How to Use Copilot in a Law Firm Without Breaking Ethical Walls

Copilot for law firms changes how quickly a screened lawyer can stumble onto a walled-off matter. If your firm has promised a former client that a lateral hire is screened, that promise now depends on how Microsoft 365 permissions are set. This guide covers what California's rules expect of a screen and the controls that keep Copilot inside it.

Why does Copilot put law firm ethical walls at risk?

Copilot puts ethical walls at risk because it searches everything a user is permitted to open, and most law firm file permissions are wider than the screens the firm has promised. Microsoft states that Copilot "only surfaces organizational data to which individual users have at least view permissions" (Microsoft Learn). That is a sound design, and it means Copilot inherits every gap in your permissions.

Before Copilot, an overshared matter folder was a quiet problem. A screened lawyer would have to know the folder existed and go looking for it. Copilot removes that friction. A prompt such as "summarize everything we have on the Acme supply contracts" can pull in a document from a walled-off matter the user never knew they could open, and present it in a tidy paragraph.

What do the California rules require of an ethical screen?

California rule 1.10 lets a firm avoid imputing a lateral lawyer's former-client conflict only when the lawyer did not substantially participate in the matter, is "timely screened from any participation in the matter," is apportioned no part of the fee, and the former client receives prompt written notice that describes the screening procedures. That notice also commits the firm to respond to written inquiries or objections about those procedures.

Rule 1.0.1 defines "screened" as the isolation of a lawyer from any participation in a matter, including the timely imposition of procedures that are "adequate under the circumstances." Its comment lists "denial of access by that lawyer to law firm files or other materials relating to the matter" as a screening measure.

The California Lawyers Association Ethics Committee, in Formal Opinion No. 2021-1, adds that "electronic documents can be coded with restrictions on access," that screens may need to cover paralegals and assistants, and that IT access audits support an adequate screen. Ethics committee opinions are advisory. They still show what a former client's counsel is likely to ask about.

ABA Formal Opinion 512 adds a management duty: "Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI." A Copilot rollout that never considered existing screens leaves that policy incomplete.

Does Copilot respect ethical walls on its own?

No. Copilot respects permissions and encryption, and it has no awareness of conflicts or screens. Microsoft says that when content is encrypted by Microsoft Purview Information Protection, "Microsoft Copilot honors the usage rights granted to the user." If a screen exists only as a memo, a flag in the conflicts database or a note in a document profile that Microsoft 365 does not enforce, Copilot cannot know about it.

That makes the practical question simple: is each screen enforced in the permission layer that Copilot reads? For many firms the answer today is "partly."

Which Microsoft 365 controls turn a screen into a technical barrier?

Four controls do most of the work, and they stack.

• Matter-level permissions. Each matter lives in its own SharePoint site, Team or document management workspace, with membership limited to the matter team. Screened lawyers and their assistants are removed by name, and broad groups such as "All Staff" never appear on matter sites.
• Sensitivity labels with encryption. A "Screened matter" label grants usage rights only to the matter team. Because Copilot honors usage rights, a screened user cannot have Copilot read a labeled file even if a copy lands somewhere wider.
• Information barriers. Microsoft Purview Information Barriers restrict communication and collaboration between defined groups in Teams, SharePoint and OneDrive. Microsoft's own example is a lawyer whose client data "can't be accessed by a lawyer at the same firm who represents a different client." Information barriers do not cover email, so Exchange mail flow rules still matter.
• Copilot exclusions. A DLP policy using the Microsoft 365 Copilot and Copilot Chat location can exclude items with a chosen sensitivity label from Copilot processing (Microsoft documentation, checked October 2026). The item can still appear in citations, but Copilot does not use its content in the response. Restricted Content Discovery can hide entire SharePoint sites from organization-wide search and Copilot while you review them, though it does not change who can open the files.

Information barriers suit firms with stable, recurring segments, such as a practice group that regularly sits on the other side of the table. Most small and mid-size firms get further with clean matter permissions plus a screening label, and use information barriers selectively. If your document management system syncs into Microsoft 365, check those integrations as well. Our note on Office 2021 end of support and DMS integrations covers what to test.

What should a law firm check before turning on Copilot?

Run an oversharing review before licenses go out, and treat every active screen as a test case.

• Pull the list of active screens from the conflicts system, naming the screened lawyers, assistants and paralegals.
• For each screen, confirm the screened people have no access to the matter's site, Team, workspace, shared mailbox or OneDrive shares. Check sharing links, which often outlive the original request.
• Look for files that left the matter workspace: attachments saved to personal OneDrive, exports in shared drives and copies in practice group libraries.
• Apply the screening label to the matter workspace and confirm that a screened account cannot open a labeled file.
• Sign in with a test account placed in the screened group and ask Copilot about the matter by client name, opposing party and key terms. Record what comes back.
• Turn on Microsoft Purview audit logging so the firm can show who accessed matter content and when.

How do new screens get enforced after rollout?

Tie every new screen to an IT ticket so the technical barrier goes up the same day the screening memo goes out. The rule 1.0.1 comment says that "in order to be effective, screening measures must be implemented as soon as practical" once the need is known. When a screen takes effect is an internal decision for the firm and its ethics counsel. Whichever way the firm decides, its IT provider can apply the matching Copilot and file restrictions the same day and record when they took effect.

A short workflow covers it:

1. The conflicts team opens a screening ticket naming the matter and the screened people.
2. IT removes access, applies the label, adds the people to an information barrier segment where one exists, and attaches evidence such as a permissions export and a test result.
3. The ticket closes only after a Copilot test returns no matter content for a screened test account.
4. When the screen lifts, a second ticket records the change and who approved it.

Keep these records for the life of the matter. CLA Opinion 2021-1 notes that notices, reminders and "monitoring information may be preserved as long as the matter continues," which is also what you will need if a former client asks how the screen works. For how long the rest of the client file is kept once a matter closes, see how long attorneys have to keep files in California.

What should your firm do this quarter?

Five steps cover most of the risk before Copilot licenses go out.

• Inventory active screens and test each one against Copilot with a screened test account.
• Fix overshared matter sites, starting with any that grant access to firm-wide groups.
• Publish a "Screened matter" sensitivity label with encryption, and a DLP rule that excludes it from Copilot processing.
• Add a short Copilot section to the firm AI policy that names who approves new AI features and how screens are enforced.
• Confirm that Microsoft's enterprise data protection terms apply to the Copilot experience your attorneys actually use.

How s90 helps

s90 helps law firms across Los Angeles and Orange County prepare Microsoft 365 for Copilot: oversharing reviews, matter-level permissions, screening labels, DLP for Copilot and audit evidence that matches what your conflicts team promised former clients. If you are planning a Copilot rollout, we are glad to walk through your current screens with you.