AI for law firms and accountants: what you can use without breaching client confidentiality

By Keith Myers · September 2026

Most small firms we speak to have already made the decision without meaning to. Someone on staff has a free chatbot account open in a browser tab and is pasting a client letter into it. The question is no longer whether the firm uses AI. It is whether the firm can describe, in writing, what happens to a client file after it leaves the building.

Your duty follows the data, not the tool

Lawyers owe confidentiality under Rule 1.6 and owe supervision of any nonlawyer assistance they use, which now includes software vendors. The ABA published a formal opinion on generative AI in 2024 that says as much. Accountants have the AICPA rules on confidential client information, and any firm preparing tax returns is also covered by Internal Revenue Code section 7216, which restricts disclosure and use of return information and requires specific written consent in some cases.

None of that bans AI. All of it means you have to know where the text goes and who may read it. Write down, in one paragraph, which tools your staff may put client content into. If you cannot name them, you do not yet have a policy.

The account tier is the compliance control

Free and personal accounts and business or enterprise accounts of the same product behave differently. On the business tier of the major assistants, your content is excluded from model training by default, an administrator can see who has an account, and you can get a signed agreement covering the data. Expect $20 to $30 per user per month. The free tier costs nothing and gives you no agreement to show a client, an insurer, or a state bar.

Buy business seats only for the people who draft, review, or summarize daily. In a ten person firm that is usually four or five people. Then check the retention setting, because the default on some plans keeps conversations for 30 days and the setting can often be reduced.

Work that is safe to run through a properly configured tool

Summarizing a long document you already hold. Drafting a first version of a client letter, an engagement letter, or a memo from your own precedent. Turning messy notes into a clean file note. Comparing two versions of a contract and listing what changed. Searching your own closed matters or prior year workpapers by meaning rather than by filename. Transcribing a meeting, with everyone told it is being recorded.

These share one feature. The AI is working on material you supplied, and you review the output before it goes anywhere. Start with two of them and leave the rest alone for a quarter.

Work to keep out

Anything in a personal account. Browser extensions that read your email or your practice management system without a written agreement, because most of them are small companies with no security programme you can inspect. Client identifiers pasted into a general tool when the same job could be done with initials. Anything touching a matter where the client has already told you in writing not to use AI.

Ask every new vendor two questions before signing: do you train on our content, and where is it stored. Get the answer in the contract, not the marketing page.

Confidentiality is one duty. Accuracy is the other.

Courts have sanctioned lawyers for filing briefs containing citations the tool invented, and the count keeps rising. The same failure in an accounting practice looks like a confidently wrong figure in a client memo. A general assistant will produce fluent text about a statute it has partly imagined.

Treat every output as a first draft from a capable but unaccountable junior. Verify each citation, figure, and date against the source. Nobody has ever been disciplined for the drafting method, only for what they signed.

Tell the client, in the engagement letter

A short clause covers most of it: the firm may use AI tools for drafting and analysis, no client information is used to train any model, all work is reviewed by a professional, and the client may ask the firm not to use these tools on their matter. Some clients will ask questions. Very few object once they read that paragraph.

Add the clause at the next revision of your standard letter rather than sending a separate notice to everyone.

A realistic first month

Week one, buy four or five business seats and turn off training and long retention. Week two, run a two hour session with those people on the two tasks you picked. Week three, write the half page policy and the engagement letter clause. Week four, ask what they actually used it for and drop whatever nobody touched. Budget around $120 per month in licences and one day of setup for a firm of ten.