How do you get client consent to use AI on a matter?

Managing partners are hearing two things at once: attorneys want to use AI on client work, and clients want to know what happens to their information when they do. A clear process for client consent for AI use answers both, and in California it now sits alongside a statute that takes effect January 1, 2027.

When does a lawyer need client consent to use AI on a matter?

ABA Formal Opinion 512 says informed consent is required before a lawyer inputs information relating to the representation into a self-learning generative AI tool, meaning one that can retain inputs and reuse them. In California, the trigger is rooted in confidentiality itself: rule 1.6(a) bars a lawyer from revealing confidential client information without the client's informed consent unless an exception applies.

The practical question for each matter is whether the tool exposes client information to anyone outside the firm's control. Opinion 512 describes the risk: information from one client's matter can surface in work for another client, or reach the vendor's other users. A tool contractually barred from training on or retaining firm inputs presents a different risk than a free consumer chatbot, and the opinion says the confidentiality analysis depends on the client, the matter, the task and the tool. The State Bar of California's proposed AI amendments point the same way. A proposed comment to rule 1.6 would treat exposing confidential information to a technology system, including an AI tool, as a possible "reveal" when it creates a material risk the information could be misused. That proposal is not yet adopted.

California adds a hard limit on January 1, 2027. SB 574 adds Business and Professions Code section 6068.1, which bars entering confidential, personally identifying or other nonpublic information into a generative AI system unless access is restricted to the attorney and the people the attorney authorizes who are obligated to keep it confidential. Client consent does not fix a tool that fails that test.

Why isn't an AI clause in the engagement letter enough?

Opinion 512 says informed consent cannot be accomplished by a boilerplate acknowledgment or notice clause in an engagement letter. Consent has to follow a real explanation of the tool and its risks for this client and this matter.

California's definition sets the floor. Rule 1.0.1(e) defines informed consent as a person's agreement after the lawyer has communicated and explained the relevant circumstances and the material risks, including any actual and reasonably foreseeable adverse consequences. A sentence saying the firm "may use technology, including artificial intelligence" explains none of that. Generic language still has a job: it tells clients the firm uses AI and that a specific conversation will happen when a matter calls for one.

What does the client need to hear before consenting?

The client needs enough to make a real decision: which tool, what information goes in, what could go wrong, and what the alternative is. Opinion 512 says that for consent to be informed, the client must have:

• The lawyer's best judgment about why the tool is being used on this matter.
• The extent of the risks involved in disclosing the client's information to it.
• The kinds of client information that will go into the tool.
• The ways others might use that information against the client's interests.
• A clear explanation of the tool's benefits to the representation.
• The risk that later users of the tool could gain access to information relating to the matter.

Add the reasonably available alternative, which is usually doing the work without the tool, and what that means for cost and timing. If the firm plans to bill for the tool, say how. Opinion 512 treats fees for AI-assisted work as a separate question, and a client deciding whether to consent will want the answer in the same conversation.

Does the client have to be told about AI use when consent isn't required?

Sometimes. Opinion 512 reads ABA Model Rule 1.4 to require telling the client when the client asks, when the engagement agreement requires it, and when AI output will influence a significant decision in the representation. Outside those cases it is a judgment call that weighs the client's expectations, the scope of the work, the sensitivity of the information and how central the tool is to the task.

California's rule 1.4(a)(1) requires a lawyer to promptly inform the client of any decision or circumstance for which disclosure or informed consent is required. The pending proposed comment to rule 1.4 would add that when a lawyer's use of technology, including AI, poses a significant risk or materially affects the representation, the lawyer must communicate enough information for the client to make informed decisions, and that the duty continues through the matter. Corporate clients add their own layer: outside counsel guidelines increasingly set AI terms, and those terms bind the firm by contract.

How do you get and record client consent, step by step?

Treat consent as a short, repeatable process tied to the matter, with a written record the firm can produce later. A workable sequence:

1. Classify the tool before the conversation. Confirm from the contract and settings whether it trains on or retains inputs, who at the vendor can see them, and whether access is limited to the firm. The State Bar's practical guidance on generative AI tells lawyers to review the terms of use and consult IT or cybersecurity professionals on security, confidentiality and retention.
2. Check the client's own rules. Read the engagement letter and any outside counsel guidelines for AI restrictions or notice requirements.
3. Apply the section 6068.1 test. If access to the tool is not restricted to the attorney and authorized people who are obligated to keep the information confidential, keep confidential and nonpublic information out of it once SB 574 is operative, with or without consent.
4. Have the conversation. Use a one-page, matter-specific disclosure that covers the Opinion 512 points above and the option of not using the tool.
5. Get the agreement in writing. California's rule 1.6 does not require written consent, but a signed form or confirming email is the clearest evidence of what the client was told and agreed to.
6. File it with the matter and record the scope: which tool, which categories of information, and which tasks.
7. Revisit when something changes. A new tool, a changed vendor term or a new category of information means a new conversation.
8. Make it enforceable. Allow only approved AI tools on firm accounts and devices, so the consent on file matches what attorneys actually use.

What should a managing partner do this quarter?

Put the consent process in place and make sure the firm can show it works. Five steps cover most firms:

• Inventory the AI tools in use across the firm, approved or not, and classify each by whether it retains or trains on inputs.
• Replace generic AI language in the engagement letter template with a notice that points to matter-specific consent when one is needed.
• Adopt a one-page consent form and a standard place in the document management system to store it.
• Train attorneys and staff on when the conversation is required. Opinion 512 and the State Bar's guidance both expect managerial lawyers to set clear AI policies and provide training.
• Track the California rule proposals, which still need Board of Trustees and California Supreme Court approval before they take effect.

How does s90 help?

s90 helps law firms make their AI rules hold in their systems. We inventory the AI tools attorneys and staff already use, enforce policy on approved AI platforms, block unapproved ones on firm accounts and devices, and monitor prompts so the consent in the matter file matches what actually happens. Your ethics counsel decides what the firm owes each client; we make the controls and the records behind that decision dependable. If you want to know what your attorneys are using today, an AI tool inventory is a good first step.