The duties are not new. The policy exists so that a tool cannot quietly move who is discharging them.
Key takeaways
A law firm’s AI policy should say which tools may be used, what client information may go into them, that every authority and citation produced with AI assistance is verified against the source before it leaves the firm, who supervises the work, and who the firm tells when something goes wrong. It should be short enough that an articling student reads it once and remembers it.
What it should not do is restate professional duties as though they were new. They are not. The Law Society of British Columbia’s page on artificial intelligence and the legal profession points to a practice resource, Guidance on Professional Responsibility and Generative AI, which it describes as covering competence, confidentiality, information security, fraud, plagiarism and copyright — the existing duties, applied.
Regulation of the legal profession in Canada is provincial and territorial. The Federation of Law Societies maintains the Model Code of Professional Conduct to harmonise conduct rules across the country, and publishes an Interactive Model Code that links each rule in the Model Code to the matching or related rule of every law society in Canada. That tool is the fastest way to move from a general proposition to the rule that actually binds you.
The chapter structure is where a policy should anchor itself. The annotated Code of Professional Conduct for British Columbia sets out chapter 3 on the relationship to clients with 3.1 Competence, 3.2 Quality of service and 3.3 Confidentiality, including the rules on confidential information and on claiming privilege when faced with a requirement to surrender a document. In Alberta, the Law Society publishes its professional conduct resources for the same purpose. Write the chapter and rule numbers of your own jurisdiction into the policy; a policy that cites another province’s code invites the argument that nobody checked.
Approved tools, by name. Distinguish the firm’s tenant-bound tools from consumer tools on the open web. They are not the same risk and should not be governed by the same sentence.
What may go in. The default is nothing that identifies a client or a matter. Where a tool is approved for client material, the approval is written down and dated, and rests on a vendor position the firm has actually read.
Verification. Every case, statute, regulation and quotation produced with AI assistance is opened at source and read before it is relied on. No exceptions for internal memos, because internal memos become submissions.
Supervision. The lawyer responsible for the file is responsible for the output, whoever or whatever produced the draft. If a firm can be answerable for a member’s work, as our sister firm explains in the note on suing a professional’s firm, then a policy that leaves supervision implicit is a gap.
Client communication. Decide, in advance, when you tell a client that AI was used on their matter and when you seek consent. The LSBC resource treats client-facing risk and disclosure as part of the analysis, and a firm that has never decided its position will decide it badly under pressure.
The firm starts by listing what people already use, honestly and without consequence for the first fortnight. Six tools surface, including one transcription service nobody had assessed. The tool list becomes the policy’s appendix, and the appendix is the part that gets updated.
Verification is written as a workflow rather than a virtue: any document containing a citation goes through a check step, and the checker initials the file. Confidentiality is written as a single sentence with a short list of what may never be pasted. Supervision is written as a name per matter.
The policy is then read aloud at a firm meeting, which surfaces the two questions everyone had — can I use it for a first draft of a client letter, and can I use it to summarise a discovery transcript — and both get answered in the document rather than in the corridor.
Client information that leaves the firm to be processed is still the firm’s responsibility. Where personal information is involved, clause 4.1.3 of Schedule 1 to PIPEDA requires an organisation to use contractual or other means to provide a comparable level of protection while a third party processes it, and clause 4.1.4 requires policies and practices, including training staff. The Office of the Privacy Commissioner’s generative AI principles state the point directly for AI. Where the obligation is contractual rather than statutory — an undertaking, a protective order, a client’s own confidentiality clause — the analysis in what happens when a confidentiality clause is breached is the practical read.
Is there an approved model policy for Canadian law firms?
Not one that is binding. The Federation’s Model Code harmonises conduct rules and the LSBC publishes practice guidance; both are inputs. Your policy is your own document, and it should name your law society.
Do we have to disclose AI use to clients?
That depends on your law society and the retainer. Decide it, write it down, and revisit it when your regulator publishes something new — the LSBC page is updated with new resources and should be checked rather than remembered.
Does a policy protect the firm if something goes wrong?
Only if it was followed. An unenforced policy is evidence of what the firm knew it should be doing. Our sister firm’s note on workplace policies and handbooks covers how to make one stick.
A 30-minute call is enough to tell you whether AI pays for itself here.
