Before anyone pastes an intake email into an AI assistant, your firm needs three answers: what information is leaving, where it is going, and who has approved that use. The same questions apply to meeting transcripts, uploaded contracts, and AI features connected to a document library—not just a chat window.
For law firm cybersecurity in Sarasota, AI confidentiality belongs in the everyday intake workflow. A short, documented approval path is more useful than a blanket “use AI responsibly” instruction. This checklist is our recommended operating process for Sarasota and Manatee County firms, not a legal opinion or a promise that a particular tool is safe.
What ABA Formal Opinion 512 says—and what it does not
ABA Formal Opinion 512, Generative Artificial Intelligence Tools, issued July 29, 2024, addresses lawyers' duties under the ABA Model Rules of Professional Conduct. Its competence discussion calls for understanding a tool's capabilities and limitations and appropriately verifying its output. Its confidentiality discussion addresses information relating to a representation—not only names or documents marked privileged.
For self-learning generative AI tools, the opinion requires a client's informed consent before inputting information relating to the representation. It explains that this information can surface in later outputs, including across matters within the same firm. Merely adding general, boilerplate AI authorization to an engagement letter is not sufficient when informed consent is required. The lawyer must explain the use, benefits, and relevant disclosure risks.
The opinion does not say every AI use requires consent. It gives idea generation without inputting information relating to a representation as an example where that consent is not required. That distinction is not permission to upload a client file to any product labeled “enterprise” or “private.” The lawyer still needs a fact-specific assessment of the tool and the proposed use.
ABA Formal Opinion 512 is guidance interpreting the ABA Model Rules; it is not Florida law. The responsible lawyer or qualified counsel must review the applicable state rules, engagement terms, client instructions, and any court requirements. That review should address competence, confidentiality, communication, and supervision. Our ABA cybersecurity obligations guide for Sarasota law firms provides the broader security context; this article focuses on the intake-to-prompt handoff.
1. Intake: keep the original in the approved matter system
Assign an intake owner and identify where new inquiries, attachments, recordings, and notes are stored. Treat prospective-client information as sensitive and have counsel determine the applicable duties before an engagement exists. Do not make AI upload the default next step after receiving an inquiry.
- Identify the purpose. Is the task a generic checklist, a summary of a particular client's facts, or analysis of a contract? If a generic prompt will do, do not attach the intake file.
- Identify the information. Note whether the material includes privileged communications, personal identifiers, financial details, litigation strategy, or information restricted by a client agreement.
- Identify the owner. Name the lawyer who can approve this matter's use. Administrative staff should not be asked to decide whether an upload is legally permissible.
Keep the original and any approval record in controlled firm storage. An intake form, browser extension, or transcription assistant may send information before anyone manually creates a prompt; include those automated routes in the review.
2. Tool approval: review the exact account and settings
Approve a defined service, account type, and workflow—not just a product name. IT can gather evidence and configure safeguards; the lawyer decides whether the proposed use satisfies professional and client obligations. In the opinion's confidentiality discussion, lawyers are directed to evaluate disclosure risks before inputting representation information.
- Training and reuse: Can prompts, attachments, or responses be used to train or improve models? Does the answer depend on the subscription or an administrator setting?
- Retention and access: What is retained, for how long, and who can access it, including service personnel and subprocessors? What do deletion controls actually cover?
- Connected data: Which mailboxes, folders, or matter libraries can the tool search? Can it retrieve another matter's information or cross an ethical wall?
- Account protection: Are firm-managed accounts, multifactor authentication, access restrictions, and appropriate audit records available and enabled?
- Change control: Who checks updated terms, new connectors, and changed settings before the approved use expands?
Record the terms and settings reviewed, review date, permitted tasks, prohibited data, and approval owner. A “no training” setting alone does not answer questions about retention, access, or disclosure. If the behavior is unclear, pause representation-data uploads until the firm resolves it. Tie this review to your law firm cybersecurity program and existing account controls.
3. Lawyer approval: resolve consent before the prompt
Have the responsible lawyer review both the tool and the specific information proposed for submission. If self-learning AI will receive information relating to the representation, address the opinion's informed-consent requirement before input—not after a useful draft comes back. Document the lawyer's decision and any required consent in the matter record.
When consent is required, the discussion must be specific enough for the client to understand why the tool is being used, what information is involved, the benefits, and the risk that others may access or use it. The lawyer should also consider whether other communication duties or engagement terms require disclosure even when confidentiality-based consent is not required. Neither an IT approval nor a generic engagement-letter clause resolves that legal review.
4. Prompt review: send only the approved minimum
Before submitting, check the prompt, attachments, previous chat history, and connected sources. Removing a client's name does not necessarily remove representation information: dates, transaction details, locations, and unusual facts can still identify a matter. Do not assume that replacing a name with “Client A” makes a prompt anonymous.
For a training exercise, use an entirely fictional task such as “Create a blank intake checklist with fields for contact details, conflict screening, and document requests.” Do not adapt it by adding facts from an actual inquiry unless that use has passed the firm's review. Staff should have a clear fallback: complete the task without AI or ask the designated lawyer.
For connected AI, review the underlying document permissions before enabling access. Our Microsoft 365 security services address account and access controls; a subscription name alone does not establish that a particular AI workflow is approved.
5. Output and records: keep a human review step
An approved input does not make the output reliable. Have the lawyer apply an appropriate degree of independent review to facts, authorities, quotations, and conclusions before relying on the result or sending it to a client or court. Opinion 512 explains that the level of verification depends on the task and tool; it does not transfer professional judgment to the software.
Store necessary approval and review records in the firm's controlled system under its retention policy. Avoid duplicating confidential prompts in a broadly accessible IT ticket. If information was entered into an unapproved tool, stop further use and notify the designated lawyer and technical contact promptly. Preserve relevant facts in restricted storage; let counsel and responders direct containment, vendor contact, and any notification decisions rather than deleting records indiscriminately.
Keep evidence accurate. A tool inventory and approval record can support internal governance, but do not label them proof of complete compliance or guaranteed coverage. Use our law firm cyber-insurance renewal checklist to distinguish documented controls from assumptions on an application.
Three things you can do this week
- Map one intake route. Follow a fictional inquiry from the web form or mailbox through notes and document storage. List every AI feature, connector, and transcription service that could receive it.
- Build a one-page approved-use record. For one tool, record the exact account, settings, terms review date, permitted data, prohibited tasks, lawyer approval owner, and next review trigger. Keep representation data out while questions remain unresolved.
- Run a staff handoff exercise. Ask a staff member to explain when to stop, whom to ask, and where approval is recorded. Have the responsible lawyer review the consent and engagement-language process before real client information is submitted.
Make confidentiality part of the workflow
Suncoast MIS reviews systems, access, and data-handling workflows through our Free Systems Audit, on-site at a Sarasota or Manatee County business. Most visits take 45–60 minutes within a 60-minute calendar slot. Every completed audit includes a full, customized Client Threat & Architecture Report with prioritized practical findings. Your lawyer or qualified counsel retains responsibility for legal interpretation, consent, and engagement terms; this technical review is not legal advice or a compliance certification.
Gregory Mathews, Systems Architect, Suncoast MIS LLC
Source Notes and Scope
The primary source is ABA Formal Opinion 512 (July 29, 2024): Section II.A addresses competence and output review; Section II.B addresses confidentiality, self-learning tools, and informed consent; Section II.C addresses client communication; and Section II.E addresses supervisory responsibilities. The opinion interprets ABA Model Rules, not Florida law. The numbered workflow and weekly actions are Suncoast MIS recommendations, not requirements prescribed by the opinion. Applicable state rules, court requirements, engagement terms, and each matter's facts require lawyer or counsel review. No specific AI product is endorsed or declared compliant here.
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance, legal, and insurance conclusions remain with each organization and its qualified advisors.