Matthew Campobasso, Chief Legal Officer at Zone and Co., put it bluntly on CZ and Friends, GC AI's podcast hosted by CEO Cecilia Ziniti:
"It will be malpractice at some point for law firms or lawyers who are not using AI. I think five years is probably the drop dead. I think it would probably be closer to a year."
He is one of many in-house leaders setting the same expectation.
AI legal ethics in 2026 is the question every in-house lawyer faces. State bars have settled the threshold: lawyers can use AI in the practice of law. The harder questions are what counts as competent use, who is responsible when AI hallucinates, and when client consent is required. This category is anchored by three documents every in-house team should be able to cite by name.
GC AI, the legal AI platform built for in-house counsel by a three-time general counsel, sees these questions land across more than 1,700 in-house teams every week. The workflows described below each map to a real ethics duty and a real customer team navigating it.
The Five Ethics Questions Every In-House GC Is Being Asked in 2026
The five questions below come up in every adoption conversation GC AI's solutions team runs, and every one maps to a specific paragraph in Florida Bar Opinion 24-1 or ABA Formal Opinion 512. They are the right place to start when you are scoping an internal AI policy.
Can I let my team use consumer AI tools like ChatGPT for client work?
Do I need client consent before using AI on a matter?
Can the firm or in-house team bill for time saved by AI?
Who is responsible when AI hallucinates?
What do I do if outside counsel uses AI on our matter?
What Florida Bar Opinion 24-1 Requires
Florida Bar Ethics Opinion 24-1, issued by the Board of Governors in January 2024, is the first state-bar opinion to walk through the four ethics duties that govern generative AI use end to end. Florida was first; California, New York (NYSBA Task Force, April 2024), Pennsylvania (Joint Formal Opinion 2024-200), and Texas (Opinion 705, February 2025) have since issued similar guidance built on the same four-duty structure.
Lawyers may use AI in the practice of law. The opinion then sets four conditions across confidentiality, supervision, billing, and advertising.
Confidentiality Under Rule 4-1.6
Florida lawyers must protect the confidentiality of client information when using generative AI. Opinion 24-1 requires lawyers to research the AI provider's policies on data retention, data sharing, and self-learning before sending any confidential information through the tool. If the AI provider does not contractually commit to confidentiality, the lawyer must either obtain informed client consent or use a different tool.
The practical translation: Enterprise AI platforms with enforceable confidentiality terms, appropriate security controls, and no training on customer inputs are better positioned to support a lawyer’s confidentiality analysis. Without those protections, the lawyer must obtain informed client consent before sending confidential information through the tool.
For a deeper read on what counts as confidential under a typical NDA, see GC AI's companion guide on Is ChatGPT Confidential.
AI Oversight Under Rule 4-5.3
Florida Rule 4-5.3 governs the supervision of non-lawyer assistants. Opinion 24-1 extends that rule to generative AI: lawyers must review the work product of an AI tool, including verifying the accuracy and sufficiency of its outputs. The rule treats AI like a junior associate whose work the partner is professionally responsible for.
Michele Murray, who leads legal at ARKO Corp, said it plainly on CZ and Friends:
"It's really only as good as a user. There has to be a knowledge base for the person, because you do have to verify the results. It's still your work product."
The lawyer signs the brief, the lawyer signs the memo, the lawyer signs the opinion letter. Every signature is a supervision act under Rule 4-5.3.
Legal Fees Under Rule 4-1.5
Florida Rule 4-1.5 prohibits unreasonable fees. Opinion 24-1 applies that to AI: lawyers may not bill for hours AI saved, may not double-bill, and may not treat AI subscription costs as a client cost without disclosure. For hourly matters, the bill should reflect the time actually spent supervising and verifying the AI-assisted work, not the time the task would have taken without AI.
This is one of the most overlooked parts of the opinion for in-house teams.
Many GCs negotiate flat fees or alternative fee arrangements with outside counsel.
If outside counsel is using AI on your matter, the value question becomes: are we paying for the hours, or for the result?
Outside counsel using AI to compress work is a feature. Outside counsel using AI to compress work and then billing as if they did not is a Rule 4-1.5 problem you should be auditing.
Lawyer Advertising and Chatbots Under Rules 4-7.1 to 4-7.3
If your firm or in-house team deploys an AI chatbot to communicate with the public, prospective clients must be told they are communicating with AI software. The lawyer remains responsible for any information the chatbot provides. The chatbot must screen for conflicts and avoid communications with already-represented parties.
For most in-house teams, the chatbot rule applies to vendor portals, employee help desks, and any AI-powered intake on the legal team's intranet page. The fix is a disclosure line and a screening question, both of which can ship as part of the chatbot's standard intake flow.
ABA Formal Opinion 512: The National Framework
ABA Formal Opinion 512, issued July 29, 2024, is the national-scope companion to Florida's state-specific guidance. Titled Generative Artificial Intelligence Tools, it applies the ABA Model Rules of Professional Conduct to AI use across competence, confidentiality, client communication, candor to tribunals, supervisory responsibilities, and fees.
ABA Opinion 512 holds that lawyers must have a reasonable understanding of the capabilities and limitations of any AI tool they use, without needing to become AI experts themselves.
The opinion is explicit that "GAI tools lack the ability to understand the meaning of the text they generate or evaluate its context." AI is therefore never a substitute for independent professional judgment.
For in-house counsel, ABA Opinion 512 maps to three concrete obligations:
Competence: Read the AI vendor's documentation. Know what model it runs on, what the system prompt does, and what its known failure modes are. "I did not know it could do that" is not a defense, and neither is "I did not know it would do that."
Confidentiality: Obtain informed client consent before feeding confidential client information into a self-learning generative AI tool. This is the bright-line rule.
Supervision: Apply Model Rule 5.3 to AI outputs. Responsibility for the work product belongs to the lawyer.
Opinion 512 does not require a specific verification protocol, but it makes clear that case citations, factual assertions, and statutory references generated by AI must be checked against primary sources before they leave the firm. Two years later, that holding still sets the floor.
Mata v. Avianca: The Case That Made Verification Non-Negotiable
Mata v. Avianca, decided by Judge P. Kevin Castel in the Southern District of New York in June 2023, is the case every in-house counsel cites when explaining the verification duty to a junior associate. The plaintiff's lawyers used ChatGPT to draft a legal motion. The motion cited six cases. None of the six cases existed.
The fake cases, by name, were Varghese, Shaboon, Petersen, Martinez, Durden, and Miller. When opposing counsel could not locate them, the court ordered the lawyers to produce copies. They went back to ChatGPT, which obligingly fabricated the opinions. Judge Castel imposed a $5,000 sanction and ordered the lawyers to send copies of the sanctions opinion to each judge whose name had been falsely attached to a fake case.
Mata v. Avianca was a foreseeable accident. It was also a permanent change in the standard of care for AI-assisted research. Florida Opinion 24-1 and ABA Opinion 512 both followed within twelve months. The verification duty is now black letter.
The sanctions trajectory has escalated since Mata. In January 2024, the Second Circuit in Park v. Kim referred a New York attorney to its Grievance Panel for citing a non-existent case generated by ChatGPT. In May 2025, a federal Special Master in Lacey v. State Farm imposed $31,000 in sanctions on lawyers at two firms (Ellis George and K&L Gates) after nine of twenty-seven citations in a ten-page brief turned out to be wrong or fabricated.
By December 2025, Couvrette v. Wisnovsky (D. Or.) later resulted in more than $100,000 in sanctions, fees, and related monetary consequences after filings included 15 nonexistent cases and eight fabricated quotations. Judge Mark D. Clarke called Couvrette "a notorious outlier in both degree and volume."
The Special Master in Lacey wrote the line every in-house team should print and pin to the wall:
"Even with recent advances, no reasonably competent attorney should outsource research and writing to this technology, particularly without any attempt to verify the accuracy of that material."
Sanctions started at $5,000 in 2023 and reached $110,000 in 2025. The cover-up multiplied the failure in Couvrette: lawyers attempted to conceal the fabrications by deleting references, and that conduct pushed the sanction to six figures. Courts have moved past the warning phase. The Prompt > Verify > Audit framework later in this guide is what closes the verification gap before a brief leaves the team.
The Florida supervision rule and the ABA competence rule both turn on what the lawyer does after the AI produces an output. Verification is the discipline. Character-level citation back to source documents is the tooling that makes verification a one-click action.
GC AI's Exact Quote, the platform's character-level citation feature that pins every output back to the source document, exists to make that discipline cheaper than the alternative.
ABA Model Rules 1.1, 1.6, and 5.3 Applied to AI Tools
If your in-house team works across multiple state bars, the ABA Model Rules are the common denominator. Three are load-bearing for AI work.
Rule 1.1: Competence and the Duty of Technological Competence
ABA Model Rule 1.1 requires lawyers to provide competent representation. Comment 8, added in 2012 and reinforced by Opinion 512, extends competence to "the benefits and risks associated with relevant technology." A lawyer who deploys AI without understanding how the tool processes inputs, where data is stored, or what its failure modes are is not technologically competent under the current standard.
Comment 8 expects lawyers to know enough about AI tools to make informed choices about when and how to use them. For an in-house team, that means at least one designated AI owner who can explain the platform stack, the model providers, the retention policies, and the supervision protocols.
Rule 1.6: Confidentiality of Information
Rule 1.6 prohibits revealing information relating to the representation of a client without informed consent or an exception.
AI breaks this rule in two ways: training on user inputs, and inadvertent disclosure through model outputs. Opinion 512 reads Rule 1.6 to require informed consent before confidential client information is fed into any self-learning AI tool.
Heppner held that, on those facts, a defendant’s exchanges with a public AI platform were not privileged or protected work product. For the full Heppner analysis, see GC AI's Is ChatGPT Private?
For in-house counsel, client confidential information should only be entered into AI platforms that contractually commit to zero data retention and zero training on customer inputs, and only after the team has read and approved the vendor's terms.
Rule 5.3: Responsibilities Regarding Nonlawyer Assistance
Rule 5.3 covers a lawyer's responsibility for the conduct of non-lawyer assistants. Both Florida Opinion 24-1 and ABA Opinion 512 read AI tools as nonlawyer assistants subject to this rule. The supervising lawyer must give reasonable assurance that the AI's conduct is compatible with the lawyer's professional obligations.
For in-house teams, Rule 5.3 has three practical implications. First, lawyer-in-the-loop is not optional for outputs that go to the business, to a regulator, or to a court. Second, the team needs a written policy that names which tasks AI can support and which require human-only execution. Third, the team needs an audit trail, because the duty is forward-looking and the regulator standard turns on what the team did, and documentation is how that gets proven.
The Florida and ABA frameworks reach beyond competence, confidentiality, and supervision. Communication (Model Rule 1.4) governs what lawyers must tell clients about AI use on their matters. Candor to the tribunal (Model Rules 3.1, 3.3, and 8.4(c)) is the rule the Mata, Lacey, and Couvrette sanctions all turned on, alongside competence under Rule 1.1. Supervisory lawyers (Model Rule 5.1) carry firm-wide responsibility for the AI conduct of the lawyers they oversee.
The Prompt > Verify > Audit Framework
GC AI's Level 110: Legal AI Ethics for In-House Legal class teaches a three-step framework for operationalizing the duties Florida Opinion 24-1 and ABA Opinion 512 codify. Every AI-assisted task runs through three checks.
Prompt (Competence, Confidentiality, Candor)
Give the AI context, force clarifying questions, and give the AI an out. Let it say it does not know.
Consider framing and perspective. Ask the AI to identify weaknesses in its own reasoning or surface counter-arguments.
Anonymize confidential information if the tool is public.
Verify (Competence, Candor)
Verify every citation against primary sources on Westlaw or Lexis.
Verify every assertion of fact and every quoted passage.
Verify that the reasoning supports the proposition stated. AI sometimes cites a real case for a proposition the case does not support.
Six red flags when scanning AI output (the GC AI Level 110 checklist):
A response that mirrors your prompt back too perfectly.
Extreme confidence with no caveats.
Citations without working links or citations you cannot find on Westlaw or Lexis.
Circular reasoning.
High context-window usage (long answer to a short prompt).
No citations at all.
Audit (Competence, Supervision)
Review AI output in a fresh session, separate from the chat where it was produced. Bias toward independent eyes.
Supervise team members' AI work and document the review.
Use AI itself for quality control. Paste the output into a new chat and ask it to flag unsupported claims, unverifiable citations, and logical gaps.
Cecilia frames the whole thing in one line. Treat AI like an intern. You check your intern's work, so check your AI's.
What Counts as Competent AI Use: A Policy Template for In-House Teams
A one-page traffic-light AI use policy maps each AI workflow to one of three permission levels. The framework below is adapted from the ACC AI toolkit and the policy guidance in Opinion 24-1 and Opinion 512. Customize the specifics to your tech stack and risk profile.
Red (Prohibited):
Entering client confidential information into a consumer or free AI product.
Submitting AI-generated case citations, statutory references, or quotations to a court or regulator without verification against primary sources.
Allowing an AI chatbot to communicate with a prospective client or counterparty without a disclosure that the user is interacting with AI.
Billing for AI-saved hours as if a lawyer had performed the work.
Yellow (Oversight Required):
Legal research and document review using approved enterprise AI platforms with zero data retention agreements.
Contract drafting and redlining inside a vetted Word-integrated tool.
Internal memos, board briefings, and regulatory summaries where a designated lawyer reviews the output before it leaves the team.
Vendor due diligence and policy comparison work.
Green (Standard Use):
Administrative drafting (calendar invites, meeting summaries, internal scheduling notes).
Brainstorming and outlining where the output never leaves the lawyer.
Translating, summarizing, or formatting public information.
Personal productivity work that does not involve client data.
Vendor Due Diligence Checklist:
Before approving an AI platform for legal work, the team should be able to answer yes to every question below. Cecilia Ziniti, GC AI's co-founder and CEO, drafted the original version of this checklist while serving as a three-time general counsel at Anki, Bloomtech, and Replit.
Does the vendor have SOC 2 Type II certification?
Does the vendor maintain a zero data retention agreement with its underlying model providers?
Does the vendor encrypt data at rest and in transit (AES-256 or stronger)?
Does the vendor train on customer inputs?
Does the vendor support character-level citation back to source documents?
Does the vendor provide an audit log of prompts and outputs?
Can the vendor produce a written explanation of how its model handles privileged information?
How GC AI Is Built for Ethical In-House Use
GC AI is purpose-built for the four ethics duties Opinion 24-1 codifies. Confidentiality, oversight, fees, and advertising each map to a specific design decision.
On confidentiality, the platform runs on SOC 2 Type II and SOC 3 certified infrastructure with AES-256 encryption, GDPR compliance, and zero data retention agreements with OpenAI and Anthropic. No customer prompt, document, or output is used to train the underlying models. Client confidential information stays inside the contractual perimeter, which is what Rule 1.6 and Florida Rule 4-1.6 require.
On oversight and verification, GC AI's Exact Quote returns a character-level citation back to the source document for every claim in an output.
Research biases toward authoritative databases, primary law, and government sources with citations.
Playbooks ship pre-built for NDAs, DPAs, MSAs for SaaS, and MSAs for commercial purchases, so the verification step happens against a standard the lawyer has already chosen and refined.
Anirma Gupta of Unity made the supervision case directly on CZ and Friends:
"AI is going to put even more emphasis on the judgment aspect of being a lawyer."
Lawyer-in-the-loop is the default workflow. The model proposes. The lawyer disposes.
On fees and transparency, GC AI publishes a flat $500 per seat per month price on its pricing page with a 14-day free trial. Verification features and audit logs ship in the base product. The supervision and competence duties are designed into the platform from day one.
On technological competence, the free legal AI courses offered through GC AI Classes are California CLE-eligible. The 101 class is one hour of CLE credit. The 201 class is 1.25 hours. The dedicated Level 110: Legal AI Ethics for In-House Legal class walks lawyers through ABA Formal Opinion 512 step by step, with practical strategies to reduce hallucinations, verify AI output, and protect privilege under Heppner.
More than 6,000 lawyers have completed the courses to date. Rule 1.1 Comment 8 says lawyers should keep abreast of the benefits and risks of relevant technology, and free CLE-eligible courses are the cheapest way to meet that duty.
For a head-to-head read on which legal AI platforms hold up under in-house counsel due diligence, see Best Legal AI Tools for In-House Counsel.
Start This Quarter: Three Steps in 90 Days
Start this quarter by giving one person on the legal team formal ownership of the AI policy, drafting a one-page traffic-light policy modeled on the framework above, and running the vendor due diligence checklist against every AI tool already in the team's tech stack.
Most in-house teams in 2026 have AI usage that predates a written policy, which means the policy work is documentation of what the team is already doing.
The team is already using AI.
The 90 days are about putting the supervision rule in writing so that Florida's verification duty and ABA Opinion 512's competence duty are documented, defensible, and consistent with how the team already operates.
Three concrete artifacts close out the quarter:
A one-page AI use policy. Traffic-light framework, signed by the GC, distributed to every lawyer and legal-adjacent role on the team.
A vendor approval list. Every AI tool the team uses, mapped to the seven-question due diligence checklist, with a renewal date.
A short verification protocol. One paragraph describing how the team verifies AI outputs before they leave the team. Two sentences are enough for most in-house teams. The shorter the protocol, the more likely the team follows it.
The teams that have these three artifacts in place by the end of Q3 will spend Q4 working. The teams that do not will spend Q4 in remediation conversations.
Frequently Asked Questions
What is Florida Bar Ethics Opinion 24-1?
Florida Bar Ethics Opinion 24-1 allows lawyers to use generative AI in the practice of law subject to four conditions: protecting client confidentiality, supervising AI outputs under Rule 4-5.3, charging reasonable fees that reflect AI efficiency gains, and disclosing AI use in chatbot communications. The Florida Bar Board of Governors approved the opinion in January 2024.
Does ABA Formal Opinion 512 Apply to In-House Counsel?
Yes, ABA Formal Opinion 512 applies to every lawyer subject to the Model Rules of Professional Conduct, including in-house counsel. The opinion's competence, confidentiality, supervision, and fees holdings apply with the same force whether the lawyer practices in a firm or inside a company.
Do I Need Client Consent Before Using AI on a Matter?
Informed client consent is required under ABA Opinion 512 when confidential client information will be fed into a self-learning AI tool. Client consent may not be required where the tool’s terms and configuration avoid disclosure outside the engagement, but the analysis depends on the tool, matter, information, and applicable ethics rules.
What Happened in Mata v. Avianca?
Mata v. Avianca established the verification duty for AI-assisted legal research. The 2023 personal injury case in the Southern District of New York saw plaintiff's lawyers submit a motion citing six fabricated cases generated by ChatGPT. Judge P. Kevin Castel imposed a $5,000 sanction. Sanctions have escalated since: $31,100 in Lacey v. State Farm (C.D. Cal. 2025), and $110,000 in Couvrette v. Wisnovsky (D. Or. 2025). Mata is the entry point to a growing line of AI sanctions cases.
Can Lawyers Bill Clients for AI-Generated Work?
Lawyers may bill for the time they spend supervising and verifying AI outputs, but they may not bill for hours the AI compressed and they may not double-bill. Florida Rule 4-1.5 and ABA Opinion 512 both require that fees reflect work performed. AI subscription costs are typically the firm's overhead.
Do AI Chatbots Used by Law Firms Need to Disclose They Are AI?
Yes, prospective clients must be told they are communicating with an AI program before any substantive exchange, under Florida Opinion 24-1 and most state bars that have addressed the issue. The lawyer remains responsible for the chatbot's communications, and the chatbot should screen for conflicts and avoid communications with already-represented parties.
What Is the Duty of Technological Competence Under ABA Model Rule 1.1?
The duty of technological competence under Model Rule 1.1 Comment 8 requires lawyers to keep abreast of the benefits and risks associated with relevant technology. For AI specifically, ABA Opinion 512 holds that lawyers must have a reasonable understanding of the capabilities and limitations of any generative AI tool they use, including failure modes such as hallucinated case citations.
How Do I Supervise AI Under ABA Model Rule 5.3?
Treat the AI tool like a nonlawyer assistant whose work the lawyer is professionally responsible for, the same supervision rule that applies under ABA Model Rule 5.3. The supervising lawyer reviews and verifies every output before it leaves the team, maintains an audit trail of prompts and outputs, and ensures the AI vendor's conduct is compatible with the lawyer's professional obligations on confidentiality, candor, and competence.
What Should an In-House Legal Team's AI Use Policy Include?
A complete in-house AI use policy includes a traffic-light classification of permitted uses (red for prohibited, yellow for oversight-required, green for standard use), an approved vendor list with a renewal cadence, a one-paragraph verification protocol, and a designated AI owner inside the legal team. The policy should be short enough that every lawyer on the team will read it from end to end.
How Is GC AI Built for the Duties in Opinion 24-1 and Opinion 512?
GC AI uses AES-256 encryption at rest, TLS in transit, SOC 2 Type II controls, and zero-data-retention arrangements with OpenAI and Anthropic. Character-level citation through Exact Quote and primary-law-biased research addresses the verification and competence duties. Free CLE-eligible legal AI classes address the duty of technological competence under Model Rule 1.1 Comment 8.
What Does the Heppner-Warner Federal Split Mean for In-House Counsel?
Heppner (S.D.N.Y., February 2026) and Warner v. Gilbarco (E.D. Mich., February 2026) came down the same day with opposite conclusions on AI privilege. Heppner denied privilege for consumer AI exchanges; Warner protected AI-assisted work product, holding that AI tools are "tools, not persons." Until the federal split resolves, in-house counsel should route confidential material only through enterprise AI platforms with contractual confidentiality, zero data retention, and lawyer-supervised use.
What Is the Prompt → Verify → Audit Framework for AI in Legal Work?
The Prompt → Verify → Audit framework, taught in GC AI's Level 110 ethics class, operationalizes the duties ABA Opinion 512 and Florida Bar 24-1 codify. Prompt the AI carefully with context, clarifying questions, and an out for "I don't know." Verify every citation, assertion, and reasoning chain against primary sources. Audit the output in a fresh session, document the review, and treat AI like an intern whose work you check.
