What the rules require
Last revised July 2026
This is a summary of the professional-conduct authorities that apply when a firm uses generative AI. Every source is linked, and the summary is short enough that you can check it against the originals in an afternoon. We would rather you did.
We are not attorneys and we do not practice law. Nothing here is legal advice, and none of it substitutes for your own reading of rules you are the one bound by. What we do is the technical work these rules govern: choosing tools, configuring them, and documenting where client information travels.
The two opinions written for AI
ABA Formal Opinion 512 (29 July 2024) was the first formal ABA ethics opinion on generative AI. It creates no new rules. It applies existing ones, across six areas: competence, confidentiality, communication with the client, candor toward the tribunal, supervision, and reasonable fees.
Two of its conclusions surprise people. On fees, a lawyer generally may not bill a client for time spent learning to use a tool, may bill for time actually spent using it, and may pass through the tool's cost only on prior agreement. On confidentiality, a tool that trains on what you put into it is treated differently from one that does not: entering information relating to a representation into a self-learning tool calls for informed client consent, not merely a judgment that the vendor seems reputable.
Texas Opinion 705 (February 2025) reaches the same place under the Texas Disciplinary Rules. It was issued at the request of the State Bar's Taskforce for Responsible AI in the Law. Its requirements are that a lawyer understand the tool well enough to judge its output, independently verify what it produces before relying on it, protect confidentiality when providing it with client information, and supervise the work it does. The duty to supervise attaches to the work itself, whether a person or a system performed it.
Texas does not use the ABA's rule numbers
The Texas rules are based on the Model Rules but numbered differently, and the two are routinely conflated in commentary written for a national audience. If a vendor cites Model Rule 1.6 to you as though it were your confidentiality rule, that is a reasonable signal about where their knowledge came from.
| Duty | ABA Model Rule | Texas Disciplinary Rule |
|---|---|---|
| Competence | 1.1 | 1.01 |
| Confidentiality | 1.6 | 1.05 |
| Communication with the client | 1.4 | 1.03 |
| Fees | 1.5 | 1.04 |
| Candor toward the tribunal | 3.3 | 3.03 |
| Supervision | 5.1 / 5.3 | 5.01 / 5.03 |
Worth noting that the underlying duty is not new in Texas. Comment 8 to Rule 1.01 was amended in 2019 to address competence in relevant technology, five years before an AI opinion existed. Opinion 705 applies a duty Texas lawyers have carried for some time; it does not introduce one.
The authority that governs the tool, not the lawyer
The AI opinions address how a lawyer may use a tool. They sit on top of an older line of authority addressing a different question, and it is the question a firm actually asks us: where does client information go once a vendor is handling it?
ABA Formal Opinion 477R (2017) is the one that matters most to how we work. It sets the duty to make reasonable efforts to protect client information handled electronically, and it expects due diligence on the vendor: a fact-specific judgment about sensitivity, not a fixed checklist. Cloud tools are permissible; unexamined ones are not. Opinion 483 (2018) sets out what a lawyer must do after a breach, including notifying affected current clients. Opinion 498 (2021) addresses virtual practice, which now describes most small firms whether they call it that or not.
In practice this is why we ask for a vendor's terms in writing rather than accepting a page of marketing: whether the product trains on your inputs, how long it retains them, where it stores them, and what happens on termination. A tool that cannot answer those in writing has not been diligenced, whatever its certifications say.
What the statutes do not require
Two Texas statutes come up in conversation, usually with more alarm than they deserve. Both are worth knowing; neither is likely to govern an ordinary small firm's use of a drafting assistant.
The Texas Responsible AI Governance Act takes effect on 1 January 2026. It addresses particular uses (biometric identifiers, healthcare, behavioral manipulation, social scoring, unlawful discrimination, explicit content) and places disclosure duties chiefly on government agencies. Enforcement rests with the Attorney General alone, after notice and a sixty-day period to cure. A firm using a mainstream assistant to draft and summarize is, on its face, outside what the Act reaches.
The Texas Data Privacy and Security Act took effect in 2024 and carries small-business exemptions. Whether a particular firm falls inside it is a real question and a legal one, which makes it your call rather than ours.
Neither statute is a reason to delay. The obligations that actually bind a firm's AI use today are the professional-conduct rules above, and they were in force before either statute was written.
Why verification is the whole of it
The sanctions decisions that made attorneys wary of AI, the first widely reported being Mata v. Avianca (S.D.N.Y. 2023), did not turn on the use of a tool. They turned on filing its output without checking it. Courts have since cataloged a great many more. The rules do not ask a firm to avoid AI. They ask it to verify, to supervise, and to know where the file went. Those are process questions, and process is the part we can build.
Sources
Read these rather than take our summary for it.