Scope
Who it applies to.
Lawyers practicing in a jurisdiction that has adopted some version of the ABA Model Rules. The critical point: the Model Rules are models and have no binding force of their own — the American Bar Association regulates no one. You are bound only by the rules your jurisdiction’s highest court has actually adopted, and states freely renumber, amend, or decline individual provisions. Most states track the model text closely; California maintains its own separately drafted set. Read your state’s rule, not the model.
- Rule 1.6(c) — reasonable efforts
- Rule 1.6 treats information relating to a representation as confidential regardless of where it came from. Subsection (c) adds an affirmative duty to make reasonable efforts to prevent inadvertent or unauthorized disclosure of, or access to, that information. “Reasonable” is a sliding scale: Comment [18] points to the sensitivity of the information, the likelihood of disclosure, the cost and difficulty of safeguards, and whether a safeguard would hamper the representation itself.
- Rule 1.1 Comment [8] — technology competence
- Comment [8], added in 2012 on the recommendation of the ABA Commission on Ethics 20/20, folds technology into the competence duty: keeping abreast of changes in the law and its practice includes the benefits and risks of relevant technology. Most jurisdictions have since adopted some version of it. Formal Opinion 512 applies it to AI — understand a tool’s capabilities and limits before use, and revisit that understanding as the tool changes.
- Rule 5.3 — supervising nonlawyer assistance
- Retitled in 2012 from “Nonlawyer Assistants” to “Nonlawyer Assistance,” the rule reaches help obtained outside the firm, not just employees. Subsection (a) requires managerial lawyers to put firm-wide measures in place; (b) requires direct supervisors to make reasonable efforts to ensure conforming conduct; (c) assigns personal responsibility for misconduct a lawyer orders or ratifies. Comment [3] names outside document, investigative, and data-storage providers.
- Informed consent — Rules 1.6(a) & 1.0(e)
- Rule 1.6(a) permits disclosure with the client’s informed consent, and Rule 1.0(e) defines that as agreement given after an adequate explanation of the material risks and reasonably available alternatives. Formal Opinion 512 concludes that general boilerplate in an engagement letter purporting to authorize AI use does not satisfy this — the client needs specifics about what will be disclosed, who could reach it, and how it might be used against their interests.
- Formal Opinion 512 — generative AI
- Issued July 29, 2024, Formal Opinion 512 concludes that self-learning generative AI tools by their nature risk surfacing one client’s information in output produced for another matter — so client informed consent is required before inputting information relating to a representation into such a tool. It also directs every lawyer to read and understand the tool’s terms of use and privacy policy, or to rely on a qualified colleague or expert who has.
- Formal Opinions 477R & 483 — transmission and breach
- Opinion 477R (2017) rejects any single mandated security measure in favor of a fact-specific analysis, and notes that special precautions may be required when the law or the sensitivity of the information demands a higher degree of security. Opinion 483 (2018) addresses what follows an electronic data breach: act promptly to stop and mitigate it, and notify current clients where material client information is involved.
The vendor & sub-processor obligation
What it puts on you.
When a cloud or AI provider can technically reach client material, a lawyer must take reasonable steps to ensure that vendor’s conduct is compatible with the lawyer’s obligations — effectively supervising each provider in the data path.
How self-hosting addresses it
Remove the third party, remove the burden.
A system that keeps client material inside the firm, with no third party able to read it, answers the confidentiality and supervision questions before they are asked. (Rules vary by jurisdiction; consult your counsel.)
How FileFerret applies
Rule 5.3 and Formal Opinion 512 both attach at the moment an outside provider can reach client material. An appliance that runs indexing, search, and generation inside the firm means that material is not disclosed to a third party at all, which narrows the vendor-supervision and informed-consent analysis considerably. It does not discharge your Rule 1.6(c) duty to secure the system you now operate yourself. See how it’s built →
Full, current text is maintained at the official source: ABA Model Rules of Professional Conduct 1.6 & 5.3.
Enforcement
Who enforces it, and how.
The ABA neither licenses nor disciplines lawyers. Enforcement runs through your jurisdiction’s disciplinary authority — typically an arm of the state’s highest court — applying the state’s own adopted rule, not the model text. Sanctions range from private admonition through public reprimand, suspension, and disbarment. Civil exposure is separate and additive: the Scope section provides that violating a rule is not itself a cause of action, but courts commonly treat it as evidence of the standard of care in malpractice claims, and may order fee forfeiture or disqualification.
Common questions
Questions firms ask.
Does putting client files into a cloud AI tool require client consent?
Under Formal Opinion 512, if the tool is self-learning and you input information relating to a representation, yes — informed consent is required, because that information may resurface in another user’s output. A tool that demonstrably does not train on or retain inputs changes the risk analysis, but never removes the Rule 1.6(c) diligence duty. Boilerplate engagement-letter language is not informed consent.
The Model Rules are not law where I practice. Why do ABA opinions matter?
They are persuasive, not binding. ABA formal opinions interpret the model text only, but state ethics committees and disciplinary boards cite them regularly — and Opinion 512 itself draws on state opinions from California, Florida, Pennsylvania, and West Virginia. Where your state’s rule tracks the model wording, an ABA opinion is a fair predictor of how your regulator will read it. It is not a substitute for your own state’s guidance.
Does Rule 5.3 really apply to software, or only to people?
The 2012 retitling to “Nonlawyer Assistance” broadened the rule beyond firm employees, and Comment [3] extends it to outside providers including document and data-storage services. Formal Opinion 512 applies Rule 5.3(b) to AI providers directly, and points to concrete diligence steps drawn from earlier outsourcing and cloud-computing opinions: vendor credentials, security policies and protocols, confidentiality agreements, and an accessible forum for relief.