Law firms are incorporating generative AI into research, document preparation, administrative work, and other everyday activities. As adoption expands, managing how employees use these tools becomes a continuing responsibility for firm leadership.
An approved AI platform may provide useful security features, but attorneys and staff still need to understand which information they can enter, when outputs require verification, and how to recognize a use case that needs additional review.
New industry research suggests that law firms are investing more attention in these responsibilities.
The 2027 Best Law Firms U.S. Legal Market Report, released November 5, 2026, found that AI implementation and related governance practices have increased among surveyed law firms.
For managing partners and firm administrators, the findings offer a reason to examine whether employee guidance and security controls have kept pace with the firm's use of AI.
What should law firms include in AI training?
Law firm AI training should explain which applications and uses are approved, how confidential client information must be handled, when AI-generated work requires verification, and how employees can report concerns or request approval for new uses.
Training should reflect the responsibilities of attorneys, paralegals, administrative personnel, and others using AI as part of their work.
It should also be supported by clear policies, appropriate technology controls, and defined oversight responsibilities.
New research shows law firms are expanding AI implementation
Best Lawyers' November 2026 report draws on survey responses from 5,753 U.S. law firms.
Among respondents with 20 or more lawyers, 28% reported fully implementing generative AI across multiple practice areas, compared with 11% in the previous year's survey.
The report also found that the share of surveyed firms providing training on AI limitations and risks rose from 22% to 63%.
The proportion reporting policies for AI use in client matters increased from 14% to 47%.
These findings describe the survey population rather than every U.S. law firm. They do, however, show that participating firms are paying greater attention to how AI is used and managed.
For smaller and midsize firms, the practical challenge may be establishing those processes without a dedicated AI governance or information-security department.
Training can be an important starting point, but it needs to address the actual tasks employees perform.
Employees need to understand which AI activities are permitted
An AI policy may identify approved applications, but employees also need guidance on acceptable activities within those platforms.
A tool approved for administrative writing may not be appropriate for every client-related task.
For example, a legal assistant may use AI to help organize a general office procedure, while an attorney considering AI-assisted analysis of confidential matter documents may need a different level of authorization and review.
The distinction should be explained before employees begin using the application.
Training should address which tools are approved, what they can be used for, and how to request approval for new workflows.
Employees should also understand that an AI feature introduced into existing software may require evaluation even when the underlying application has been used for years.
Providing a clear process for new requests makes it easier for employees to follow the firm's governance procedures.
Confidentiality training should include realistic work scenarios
Law firms handle information that may be confidential, privileged, contractually restricted, or otherwise sensitive.
Employees need to understand how AI applications process information and which categories of client material are permitted in approved tools.
The American Bar Association's Formal Opinion 512, published in July 2024, discusses lawyers' responsibilities when using generative AI, including competence, confidentiality, communication, supervision, and other professional obligations.
The opinion does not establish a universal set of technology settings that every law firm must implement. Applicable duties depend on the circumstances and relevant professional-conduct rules.
A useful training exercise might involve an employee preparing a document summary for an attorney.
Before entering information into an AI application, the employee should know whether the tool is approved for that purpose, whether the material contains restricted information, and whether additional safeguards or authorization are necessary.
Training should also cover circumstances in which employees should stop and seek guidance.
These examples help staff apply confidentiality requirements to real work rather than relying solely on general policy statements.
Verification procedures should match the work being performed
Generative AI can produce text that appears convincing even when its information is inaccurate.
For legal work, errors involving citations, factual statements, quotations, or legal analysis can have consequences.
Firms should establish procedures for reviewing AI-generated work based on its intended use.
A draft of an internal administrative announcement may require less scrutiny than legal research supporting a court filing.
ABA Formal Opinion 512 addresses the professional responsibilities lawyers must consider when relying on generative AI, including competence and candor toward tribunals.
Training should therefore explain who reviews AI-assisted work and how verification is performed.
For legal research, that may include checking cited authorities against reliable primary sources.
For document analysis, it may involve reviewing the underlying material to confirm that the AI output accurately reflects the source.
For client-facing communications, the responsible attorney may need to consider accuracy, confidentiality, and any applicable disclosure obligations.
The appropriate procedure should be documented so that employees understand what is expected.
AI training should vary by employee responsibility
Attorneys, paralegals, administrative employees, and IT personnel may use the same AI platform in different ways.
Their training should reflect those differences.
For example:
|
Role |
Useful training focus |
|---|---|
|
Attorneys |
Verification of AI-assisted legal work, confidentiality, professional judgment, and applicable client communication duties |
|
Paralegals and legal assistants |
Approved workflows, document handling, escalation, and attorney-review procedures |
|
Administrative employees |
Permitted tools, sensitive information, and appropriate use in communications and office workflows |
|
IT and operations personnel |
Application approvals, access permissions, integrations, vendor changes, and incident escalation |
|
Firm leadership |
Governance ownership, policy review, accountability, and significant risk decisions |
These examples are suggested training topics, not a mandatory curriculum.
A firm should adapt its training to the applications it uses, the responsibilities of its employees, and the risks associated with its work.
Security controls should reinforce employee guidance
Training helps employees understand expectations. Technology controls can support those expectations by limiting unnecessary access and identifying certain activities that require attention.
For example, a firm may restrict which employees can use a particular AI application or limit the documents an integrated tool can access.
Depending on the platform, the firm may also have options for controlling account access, reviewing application permissions, or monitoring relevant activity.
Before expanding use of an AI platform, the firm should evaluate:
- Which employees and roles have access.
- Whether permissions match approved responsibilities.
- Which document repositories and applications are connected.
- Who can authorize new integrations.
- How access is removed when someone leaves the firm.
- Which activities can be reviewed when a concern arises.
Technical capabilities vary by product and configuration. Firms should confirm which controls are available and whether they operate as intended.
These reviews can be included in existing cybersecurity and information-governance processes.
Ongoing training matters when AI capabilities change
A firm may approve an AI application for a limited purpose, then expand its use as new features become available.
Employees may begin working with additional document types, connecting new information repositories, or using AI features introduced through another vendor.
Those changes can affect the firm's original governance decisions.
Rather than treating training as a single presentation during implementation, firms should establish a process for communicating material changes.
For example, an update may be appropriate when a newly approved workflow involves confidential client information or when an application gains additional access to firm systems.
The firm should document who is responsible for reviewing such changes and communicating revised requirements to employees.
Training records can also help leadership understand which guidance has been delivered and where additional attention may be needed.
How can law firms check whether AI guidance is being followed?
A practical AI governance review can compare the firm's written expectations with its actual applications, permissions, and employee workflows.
For example, leadership can examine whether its approved-tool inventory is current, whether employees understand their permitted use cases, and whether appropriate review procedures have been established.
The review may also identify questions that need further investigation.
An employee may be using an approved application for a new purpose that was never evaluated. A vendor may have introduced additional features. A firm's written instructions may no longer match its current technology environment.
Useful review questions include:
- Do employees know which AI tools are approved?
- Are restrictions on confidential client information clearly explained?
- Have attorneys and staff received training relevant to their responsibilities?
- Are AI-generated legal materials subject to appropriate verification?
- Have application permissions and integrations been reviewed?
- Does the firm have a process for approving new uses and addressing concerns?
These questions provide a starting point for assessing implementation. They do not replace legal ethics analysis or establish compliance with every applicable professional obligation.
For firms that have recently approved an AI application, AvTek's guidance in 7 Questions Every Business Should Answer Before Expanding Its Use of AI provides additional context on data access, security responsibilities, and governance.
Supporting secure AI adoption in law firms
AvTek Solutions helps organizations evaluate AI-related cybersecurity and business risks and establish practical governance processes.
Its AI Governance Services include AI risk assessments, acceptable-use policies, approved-tool standards, data-protection guidance, defined responsibilities, and ongoing governance support.
For law firms, these services can help identify gaps between approved AI practices and the technology employees are using.
AvTek also provides vCISO Services for organizations that need cybersecurity leadership, policy and documentation support, risk assessments, and remediation planning.
These services can complement a law firm's internal training and governance efforts. Decisions involving attorney ethics, client obligations, and legal work-product review remain the responsibility of qualified legal professionals.
As firms expand AI use, reviewing employee guidance and supporting security controls can help leadership make more informed decisions about how the technology is adopted.
Talk with AvTek about an AI Governance Assessment for your law firm.
