AI policy for law firms in Tennessee: what to put in writing

Why this matters now

A 2026 survey of more than 1,300 legal professionals (8am's legal industry report, as summarized by the North Carolina Bar Association) found that 43% said their firm had no AI policy and no plans for one. Only 9% reported a written policy that is actually enforced, and 54% said no responsible-AI training had been provided.

That gap is the risk. Staff are already using AI tools, whether the firm has approved them or not. An unwritten rule is just a habit, and one lawyer pasting a client's facts into a free chatbot is enough to create a confidentiality problem.

The American Bar Association addressed this in Formal Opinion 512 (July 2024), which ties generative AI use to existing duties: competence, confidentiality, communication with clients, supervision, and reasonable fees. A policy is how a firm shows those duties are being met in practice.

What to put in a law firm AI policy

• Approved tools, by name and plan. List exactly which tools are allowed and on which account type. A paid business plan with no training on your data is different from a free personal account. Ban the free and personal ones for client work.
• What may never be entered. Client names, matter details, privileged communications, opposing-party information, sealed material, Social Security numbers, health information. Say it in plain words and give examples.
• Review before anything leaves the firm. A lawyer verifies every citation, quotation, and factual claim in AI-assisted work. Courts have sanctioned lawyers for filing AI-invented cases. The policy should make human verification non-negotiable.
• Supervision. Partners are responsible for how associates, paralegals, and staff use these tools. Name who owns the policy.
• Client communication and billing. Decide when clients are told about AI use, check engagement letters and outside-counsel guidelines (some clients restrict AI), and bill for time actually spent, not time the tool saved.
• Vendor review. Before approving a tool, check where data is stored, whether it is used to train models, how long it is retained, and whether you can delete it.
• Incident reporting. If something sensitive goes into the wrong tool, staff report it right away with no blame for prompt reporting. Decide in advance who assesses whether notice to the client is needed.
• Training and review dates. Short training at hire and yearly, and a policy review every six months. The tools change fast.

Common mistakes

• Banning AI entirely. Staff keep using it on personal devices, and now you can't see it.
• Writing it once and filing it. A policy nobody trains on or enforces counts as no policy.
• Trusting the vendor's marketing. "Enterprise" or "secure" means little until you've read the data terms.
• Forgetting the browser extensions and built-in features. AI now shows up inside email, document, and practice-management software your firm already uses.

A practical way to start this month

First, ask everyone at the firm which AI tools they use today. Expect surprises. Second, pick one approved tool and one owner. Third, adopt a short written policy and walk the team through it in a 30-minute meeting. Fourth, put a six-month review on the calendar. I've published a free one-page template you can edit.

If you're in Nashville or Middle Tennessee, the Tennessee Bar Association has an AI Primer scheduled for December 10 and an "AI and the Law" conference on December 11 in Nashville. Confirm details with the TBA before you plan around them.

Frequently asked questions

Does a Tennessee law firm need a written AI policy?

No Tennessee rule I am aware of requires a stand-alone AI policy, but the Rules of Professional Conduct on competence, confidentiality, and supervision apply to AI use. A written policy is the practical way to show you are meeting them. Confirm current requirements with the Tennessee Board of Professional Responsibility or your ethics counsel.

Can lawyers put client information into ChatGPT?

Not into a free or personal account. Confidentiality duties apply to anything you enter. If a firm uses an AI tool at all for client work, it should be an approved business-grade plan whose data terms the firm has reviewed, and the policy should say exactly what may and may not be entered.

How long should a law firm AI policy be?

One to two pages is enough to start. It should be short enough that people read it and specific enough that they know what to do. Longer procedures can sit behind it.

Who should own the AI policy at a small firm?

A named partner, managing attorney, or firm administrator. One person should be accountable for the approved-tool list, training, and the six-month review.

Can you help us write one?

Yes. The AI Opportunity Audit includes a policy draft fitted to your firm and tools, for your counsel to review. I am not a lawyer and do not give legal advice.

By Dane Hale, Franklin, Tennessee. Published and last updated October 2026. General information, not legal advice.