Law Firm AI Confidentiality: What the Rules Require in 2026

Law and accounting firms can use AI on client work without breaching confidentiality, but only if three things line up: the right kind of tool, the right contract terms, and, in some cases, the client's informed consent. The short answer on law firm AI confidentiality is this. Consumer chat accounts should never see client information. Business and API tiers that bar training on your data, limit retention and promise breach notice can meet the "reasonable efforts" standard in ABA Model Rule 1.6(c). And when a tool can learn from one client's information and reuse it for another, ABA Formal Opinion 512 expects informed consent first, and a boilerplate engagement-letter clause will not do.

2026 raised the stakes. A federal judge in New York held that a defendant's conversations with a consumer AI tool were not privileged, California replaced its AI guidance with a stricter version, and tax preparers still face a criminal statute, Section 7216, that predates AI by decades.

This guide is for managing partners, firm administrators, IT leads and general counsel at small and mid-sized law, accounting and tax firms. You will get:

• what the ABA, state bars and the courts actually require, with the sources;
• the separate rules for CPAs and tax preparers;
• a comparison of four AI deployment options by how much control they give you;
• a vendor question list, a consent checklist and a 60-day rollout plan.

None of this is legal advice. Ethics rules differ by state, so confirm the specifics with your ethics counsel or state bar before you rely on them.

What the ethics rules require when lawyers use AI

There is no AI-specific Model Rule. The duties come from rules lawyers already know, applied to a new kind of tool.

Rule 1.6(c): reasonable efforts, not perfection

Model Rule 1.6(c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Two points matter for AI.

First, the scope is "information relating to the representation," which is much broader than privileged communications. A client's name in a prompt, a deal's timeline or a draft contract all count.

Second, the standard is reasonableness. Comment 18 says a disclosure is not a violation if the lawyer made reasonable efforts to prevent it, and lists the factors: the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost and difficulty of those safeguards, and how much they hurt the lawyer's ability to represent clients. The same comment notes that a client may demand extra security measures, or give informed consent to skip some.

That framework is useful for buying decisions. Paying for a business tier with no-training terms is cheap and easy; using a consumer account to save the license fee is hard to defend as reasonable.

ABA Formal Opinion 512: the AI-specific reading

The ABA's Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512, Generative Artificial Intelligence Tools, on July 29, 2024. It is advisory rather than binding, but Business Law Today calls it "a useful compilation of ethics guidance keyed to the Model Rules." It covers competence (Rule 1.1), communication (1.4), fees (1.5), confidentiality (1.6), meritorious claims (3.1), candor to the tribunal (3.3), and supervision of lawyers and nonlawyers (5.1 and 5.3).

On confidentiality, the opinion says lawyers are responsible for knowing how a tool uses data and for putting adequate safeguards in place. Its central concern is the self-learning tool, one that can retain prompts and reuse them. As the ABA Litigation Section summarizes, such a tool raises the chance of "inadvertent disclosure or cross-use in other cases," and that risk exists even inside a firm's own closed system, because a lawyer on one matter could receive output shaped by another client's information.

The opinion's conclusion: before putting information relating to the representation into a self-learning tool, get the client's informed consent, and do not rely on a boilerplate clause in the engagement letter. The duty also reaches former clients (Rule 1.9(c)) and prospective clients (Rule 1.18(b)).

Key takeaway: The question Opinion 512 asks is not "is this AI tool safe?" It is "can this tool take what one client told us and use it anywhere else, including for another client or the vendor?" If yes, you need consent or a different tool.

Supervision and policy duties

Rules 5.1 and 5.3 put the burden on partners and managers. Business Law Today's summary of Opinion 512 says supervisory lawyers "must establish clear policies regarding the permissible use of GAI," supervise compliance, and make sure nonlawyers, including outside contractors, are trained. A firm with no written AI policy is relying on every associate and paralegal making the right call alone. Our AI acceptable use policy template includes a section written for law and accounting firms.

Fees: the efficiency question

Opinion 512 also addresses billing. Lawyers generally may not charge clients for time spent learning a general AI tool, may treat AI costs as overhead, and may pass through specific tool costs only when the arrangement is explained in advance. It is not a confidentiality rule, but clients asking about AI usually ask about both at once, so have the answer ready.

How state bars differ: Florida, Texas and California

State rules control, and the state opinions do not all say the same thing. Three examples show the range.

Florida. Opinion 24-1, adopted January 19, 2024, applies the bar's cloud-computing guidance to generative AI. Lawyers should ensure the provider has an enforceable obligation to preserve confidentiality and security and will notify the lawyer of a breach, and should find out whether the provider retains information before and after the service ends. It says "it is recommended that a lawyer obtain the affected client's informed consent prior to utilizing a third-party generative AI" program when confidential information would be disclosed, and notes that concerns "may be mitigated by use of an inhouse generative AI" instead of an outside one.

Texas. Opinion 705, issued in February 2025, defines a self-learning program as "one that stores and incorporates user inputs into its existing datasets." The lawyer "should be reasonably satisfied that the program will not reveal confidential information to others," and if not, should not input confidential information "without client consultation and consent." It also points out that a tool that never shares inputs on purpose can still be vulnerable to hacking of what it stores.

California. The State Bar of California replaced its 2023 generative AI guidance with a 2026 version that also addresses agentic AI, tools that carry out multistep tasks without a prompt at each step. According to a Wilson Elser summary, the update says a lawyer may not input confidential information into AI "absent informed client consent regarding the risks," and calls for written AI policies, periodic training and review of terms of use before any client data goes in. California lawyers should read the full guidance on the State Bar's site.

The practical lesson for a multistate firm: design for the strictest jurisdiction you practice in, and treat client consent as a normal step in onboarding a new AI use, not an exception.

Does using AI waive privilege? What the Heppner ruling changed

Confidentiality is an ethics duty. Privilege is an evidence rule, and AI can damage it in a different way.

In United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y.), decided in February 2026, Judge Jed Rakoff ruled on documents a criminal defendant had generated with the consumer version of Anthropic's Claude. As Orrick's analysis and the Washington Legal Foundation describe it, the court held:

• No attorney-client privilege. The AI is not a lawyer, so the exchanges were not attorney-client communications.
• No expectation of confidentiality. The consumer privacy policy said the vendor collects inputs and outputs, may use them for training and may disclose them to third parties, including government authorities.
• Waiver. Putting privileged advice into a public AI tool waived protection over that material.
• No work product. The defendant used the tool on his own initiative, not at counsel's direction.

Two limits matter. The court did not hold that AI use waives privilege in every case, and it left open whether an enterprise tool with confidentiality terms, or use directed by counsel, would come out differently. And other courts are not uniform: WLF notes that in Warner v. Gilbarco, Inc. (E.D. Mich., February 10, 2026), a court held that a pro se party's use of ChatGPT did not waive work-product protection, calling AI tools "tools, not persons."

For firms, Heppner has three consequences:

1. The consumer-versus-business distinction now has case law behind it. The court read the vendor's consumer privacy policy closely. Your tool's terms are evidence.
2. Clients are the new leak. The defendant, not his lawyers, used the AI. Tell clients in writing not to paste your advice into public chatbots, and offer a safe channel instead.
3. AI logs are discoverable material. Prompts and outputs are records. Your retention schedule, litigation holds and AI audit trail need to cover them.

Accounting and tax firms: the AICPA code and Section 7216

CPA and tax firms sit under different, and in one respect harsher, rules.

The AICPA Confidential Client Information Rule

The AICPA Code of Professional Conduct generally bars a member in public practice from disclosing confidential client information without the client's specific consent. When a firm uses a third-party service provider, which includes an AI vendor processing client files, the Journal of Accountancy explains the code's requirements: inform the client, preferably in writing, before confidential information goes to the third party; either get client consent or sign a contract that obliges the provider to keep the information confidential (the article recommends the contract regardless); and plan and supervise the provider's work. State boards of accountancy can add their own rules.

Section 7216: a criminal statute for return information

26 U.S.C. 7216 applies to anyone in the business of preparing returns or providing services connected with preparation. Knowingly or recklessly disclosing return information, or using it for anything other than preparing the return, is a misdemeanor punishable by a fine of up to $1,000, up to one year in prison, or both. The fine rises to $100,000 for disclosures tied to identity theft under Section 6713(b).

The regulations decide how AI fits in:

• Technical contractors. Under 26 CFR 301.7216-2(d)(2), a preparer may share return information with a contractor that programs, maintains, repairs or tests its software or equipment only "to the extent necessary" for the contracted services, and must give the recipients written notice of the Section 6713 and 7216 penalties. Whether an AI vendor doing analysis rather than maintenance fits this exception is an open question, which is why most practitioners get consent.
• Substantive work by others. The no-consent exception for passing information to another preparer for auxiliary services, such as e-filing, applies only "so long as the services provided are not substantive determinations or advice affecting the tax liability."
• Offshore processing. Information first given to a US preparer generally needs the taxpayer's consent before it goes outside the United States, and the regulation's own example treats letting an overseas contractor view US-stored data through a remote login as a disclosure abroad.
• Social Security numbers. Under 26 CFR 301.7216-3(b)(4), for Form 1040-series filers a US preparer generally may not obtain consent to disclose the SSN to a preparer outside the United States and must redact or mask it, unless an IRS-specified data protection safeguard is used.
• Consent format. Consent must be written, signed and dated by the taxpayer, name the recipient and the information, state the purpose, and come before the disclosure. It cannot be obtained after the fact.

That makes data location a first-class question for tax firms. Microsoft's Copilot documentation, for example, says model calls can be routed to other regions when capacity is tight and that customers outside the EU "may have their queries processed in the US, EU, or other regions." That may be acceptable for a law firm's research memo. For return information, find out exactly where processing happens, or get consent that covers it.

Tax preparation firms are also "financial institutions" under the FTC Safeguards Rule, which the FTC's guide lists by name. Our guide to GLBA compliance for generative AI covers what that rule requires when AI tools touch customer data.

Which AI deployment protects client confidentiality?

Most of the confidentiality analysis comes down to which of four deployment patterns you are using. They differ in who holds the data, whether it can train a model, and how much work you take on.

1. Consumer chat apps. These are the free and personal plans staff sign up for on their own. Terms vary by vendor and change. Anthropic's August 28, 2025 consumer terms update, for example, let Free, Pro and Max users choose whether chats train models, with five-year retention for those who allow it and 30 days for those who do not. The update explicitly does not apply to commercial terms or API use. The point is not that one vendor is careless. It is that a consumer account's data handling is set by a user's toggle and a policy you never negotiated, which is the fact pattern the Heppner court relied on.

2. Enterprise AI workspaces. Business plans of the major chat products, with single sign-on and admin controls. OpenAI's enterprise privacy page (updated January 8, 2026) says it does not train on business data from ChatGPT Business, Enterprise and its API "by default," lets Enterprise admins control retention, and removes deleted conversations within 30 days unless legally required to keep them. Microsoft's Copilot documentation says prompts, responses and data accessed through Microsoft Graph "aren't used to train foundation LLMs," and that Copilot only surfaces data a user already has permission to view. These tiers suit drafting, research and firm knowledge work under a written policy.

3. API-based apps inside your own systems. Your firm, or a developer working for it, builds an application that calls a model through an API and retrieves documents from your own document management system. OpenAI says API inputs and outputs may be kept up to 30 days for abuse monitoring, with zero data retention available for eligible endpoints and qualifying use cases. The big advantage here is control over what the model sees: you decide which matter's documents are retrieved for which user. That is how you build an assistant that respects ethical walls. Our RAG chatbot cost guide explains what this kind of system costs.

4. Self-hosted models. An open-weight model running on servers you control, in your office or your own cloud account. No outside model vendor ever sees a prompt, which is the "in-house" option Florida's opinion mentions. The trade-off is ownership of hardware, patching, monitoring and model quality. Our breakdown of on-premise LLM deployment cost shows when that pays off, and our comparison of a private LLM vs ChatGPT Enterprise covers the middle ground.

Key takeaway: "Private" is not a product category. It is a set of answers: no training on your data, retention you control, a known data location, an enforceable confidentiality promise and access limited to the people on the matter. Any of options 2 to 4 can meet that bar; option 1 cannot.

The cross-client problem: ethical walls inside AI

The risk Opinion 512 worries about most is not a hacker. It is your own system mixing clients.

That happens in four ordinary ways:

• A firm-wide retrieval index. Every document goes into one searchable store, and the assistant retrieves from all of it. An associate on Client A's matter asks a question and gets a passage from Client B's file.
• Permission drift. Workspace assistants like Copilot respect existing permissions, which is good, but most firms have years of overshared folders. Copilot will faithfully surface whatever a user can already open. Clean up permissions before you turn it on.
• Shared memory and custom assistants. Some products remember past conversations or let users build reusable assistants loaded with documents. A "contract review assistant" built from one client's agreements and shared firm-wide is a confidentiality problem.
• Fine-tuning on client work. Training a model on many clients' documents bakes their information into the model itself, where it cannot be cleanly removed. Keep client documents in retrieval, where access can be controlled per matter, rather than in model weights.

The design rules that follow are simple to state:

1. Scope retrieval to the matter. The assistant should only search documents the current user can access for the current matter, enforced by the system, not by the prompt.
2. Mirror ethical walls. If a lawyer is screened from a matter in your conflicts system, the AI must be screened too. That means the AI's access checks must read from the same source of truth.
3. No shared assistants built from client documents unless the client has agreed.
4. Log every retrieval with user, matter and documents returned, so you can show what was accessed if a question ever comes up.

This is the main reason firms move from off-the-shelf tools to custom AI development: matter-aware access control is hard to bolt onto a general product, and straightforward to build into a firm's own application.

How to check an AI vendor's confidentiality terms

Florida's opinion says to vet an AI provider the way you would a cloud provider, and California's guidance says to read the terms, privacy policy and documentation first. Here are the questions to get answered in writing, with where the answer usually lives.

Two vendor details from October 2026 show why the last two rows matter. Microsoft's documentation notes that Copilot can use models from Anthropic and OpenAI as subprocessors, and that Anthropic models are currently excluded from the EU Data Boundary. Neither is hidden, but both are easy to miss if you only read the headline promise. Our AI vendor risk assessment questionnaire has the full question set.

Informed consent: what a meaningful conversation covers

When consent is needed, Opinion 512 asks for more than a signature. The ABA Litigation Section lists what the opinion expects the lawyer to explain:

• why the AI tool is being used, in the lawyer's best judgment;
• the extent of, and specific information about, the risks of disclosing client information;
• the kinds of client information that will be disclosed;
• how others might use the information against the client's interests;
• the tool's benefits to the representation;
• the risk that later users or beneficiaries of the tool will have access to the information.

Informed consent need not be in writing under the Model Rules, but confirming it in writing is the sensible practice. A short consent note might cover the tool and vendor by name, the contract terms that protect the data (no training, retention period, data location), the categories of information involved, what the client can opt out of, and a contact for questions. Have your ethics counsel draft the actual language for your jurisdiction.

For CPA firms handling returns, Section 7216 consent is a separate, formal document with its own required contents and timing. Do not merge it into a general AI notice.

Consent is also a sales conversation. Corporate clients increasingly send outside counsel guidelines that restrict or require disclosure of AI use. A firm that can explain its setup in plain terms, and show the contract terms, wins trust that a firm saying "we don't use AI" or "trust us" does not.

Safe first AI use cases for law and accounting firms

Start where confidentiality risk is lowest and value is easy to see, then move toward client data as controls mature.

Verification belongs in every stage. The hallucinated citations in cases such as Mata v. Avianca, which Business Law Today cites, are a competence and candor failure rather than a confidentiality one, but the same review habits catch both. If you are weighing stage 3 or 4 work, our guide to building AI agents covers how human approval steps are designed in.

A 60-day rollout plan

Use this checklist to go from scattered, unapproved AI use to a defensible program in two months.

Days 1 to 15: find out what is already happening.

• Survey staff anonymously about which AI tools they use and for what.
• Check single sign-on, browser and network logs for AI services in use.
• List every client with outside counsel guidelines or engagement terms that mention AI, data location or subcontractors.
• Identify which states' rules apply to your lawyers and which boards govern your CPAs.

Days 16 to 30: pick tools and sign contracts.

• Choose one approved general tool under business or API terms and block consumer AI on firm devices.
• Run every candidate through the vendor questions above; keep the answers on file.
• Confirm no-training, retention, breach notice, data location and subprocessor terms in the contract, not only on a web page.
• For tax work, decide whether any processing could happen outside the US and plan Section 7216 consent accordingly.

Days 31 to 45: write the rules and fix access.

• Adopt a written AI policy covering approved tools, prohibited data, verification and client communication (Rules 5.1 and 5.3).
• Clean up overshared folders before enabling any workspace assistant.
• Decide your consent approach by use case, using the strictest state that applies, and have counsel draft consent language.
• Add AI prompts and outputs to the records retention schedule and litigation hold procedures.
• Add a line to client advice letters asking clients not to paste your advice into public AI tools.

Days 46 to 60: train, launch and monitor.

• Train every lawyer, accountant and staff member, including the decision flow below.
• Launch stage 1 and 2 use cases; scope any stage 3 pilot to one practice group with matter-level access controls.
• Review logs weekly for the first month, then monthly.
• Re-read vendor terms at every renewal and whenever a vendor announces a policy change.

Key takeaway: The firms that get in trouble are rarely the ones that chose the wrong vendor. They are the ones with no approved option, so staff used whatever was free.

Common mistakes

• Banning AI without providing an alternative. Staff use consumer tools anyway, and now the firm has no visibility at all.
• Trusting the marketing page. "Enterprise-grade privacy" is not a contract term. Get no-training and retention commitments in the agreement.
• One index for the whole firm. It defeats ethical walls and is the cross-client risk Opinion 512 describes.
• Forgetting the client. Heppner turned on the client's own AI use. Advise clients in writing.
• Treating Section 7216 like an ethics rule. It is a criminal statute with specific consent formalities. Treat return information as its own data class.
• Never re-reading terms. Consumer terms changed in 2025, guidance changed in 2026, and both will change again.

Bottom line

Law firm AI confidentiality, and the same duty at accounting firms, holds up when the firm controls three things: which tools touch client information, what the contract says those vendors may do with it, and whether one client's information can ever reach another. Consumer accounts fail all three tests. Business and API tiers pass the first two with the right contract. Matter-scoped, custom-built applications or self-hosted models pass the third.

Start with a written policy and one approved tool, scope client-data use cases to the matter, get informed consent where your state's guidance calls for it, and treat AI logs as records. Fleurant AI builds AI for regulated industries, including matter-aware assistants with access controls designed in, and offers a free discovery call; you can see more on the Fleurant AI home page. When you are ready, talk to a specialist about your firm's use cases and the rules that apply to them.