AI ethics guide · California
Can a California lawyer put client documents into an AI tool?
What the 2026 Practical Guidance says about client confidentiality, and the other duties that come with using AI.
Not legal advice. This is a plain-English summary of the 2026 Practical Guidance, written by the team that makes ClientSafeAI, and it hasn't been reviewed by a lawyer. Read the source itself, and ask the California bar's ethics hotline if you're unsure how it applies to you.
| Document | Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026) |
|---|---|
| Issued by | State Bar of California, Standing Committee on Professional Responsibility and Conduct (COPRAC) |
| Date | 2026, replacing the original November 2023 guidance |
| Status | Guidance, not a binding rule |
The short answer
Yes, with conditions. California’s guidance says a lawyer must not put a client’s confidential information into an AI tool that may present material risks to confidentiality or security, unless the client gives informed consent to those risks. To know whether a tool presents that risk, you’re expected to find out how it collects, uses, stores and shares what you give it. Marketing assurances on their own aren’t enough.
What it says about confidentiality
The guidance starts from how these products work. Many use what you type and upload, prompts and documents alike, to further train or refine the AI, and some share it with third parties or use it for other purposes. Even a tool that does neither may still store or transmit data in ways that raise confidentiality concerns.
Reasonable efforts to protect client confidences, it says, require more than relying on general marketing. That can mean reading the terms of use, the privacy policy and the vendor’s documentation, remembering that simply using a product can amount to accepting its terms. Depending on the circumstances, it can also mean asking qualified IT or cybersecurity people to confirm the tool follows reasonable security, confidentiality and data-retention practices.
The 2026 version adds a section on agentic AI: systems that act on their own, often with ongoing access to email, document management or client files. The more access and autonomy a system has, the more diligence and supervision the lawyer owes. A lawyer must not deploy an agentic system in a way that lets it send client information outside the firm on its own, through emails, filings or data transfers, without appropriate safeguards and human review.
Reasonable efforts require more than reliance on generalized marketing assurances.
COPRAC, 2026 Practical Guidance, Duty of Confidentiality
The other duties it covers
| Competence | Understand the tool before relying on it, and reassess it periodically as models and features change. The more autonomy a system has, the more oversight the lawyer must build in. |
|---|---|
| Communication | Consider telling the client you intend to use AI, how, and the benefits and risks, especially where it materially affects decisions. Follow any client instructions that restrict AI use. |
| Fees | You may bill actual time spent prompting and reviewing output, but hourly bills must reflect time actually spent. General AI subscriptions are usually overhead. Per-use costs incurred for a specific matter may be passed on if the fee agreement discloses it, at cost, with no markup unless the client gives informed written consent. |
| Supervision | Managerial and supervisory lawyers need clear policies and periodic training on appropriate AI use, including agentic tools. |
In practice
- Read the terms of use and privacy policy of any AI tool before client data goes into it, and keep a note of what you found.
- If a tool may use inputs for training or share them, don’t put confidential client information into it without the client’s informed consent.
- For agentic tools, limit what they can access and make sure nothing leaves the firm without a person reviewing it.
- Check your fee agreements: say how AI affects rates and whether any matter-specific AI costs will be billed.
Worth watching
The State Bar has also proposed amendments to California’s Rules of Professional Conduct to address AI directly. Check the State Bar’s site for their current status before relying on this page.
How this compares with ABA Formal Opinion 512
The ABA's national opinion requires a client's informed consent before information relating to the representation goes into a self-learning AI tool, and says boilerplate consent in an engagement letter isn't enough. Read the Opinion 512 summary and firm checklist.
Keep client documents on a server that’s only yours
A Private AI Workspace runs on a GPU server ordered for one firm. Your documents, the AI model and the database stay on it, it never trains on your files, and answers cite the page they came from. It costs $499 a month, flat.
Sources
Spotted something out of date? Tell us and we'll fix it.
Not legal advice. This is a plain-English summary of the 2026 Practical Guidance, written by the team that makes ClientSafeAI, and it hasn't been reviewed by a lawyer. Read the source itself, and ask the California bar's ethics hotline if you're unsure how it applies to you.