Ethics and Compliance: Using AI Responsibly

The Brief That Ended a Career

On a spring morning in 2023, Steven Schwartz -- a New York attorney with over thirty years of experience -- sat down to prepare an opposition brief in Mata v. Avianca, Inc., a personal injury case filed in the Southern District of New York. His client, Roberto Mata, alleged that he had been injured by a metal serving cart on an Avianca Airlines flight. It was a straightforward matter. The airline had moved to dismiss on statute of limitations grounds, and Schwartz needed to identify case law supporting his argument that the limitations period should be extended.

Schwartz turned to ChatGPT. He asked the AI to find cases supporting his position. ChatGPT obliged, generating a brief populated with case citations that looked impeccable -- complete with case names, reporter citations, volume numbers, page numbers, and detailed summaries of holdings. Varghese v. China Southern Airlines Co., Ltd. Shaboon v. Egyptair. Petersen v. Iran Air. Martinez v. Delta Airlines. Estate of Durran v. Korean Air Lines. Miller v. United Airlines. Each citation followed perfect Bluebook format. Each included a plausible factual scenario and a holding that directly supported Schwartz's argument.

None of them existed.

Not one of the six principal cases ChatGPT generated was real. The AI had fabricated case names, created fictional courts, invented holdings, and constructed an entire body of fake jurisprudence with the same confident tone it uses when providing accurate information. Schwartz, who later testified that he was unaware of the possibility that ChatGPT could fabricate cases, submitted the brief to the court without verifying a single citation.

When opposing counsel could not locate the cited cases and brought this to the court's attention, Schwartz did something that compounded the error catastrophically: he went back to ChatGPT and asked it to confirm whether the cases were real. ChatGPT confirmed they were. He then submitted an affidavit to the court stating that the cases existed, attaching ChatGPT's confirmation as support.

Judge P. Kevin Castel was not persuaded. In a hearing that was livestreamed and watched by legal professionals around the world, the court walked through each fabricated citation, noting that the cases did not appear in any legal database, that the courts cited in some of the cases did not exist, and that the attorney had failed to exercise the most basic form of professional diligence. The court imposed sanctions of $5,000 and referred the matter for disciplinary proceedings.

But the sanctions were almost beside the point. The damage to Schwartz's reputation was devastating and immediate. The case became a cautionary tale repeated at every CLE program, bar association meeting, and legal technology conference for the next three years. It was cited in judicial opinions across the country. It became the first thing that came to mind whenever anyone mentioned AI and legal practice in the same sentence.

And it did not have to happen. Every ethical principle that was violated in Mata v. Avianca was already well-established long before AI existed. The duty to verify citations. The obligation to provide competent representation. The prohibition against making false statements to a tribunal. AI did not create new ethical obligations -- it created new ways to violate existing ones.

This lesson examines those obligations in detail. Not as abstract principles, but as concrete, practical requirements that govern every interaction you will ever have with an AI tool in your legal practice.

---

The ABA Model Rules and AI: A Framework for Compliance

The American Bar Association has not yet adopted a standalone rule governing AI use in legal practice. It does not need to. The existing Model Rules of Professional Conduct, adopted in some form by every state bar, already provide a comprehensive framework for the ethical use of AI. What is required is understanding how those rules apply to this new technology.

Rule 1.1: Duty of Competence

The Rule: "A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation."

Comment 8 to Rule 1.1, amended in 2012, adds: "To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology."

This comment -- sometimes called the "technology competence" amendment -- has been adopted by approximately forty states. Its implications for AI are significant and twofold:

First, you must understand AI well enough to use it competently. This means understanding what AI can and cannot do, recognizing its limitations (particularly hallucination), knowing how to verify AI output, and being able to evaluate whether an AI tool is appropriate for a particular task. Blind reliance on AI output -- the Schwartz approach -- is a per se competence violation.

Second, you must understand AI well enough to serve clients who are affected by it. If your clients are using AI in their businesses, if AI is relevant to a transaction you are structuring, if AI-generated evidence is at issue in a case you are litigating, or if AI regulation applies to your client's industry, you have a duty to understand the technology sufficiently to provide competent advice.

Rule 1.6: Duty of Confidentiality

The Rule: "A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent."

Rule 1.6 is arguably the most critical ethical rule implicated by AI use. Every time you enter information into an AI tool, you are potentially "revealing" that information to a third party -- the AI provider. The analysis turns on several factors:

What data does the AI provider retain? Consumer AI tools typically retain user inputs and may use them to train future model versions. This means that client information entered into a consumer AI tool could be incorporated into the AI's training data and could influence responses provided to other users. Enterprise AI tools typically commit to not retaining or training on user data, but you must verify this by reviewing the specific terms of service and data processing agreements.

Who has access to the data? Even if the AI provider does not use your data for training, employees of the AI provider may have access to your inputs for quality assurance, safety monitoring, or troubleshooting purposes. Determine who can access your data, under what circumstances, and what confidentiality obligations bind them.

Where is the data stored? For matters involving international data protection requirements (GDPR, cross-border data transfer restrictions), the physical location of the AI provider's servers may matter. Some enterprise AI providers offer data residency controls; others do not.

How long is the data retained? Even if data is not used for training, it may be retained in logs, backups, or conversation histories. Understand the retention period and ensure it is consistent with your confidentiality obligations.

Practical compliance framework:

1. Never use consumer-grade AI tools for work involving client information -- unless the client has given informed consent after being advised of the risks, which is a high bar and one most practitioners should not attempt to clear.

2. Use enterprise-grade tools with appropriate data protection agreements -- review the terms of service, data processing agreement, and security documentation before using any AI tool for client work.

3. Anonymize when possible -- strip client-identifying information before entering data into AI tools. You can describe a legal scenario in generic terms and still get useful AI output.

4. Document your data protection analysis -- keep a record of which AI tools you have evaluated, what data protection measures they offer, and your assessment of whether they meet your confidentiality obligations.

Rule 1.4: Duty of Communication

The Rule: "A lawyer shall... reasonably consult with the client about the means by which the client's objectives are to be accomplished."

An emerging question is whether attorneys have a duty to inform clients that AI is being used in their representation. No jurisdiction currently requires blanket disclosure of AI use, but several considerations argue in favor of proactive communication:

Client expectations. Many clients assume that their attorney is performing legal work personally. If AI is performing a significant portion of the analysis, research, or drafting, the client may reasonably want to know.

Fee implications. If you are billing for AI-assisted work, the client has a right to understand how that work was performed, particularly if AI reduced the time required.

Trust and transparency. Proactive disclosure of AI use builds trust and demonstrates professionalism. Clients who learn after the fact that AI was used in their representation -- particularly if a problem arises -- are likely to feel misled, even if no technical ethical violation occurred.

Recommended practice: Include a brief AI usage disclosure in your engagement letter, explaining that your firm may use AI tools to assist with certain tasks, that all AI output is reviewed and verified by a licensed attorney, and that client data is protected in accordance with your confidentiality obligations.

Rules 5.1 and 5.3: Duty of Supervision

Rule 5.1 addresses supervisory responsibilities of partners and supervising lawyers. Rule 5.3 addresses responsibilities regarding nonlawyer assistance.

The key question: Is AI output "nonlawyer assistance" within the meaning of Rule 5.3?

The better analysis treats AI as analogous to a nonlawyer assistant -- a tool that can perform legal tasks but whose output must be supervised by a licensed attorney. Under this framework:

• Partners and supervisory lawyers must ensure that the firm has reasonable policies and procedures governing AI use
• Lawyers who use AI must supervise AI output with the same diligence they would apply to work performed by a paralegal or junior associate
• Supervision means verification -- reviewing AI output for accuracy, completeness, and appropriateness before relying on it or sharing it with clients, courts, or third parties

The Mata v. Avianca case is a textbook example of supervision failure. Schwartz did not supervise ChatGPT's output at all. He accepted fabricated citations without verification. This would have been equally sanctionable if a paralegal had fabricated the citations -- the failure was in supervision, not in the choice of tool.

Rule 3.3: Candor Toward the Tribunal

The Rule: "A lawyer shall not knowingly... make a false statement of fact or law to a tribunal" and "shall not... fail to correct a false statement of material fact or law previously made to the tribunal by the lawyer."

This rule applies with particular force to AI-generated legal content submitted to courts:

• Every citation must be verified. Submitting an AI-generated citation without verifying that the case exists and that the holding is accurately described is a violation of Rule 3.3 -- regardless of whether the attorney "knew" the citation was false, because the attorney had a duty to verify it.

• AI-generated legal analysis must be substantively reviewed. If AI generates a legal argument that misstates the law, and you submit it to a court without catching the error, you have made a false statement of law to a tribunal.

• Disclosure of AI use may be required. Several courts have adopted standing orders or local rules requiring attorneys to disclose when AI was used in the preparation of court filings. Failure to comply with these disclosure requirements may itself constitute a violation of Rule 3.3 or the court's inherent authority.

---

State Bar Guidelines: The Evolving Regulatory Landscape

While the ABA Model Rules provide the foundational framework, individual state bars are developing their own AI-specific guidance. Understanding the regulatory landscape in your jurisdiction is essential.

States with Formal AI Guidance

As of early 2026, numerous state bars have issued formal opinions, guidelines, or ethics opinions addressing AI use in legal practice. While the specifics vary, common themes include:

California -- The State Bar of California has issued formal ethics opinions addressing AI use, emphasizing the duty of competence in understanding AI limitations and the duty of confidentiality in selecting AI tools. California's guidance is notable for its specificity regarding data protection requirements.

Florida -- The Florida Bar has addressed AI in the context of advertising and solicitation (ensuring AI-generated content complies with attorney advertising rules) and in the context of unauthorized practice of law (addressing the boundary between AI-assisted legal work by attorneys and AI-generated legal advice provided directly to consumers).

New York -- New York courts have been at the forefront of AI-related judicial orders, with several judges in the Southern and Eastern Districts issuing standing orders requiring AI disclosure. The New York State Bar Association has issued guidance emphasizing verification obligations and confidentiality requirements.

Texas -- The State Bar of Texas has addressed AI in the context of competence and supervision, with emphasis on the obligation to understand AI limitations before using AI tools in practice.

Common Requirements Across Jurisdictions

Despite jurisdictional variations, a consensus is emerging around several core requirements:

1. Verification obligation -- All jurisdictions that have addressed AI use require attorneys to verify AI-generated content before relying on it
2. Confidentiality compliance -- All jurisdictions require that AI tool selection and use comply with existing confidentiality obligations
3. Competence in technology -- Jurisdictions that have adopted Comment 8 to Rule 1.1 require attorneys to understand the benefits and risks of AI tools they use
4. Supervision of AI output -- AI output must be supervised with the same diligence applied to work performed by human assistants
5. Transparency -- An increasing number of jurisdictions encourage or require disclosure of AI use to clients and courts

---

Malpractice Considerations

AI use introduces new dimensions to legal malpractice exposure. Understanding these risks is essential for both avoiding liability and maintaining adequate insurance coverage.

Potential Malpractice Theories

Failure to verify AI output. The most obvious malpractice theory arising from AI use: if you rely on AI-generated content that is inaccurate, and the inaccuracy causes harm to a client, you may be liable for malpractice. The standard of care is clear -- you must verify AI output before relying on it. The Mata v. Avianca fact pattern, applied in a context where the client was harmed by the false citations (imagine if the case had been dismissed because the opposition successfully argued there was no supporting case law), would support a straightforward malpractice claim.

Failure to use available technology. A more provocative theory: if AI-assisted research or review would have identified a relevant authority, a problematic contract provision, or a critical factual issue that manual work missed, the failure to use AI may itself constitute a failure to meet the standard of care. While no court has yet held that failure to use AI constitutes malpractice, the standard-of-care analysis evolves with the profession. As AI adoption becomes widespread, the argument that competent practice requires AI use for certain tasks will become increasingly difficult to resist.

Confidentiality breach through AI. If client information is disclosed through an AI tool -- because the tool used client data for training, was breached, or otherwise failed to protect confidential information -- the attorney who selected and used that tool may face malpractice liability. The analysis would turn on whether the attorney's choice of tool and data-handling practices met the applicable standard of care.

Billing for AI-assisted work. If you bill a client for five hours of research that AI completed in fifteen minutes, you may face a fee dispute or, in extreme cases, a claim that the billing was fraudulent. The ethics of billing for AI-assisted work are still being resolved, but the direction is clear: billing must accurately reflect the work performed, including the role of AI.

Insurance Coverage Considerations

Contact your malpractice insurance carrier to understand:

• Whether your policy covers claims arising from AI use
• Whether your policy excludes technology-related errors
• Whether your carrier requires disclosure of AI tools used in practice
• Whether your premiums may be affected by AI adoption (in either direction -- some carriers view AI as risk-reducing because it catches errors, while others view it as risk-increasing because of hallucination)

---

Building Your Ethical AI Practice: A Verification Protocol

Theory is important. Practice is essential. Here is a concrete, step-by-step verification protocol for any AI-generated legal work product.

The Five-Check Protocol

Check 1: Citation Verification Every case, statute, regulation, rule, and secondary source cited by AI must be independently verified using official legal databases (Westlaw, Lexis, official government databases). This is not optional. This is not something you do "when you have time." This is a mandatory step that must be completed before any AI-generated citation is included in any work product.

Check 2: Substance Verification Even when AI cites a real case, verify that the holding, reasoning, and facts are accurately described. AI may cite a real case but misstate the holding, confuse the majority and dissent, combine elements from different cases, or describe a superseded version of a rule.

Check 3: Completeness Check AI may omit important contrary authority, key exceptions, recent amendments, or critical qualifications. Perform your own research to ensure that the AI has not provided a selectively favorable picture that omits important adverse information.

Check 4: Jurisdictional Accuracy Verify that the authorities cited by AI are actually authoritative in the relevant jurisdiction. AI may cite persuasive authority as if it were binding, apply federal law when state law governs, or cite out-of-jurisdiction cases without noting the jurisdictional limitation.

Check 5: Professional Judgment After the first four checks, apply your professional judgment. Is the analysis complete? Is the argument well-structured? Does it account for the specific facts and circumstances of your client's situation? Would you be comfortable putting your name on this work product and defending it to a judge, a client, or a disciplinary committee?

---

Applying What You Have Learned

---

Reflection: Your Ethical Commitment

The ethical use of AI in legal practice is not a burden -- it is a competitive advantage. Attorneys who use AI ethically and competently will deliver better work product, serve clients more effectively, and avoid the career-ending consequences that await those who cut corners.

Consider these questions:

1. What is your current verification practice? Be honest. If you have been using AI without verifying every citation and legal conclusion, commit to changing that practice immediately. Not tomorrow. Now.

2. What gaps exist in your data protection? Have you been using consumer AI tools for work that involves client information? If so, stop. Transition to enterprise-grade tools or anonymize your inputs.

3. What would you do if a client asked how you use AI? Could you explain your practices with confidence? If not, your practices need work.

4. What would you do if a judge asked whether AI was used in a filing? Could you answer honestly and demonstrate that appropriate verification was performed? If not, your verification process needs strengthening.

5. Are you prepared for the standard of care to evolve? The ethical landscape for AI in legal practice is changing rapidly. Commit to ongoing education -- not because it is required for CLE credit, but because it is required for competent practice.

The attorneys who faced sanctions in Mata v. Avianca did not set out to deceive anyone. They made a mistake born of ignorance and laziness -- ignorance about how AI works and laziness in failing to verify its output. You now have the knowledge to avoid that mistake. What remains is the discipline to apply that knowledge consistently, in every interaction with every AI tool, for every client matter, without exception.