Review of vendor's cybersecurity liability coverage
- Identifying the data hosting locations
8. BILLING
9.1 Billing for Legal Services Performed Using AI ToolsAttorneys and paralegals may bill for the activities of using AI Tools only if the activities directly relate to the legal services performed for the clients. Users may not bill for the time spent using AI Tools for AI training.
For example, Users may bill for the time spent reviewing documents with the help of AI Tools, or researching and analyzing issues related to the representation of clients.
9. INCIDENT RESPONSE
9.1 Security Breach ProtocolIf any User is made aware of a potential security breach, he/she should follow the following steps:
- Immediate: Disconnect affected systems
- Within 1 Hour: Notify the supervisor and the firm's IT security lead
- Within 24 Hours: Assess scope and notify clients if necessary
- Within 72 Hours: Report to relevant authorities if required
- Ongoing: Document the incident and implement corrective measures
10. COMPLIANCE MONITORING
10.1 Audit RequirementsUsers must regularly audit the confidentiality status of the files, including:
- Quarterly backup of files
- Annual comprehensive policy compliance review
- Annual vendor security assessments
- Regular monitoring for security incidents
- At least one hour a year of training on AI and/or technology for Attorneys