A model predicts the next token. It does not know the law. Hallucination is only one failure. Wrong quotes, mashed holdings, invented docket numbers, and confident nonsense in a polished memo all count. An ordinary chatbot can sit in a window until someone checks it. An agent can file, send, or delete first.
California’s 2026 bar guidance treats agentic systems as part of the competence analysis. The controls that follow are not exotic: least privilege, no unattended outbound actions, a human gate before anything leaves the firm, logs, and a way to shut the thing off. Prompt injection (instructions hidden in a page, an email, or a PDF) belongs in the same conversation. If you cannot ask a vendor how they handle it, you are not ready to put client text in the box.
The model rules did not get a carve-out
The ABA and bars in Alabama, Alaska, California, D.C., Florida, Illinois, Kentucky, Mississippi, New Jersey, New Mexico, New York, North Carolina, Oregon, Pennsylvania, Texas, Virginia, Washington, and West Virginia have all spoken in opinions, guidelines, or toolkits. The through line is boring and useful. Existing rules apply.
Rule 1.1: know the tool’s limits before you rely on it. Rule 1.6: client information does not become free training data because the interface is convenient. Rules 5.1 and 5.3: partners supervise the software and the people using it with the same seriousness they give a junior associate. Rule 3.3: you own the filing. Rule 1.5: you bill time you spent, not time the task “would have taken” in 2019.
A few states are sharper. West Virginia LEO 24-01 wants written informed consent before confidential matter goes into generative tools. Florida Opinion 24-1 spends time on marketing: fake voices, synthetic faces, and unverified claims about predictive accuracy. Virginia LEO 1901 is blunt on money. Hourly billing cannot invent hours the model erased. Efficiency pushes toward fixed or value fees for some of this work.
If the firm does not pick tools, the staff will
Shadow AI is a management failure. People will use the free consumer product if the approved stack is slow or missing. A real program names owners (ethics, security, privacy, IT, practice leads), keeps an inventory of what is in use including features buried inside other software, and draws a line between allowed and banned uses.
Contracts should say no training on firm inputs unless someone with authority says yes. Retention and deletion need dates, not slogans. Security, audit rights, and liability should match the harm if a transcript leaks. You can negotiate those terms. You cannot assign Rule 1.6 to the vendor’s form.
Learning the product on the client’s dime is another easy ethics miss. Several opinions warn against it. Bill the actual review. Do not bill a fantasy first draft that never existed as lawyer time.
Courts have stopped treating fake cites as a novelty
Mata v. Avianca in 2023 was the warning shot. 2026 is the enforcement year. In Lnu v. Blanche, the Ninth Circuit suspended two lawyers for six months after fabricated citations and a weak story after the court asked questions. Alabama, Mississippi, New York, and Texas courts have issued reprimands, fines, and bar referrals. Some judges now expect you to catch the other side’s invented authorities too. Ignorance of the generator is not a defense.
E-discovery still rests on process, sampling, validation, and human review, the Da Silva Moore line, not on a vendor’s claim that the model is transparent. For AI-touched evidence, FRE 901 and 702 still do the work. Watch proposed Rule 707 if it moves. Standing orders already differ judge to judge. Read them per matter.
Privilege is not a safe harbor yet
The elements have not changed: confidential communication, right people, legal advice. Routing that communication through a third-party model raises waiver if the disclosure was not reasonably necessary or if the terms wreck any expectation of confidentiality. Enterprise contracts and tight process lower the risk. No court has given a categorical pass.
United States v. Heppner refused privilege and work product for documents a defendant made alone in a consumer tool. The court said the bot was not counsel and the consumer terms undercut confidentiality. It left open what happens when counsel directs an enterprise product. Warner v. Gilbarco treated the tool as a tool and protected a pro se plaintiff’s analysis. Morgan v. V2X saw possible work product and still tightened a protective order so confidential discovery would not go into mainstream models without real contractual guards.
Facts about the product, the terms, and who pointed the work decide these cases. None of them is a green light to dump a client file into a public chat.
Disclosure rules will stay messy
There is no national rule that you must tell a client or a court every time a model touched a paragraph. Materiality, local ethics, and standing orders control. West Virginia’s written-consent view is the strict end. New York Part 161, Florida’s amended filing rule, and Rhode Island’s interim guidelines took different paths in a short window. A suggested federal Rule 11 tweak on citation certification is still early. Build a calendar to recheck this. Do not freeze a policy on last spring’s memo.
What to do Monday
Approve a short list of tools. Ban the rest for client matter. Turn off vendor training. Log agent actions. Require a lawyer’s eyes before send or file. Sample outputs the way you would sample a first-year’s research. Tell clients when the jurisdiction or the engagement letter requires it. Bill the minutes you actually worked.
The stack will change again next quarter. The duty will not. Understand the machine well enough to refuse it, constrain it, or stand behind what it drafted. That is the job.