Checklist: an AI use policy for your law firm

A law firm’s AI use policy should cover 14 items: approved tools, confidential information, restricted court material, personal information, citation checks, supervision, permitted tasks, evidence, telling clients, court practice notes, billing, records, training and incidents. In the 2025 Victorian Lawyer Census, 37% of responding lawyers used AI, but only 42% had workplace AI guidelines.

The census figures come from the Victorian Legal Services Board + Commissioner’s research brief on generative AI use, based on 1,887 responses. This checklist is general information for firm principals and practice managers. It is not legal advice, and each firm should read the rules and court documents that apply where it practises.

Why does a law firm need a written AI policy?

The Statement on the use of artificial intelligence in Australian legal practice, issued in December 2024 by the Law Society of New South Wales, the Legal Practice Board of Western Australia and the Victorian Legal Services Board + Commissioner, asks lawyers to adopt clear, risk-based policies. It says a policy should record which AI tools the practice uses, who may use them, for what purposes and with what information, how junior and support staff are supervised, and how AI-generated content is reviewed before a document is settled. It also recommends making the policy available to clients who ask for it.

The census brief found that 60% of respondents had not read the Victorian courts’ AI guidelines or the regulators’ statement, including close to half of those already using AI. Court rules are also changing quickly: three of the documents in item 10 below were issued between 16 April and 29 May 2026.

The checklist

Tools and information

1. A register of approved tools. List each AI tool the firm allows, the account tier, who owns the relationship with the vendor, what the vendor’s terms say about training on your data, and where data is processed. Anything not on the register is not approved. Include tools built into software you already pay for, such as transcription or drafting features.
2. A rule on client confidential information. Staff must not enter confidential, sensitive or privileged client information into public AI tools. The Supreme Court of Victoria’s Practice Note SC Gen 25 says court users should be aware that anything entered into a public AI tool could become publicly available. Closed tools are allowed only after someone has read the contract terms and settings.
3. A rule on material the court restricts. Information covered by suppression or non-publication orders, documents produced on subpoena and material held under the implied undertaking need their own rule, because the court documents in item 10 treat them more strictly than ordinary client files. The default should be that none of it goes into any AI tool without a principal’s written approval.
4. Personal information. If the firm is covered by the Privacy Act 1988, the policy should point to the privacy principles that apply to AI inputs and outputs, and to the new privacy policy content required from 10 December 2026. The Privacy Act guide explains both.

Accuracy and supervision

5. Checking every citation and authority. Every case, statute, quote and reference produced with AI is checked against an authorised source before it leaves the firm. The policy should say plainly that asking an AI tool whether its own output is correct is not a check; SC Gen 25 says one AI tool cannot be used to confirm content produced by another.
6. Supervision. Name the person responsible for each matter’s AI use and how their review is recorded. Rule 37.1 of the conduct rules requires a solicitor with designated responsibility for a matter to exercise reasonable supervision over the solicitors and employees working on it.
7. Permitted and prohibited tasks. The joint statement suggests limiting AI to lower-risk tasks that are easy to verify, such as drafting a polite email or suggesting how to structure an argument, and avoiding higher-risk tasks such as translating advice into another language or analysing an unfamiliar legal concept. Write your own two lists.
8. Evidence and expert material. Affidavits, witness statements, character references and expert reports get the strictest rule, because several courts restrict or require disclosure of AI use in evidence. Under the Supreme Court of New South Wales practice note, generative AI must not be used to generate the content of affidavits, witness statements or character references.

Clients, courts and costs

9. Telling clients. Decide when the firm tells a client that AI was used on their matter, how that is recorded on the file, and how it shows up in costs if the client asks. The joint statement expects lawyers to be transparent and to record and disclose AI use to clients.
10. Court practice notes. Keep a list of the AI rules for every court and tribunal the firm appears in, and check it before filing.

11. Billing. Time recorded and billed must reflect the legal work actually done. The joint statement says AI should not push a client’s costs above traditional methods, for example through extra time spent correcting its output.

Records, training and incidents

12. Records. For each matter, record which tool was used, for what task, who checked the output and when. Keep prompts and outputs where they form part of the work, so the firm can answer a court or client question later.
13. Training. Set the training a person must complete before getting access, and a refresher each year. In the census, 72% of AI users had received AI training in the past year compared with 38% of non-users. Yes AI runs practical sessions through ai-workshops.au.
14. Incidents. Write down what happens when something goes wrong: client information pasted into a public tool, a false citation filed, or a vendor reporting a breach. Steps should include stopping use, telling the responsible principal, assessing whether it is a notifiable data breach, correcting anything filed with a court, and deciding what to tell the client.

What should the policy say about an AI receptionist or intake agent?

Front-of-house AI needs its own short section, because it talks to the public rather than to staff:

• The greeting tells callers they are speaking with an AI assistant, and the recording notice is approved by a principal.
• The agent has a written rule never to give legal advice, assess prospects or say whether a time limit has passed.
• Fee information is limited to wording the firm has written, such as the price of a first consultation.
• Urgent triggers and the people they go to are listed by name, with a backup for each.
• Messages go to a shared intake mailbox or named staff, and someone reads them every business day.
• The conflict check stays with a person; the agent only collects names.
• The firm knows how long recordings, transcripts and messages are kept, and where.

The AI receptionist page shows how these rules turn into call handling.

How do you roll the policy out?

1. Ask every staff member which AI tools they already use, including free accounts on personal devices.
2. Draft the policy with a principal and the practice manager, using the 14 items above.
3. Approve the tool register and close any account that is not on it.
4. Train staff, then have each person confirm in writing that they have read the policy.
5. Put a review date in the diary: every 6 months, and whenever a court you appear in issues a new AI document.

The duties behind each item are explained in AI and solicitors’ professional obligations. For tools that keep client data inside a controlled environment, see private AI for law firms. To talk through how an AI agent would sit inside your policy, send an enquiry.