Associates are drafting with ChatGPT. Paralegals summarize depositions with Copilot. Intake runs through a chatbot. Most small firms adopted these tools before anyone wrote a rule about them. The Florida Bar has now written the rule, and it puts the responsibility squarely on the lawyer.
What Opinion 24-1 actually says
In January 2024 the Florida Bar Board of Governors approved Ethics Advisory Opinion 24-1. Its core line: a lawyer may use generative AI "so long as the lawyer can reasonably guarantee compliance with the lawyer's ethical obligations." The opinion then names four areas where AI creates risk.
- Confidentiality (Rule 4-1.6). Before putting client information into a third-party AI tool, understand how the provider stores, uses and retains it. The opinion advises getting the client's informed consent where confidential information goes to a third-party AI.
- Supervision (Rules 4-5.1 and 4-5.3). AI is treated like a nonlawyer assistant. The firm needs policies, and lawyers must verify AI output before it reaches a client or a court.
- Fees (Rule 4-1.5). You cannot bill for time AI saved, and you should not bill clients for learning the tool.
- Advertising. An intake chatbot must say it is not a lawyer and must not give legal advice.
The ABA reached the same conclusions nationally in Formal Opinion 512 (July 2024).
If a junior associate pasted a client's settlement memo into the free version of ChatGPT this afternoon, could your firm show who approved that tool, what the provider does with the data, and whether the client agreed? If not, you have an Opinion 24-1 gap.
Confidentiality is a cybersecurity duty too
ABA Model Rule 1.6(c) requires "reasonable efforts" to prevent unauthorized access to client information, and Florida's Rule 4-1.6 carries the same duty. In practice, "reasonable" for a small firm means written security policies, multi-factor authentication on email and document systems, encrypted laptops and phones, a plan for a lost device or a hacked mailbox, and vendor contracts that protect client data.
Wire fraud is the attack most firms meet first. Settlement and escrow payments make law firms a prime target for business email compromise, where a criminal impersonates a client or the firm and redirects funds. The FBI's 2025 Internet Crime Report attributes more than $3 billion in losses to business email compromise.
A five-step AI governance plan for a small firm
- Inventory. List every AI tool in use, including the ones staff adopted on their own.
- Classify. Decide which tools may touch client information. Consumer plans usually may not; business plans with no-training and retention controls may.
- Write the policy. An AI acceptable use policy: approved tools, forbidden uses, verification of citations and facts, and how AI use is disclosed to clients.
- Update engagement letters. Add plain-language disclosure of AI use and obtain consent where client confidential information is involved.
- Train and log. Short training, signed acknowledgments, and a record of who approved each tool.
Can Florida lawyers use ChatGPT?
Yes. Florida Bar Ethics Opinion 24-1 allows generative AI if the lawyer can reasonably guarantee compliance with ethical duties: protect confidentiality, supervise and verify the output, bill fairly, and follow advertising rules. Putting client confidential information into a consumer AI tool without understanding its data use, and without informed consent, is the main risk.
Does a small law firm need a written AI policy?
Opinion 24-1 expects firms to have policies that make sure AI use matches the lawyer's professional duties. For a small firm that means a short AI acceptable use policy listing approved tools, prohibited uses, verification steps and client disclosure, plus staff training.