The Small Firm Brief

The AI briefing for lawyers who didn't go to law school to become AI people.
Issue #3 · June 3, 2026

This week.

Three stories, one theme: the AI policy is not enough anymore.

The question courts, clients, carriers, and opposing counsel are going to ask is not whether your firm allows AI.

It is whether you can prove who used it, what they used it for, and what a lawyer verified before anything left the firm.

What's worth your attention.

1. Your AI policy is not a defense. Your file note might be.

The first two waves of lawyer-AI mistakes were easy to understand: fake cases, fake quotes, real sanctions.

The next wave is going to be less dramatic and more dangerous.

It will not always be a hallucinated citation. It will be a client asking whether confidential information went into the wrong tool. A carrier asking what safeguards were in place. A judge asking who checked the output. A disciplinary committee asking whether the supervising lawyer actually supervised.

That is why the AI policy sitting in your shared drive is not enough by itself.

A policy says what your firm intended to do.

A file note shows what you actually did.

For every client-facing AI-assisted work product, add one short note to the file:

• Tool used.
• Purpose of use.
• Whether confidential information was included.
• What the lawyer independently reviewed.
• Whether citations, quotes, calculations, and deadlines were verified from original sources.

This does not need to become a 14-page memo.

It needs to exist.

The ABA's generative AI ethics opinion is not subtle on the core duties: competence, confidentiality, communication, supervision, and reasonable fees still apply when AI is involved. AI changes the workflow. It does not move responsibility off the lawyer's signature block.

Source: ABA Formal Opinion 512

2. The smart firms are moving from "AI use" to "AI governance." Small firms need a lighter version.

Big firms are building AI committees, approval workflows, vendor reviews, training records, and audit trails.

Most small firms do not need that much machinery.

But they do need the small-firm version:

• Approved tools.
• Prohibited tools.
• Approved use cases.
• Client-data rules.
• Verification rules.
• A simple file-note requirement.

That is the minimum viable AI governance program for a small law firm.

Do not overbuild it.

A solo or five-lawyer firm does not need a Fortune 500 risk framework. But the NIST AI Risk Management Framework is useful for one reason: it breaks AI risk into plain operational buckets — govern, map, measure, manage. Translated into law firm English: decide the rules, identify the use case, check the risks, document the control.

If your policy does not answer "who checks what before it goes out," it is not a policy. It is a permission slip.

Source: NIST AI Risk Management Profile

3. Clients will eventually ask how you use AI. Have the answer before they ask.

Some clients will want you to use AI because they expect faster work and lower bills.

Some clients will not want you to use AI because they worry about confidentiality.

Both clients are asking the same question:

Do you know what you are doing?

That is why every small firm should have a one-paragraph client-facing AI explanation ready before the first uncomfortable conversation.

Not a marketing claim.

Not "we use cutting-edge artificial intelligence to transform legal services." Please don't write that.

Something plain:

Our firm may use approved AI tools to assist with drafting, summarizing, organizing, and reviewing information. A lawyer remains responsible for all legal judgment, strategy, citations, deadlines, and final work product. We do not use public AI tools with confidential client information unless specifically approved and appropriate safeguards are in place.

That paragraph will not solve every ethics issue.

It will stop you from improvising when a client asks the question on a call.

Tool of the week

A one-page AI use log — the cheapest risk-management tool in your firm.

Do not start with software.

Start with a spreadsheet.

Columns:

• Date.
• Matter.
• Tool.
• Task.
• Confidential information used? Yes/No.
• Output used in client-facing work? Yes/No.
• Lawyer review completed.
• Citations/quotes/deadlines verified.
• Reviewer initials.

That is enough for now.

It gives you a habit. It gives you a record. It gives your staff a reminder that AI output is not finished work product.

Most importantly, it forces the supervision step before the signature step.

Prompt of the week.

Create an AI file note after using a draft from Claude, Copilot, or ChatGPT Business.

Use this after the work is done. Do not paste confidential information into a tool unless your firm has approved that tool for confidential client data.

COPY & PASTE THIS PROMPT

You are helping me create a short internal file note documenting lawyer supervision of AI-assisted work. Do not add facts I do not provide. Do not evaluate legal strategy.

Create a concise file note with the following sections:

1. Matter/task: [brief description]
2. AI tool used: [tool name]
3. Purpose of AI use: [drafting, summarizing, outlining, editing, intake summary, etc.]
4. Client confidential information included: [yes/no; if yes, identify safeguard or approval]
5. Human review completed: [what I reviewed]
6. Independent verification completed: [citations, quotes, dates, calculations, deadlines, names, procedural rules, etc.]
7. Changes made by lawyer: [briefly describe]
8. Final responsibility: state that the lawyer independently reviewed and approved the final work product.

Keep the note under 200 words. Use neutral, professional language suitable for an internal client file.

One more thing.

The lawyers getting in trouble are not being punished for touching AI.

They are being punished for treating AI output like finished legal work.

That distinction matters.

Use the tool. Get the time back. Draft faster. Summarize faster. Organize faster.

But leave a record that a lawyer did the lawyer part.

Greg

Actionable AI | Less hype. More results.

P.S. Don't skip the supervision step.