ABA Model Rule 1.6 Confidentiality: AI Implementation Patterns

ABA Model Rule 1.6 governs confidentiality of information related to representation. As AI tools enter legal practice, the rule's application raises new questions. This article catalogs implementation patterns that maintain compliance.

The rule

Model Rule 1.6 (Confidentiality of Information):

"(a) A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent..."

"(c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

Source: ABA Model Rules of Professional Conduct, Rule 1.6.

AI implications

When AI tools are used:

1. Information leaves the firm's control (sent to AI vendor)
2. Some AI vendors use inputs for training
3. Audit logs are held by AI vendor
4. Subprocessors (cloud, infrastructure) have access
5. Data breaches at vendor become law firm breaches

Reasonable efforts for AI

ABA Formal Opinion 477R (2017) and Opinion 533 (2024):

For AI specifically, "reasonable efforts" under Rule 1.6(c) include:

1. Vetting AI vendors' data practices
2. Using BAA-protected endpoints for sensitive data
3. Reviewing AI vendor's data retention policies
4. Disclosing AI use to clients (informed consent under Rule 1.6(a))
5. Maintaining audit logs of AI use

Implementation patterns

Pattern 1: Self-Hosted Open Source

For sensitive workloads:

• Self-hosted Llama 3.3 70B or Mistral
• On dedicated hardware
• Full audit log control
• No data leaves the firm

Pros: full control
Cons: requires ops expertise

Pattern 2: BAA-Protected Cloud

• Azure OpenAI (BAA covers HIPAA workloads)
• AWS Bedrock with BAA
• Google Vertex AI with BAA

Pros: flexibility
Cons: vendor has access to audit logs

Pattern 3: Consumer-Tier AI (NOT RECOMMENDED for sensitive workloads)

• ChatGPT free/Plus
• Claude.ai free
• Google Bard/Gemini free

Critical: do not use for client confidential data per most bar opinions.

Vetting checklist

For AI vendor selection:

1. Data retention: how long is data kept?
2. Training: is data used for model training? Can it be opted out?
3. Subprocessors: who has access? Are they also covered?
4. Audit logs: does the firm have access?
5. Security: SOC 2 Type II? HIPAA compliance?
6. Breach history: any reported breaches?
7. Geographic location: where is data stored?
8. Cross-border: any data transfer agreements needed?

Disclosure to clients

Pattern engagement letter language:

"I may use AI-assisted tools to assist with legal research, document review, and other tasks during our representation. These tools process client information according to the security and confidentiality terms above. I verify all AI-generated outputs before relying on them."

Informed consent under Rule 1.6(a) requires client awareness of significant AI use.

Audit log retention

Recommended:

• 7 years (minimum for many case types)
• Permanent for some case records
• Include: timestamp, user, document ID, prompt, response, citation verification status
• Tamper-evident (append-only)
• Encrypted at rest

State bar opinion compliance (2024-2026)

Per California, Florida, New York, New Jersey, Texas, and ~25 other states:

• Lawyer must supervise AI as a non-lawyer assistant
• Citation verification is mandatory
• Confidentiality requires BAA or self-host for sensitive
• Reasonable fees for AI-assisted work
• Communication to clients about material use

Acknowledgments

This article summarizes public sources as of early 2026.

Dillon Deutsch has worked with law firms on ABA compliance for AI deployments. https://courtgpt.ai