AI Provisions in Outside Counsel Guidelines: A Compliance Guide for Law Firms

Corporate clients are adding AI provisions to their outside counsel guidelines (OCGs). These clauses set rules for when and how your firm may use generative AI on the client's matters.

Most AI provisions require the same core things. You must disclose or get written consent before using AI, use only approved tools, keep client data out of public models, avoid billing for AI-driven time savings, and keep a human reviewing the work.

This guide explains each common clause, the court and ethics rules behind them, and a numbered checklist your firm can follow every time a client's OCG restricts AI. It is educational, not legal advice.

What AI provisions in outside counsel guidelines are

AI provisions are rules a client writes into its outside counsel guidelines to govern how your firm uses artificial intelligence on its matters. OCGs are the client's binding instructions for outside law firms.

These clauses usually cover generative AI tools that draft, summarize, or analyze legal work. They tell your firm what you may use, when you must tell the client, and how you may bill.

Clients add them because AI touches confidentiality, privilege, accuracy, and cost all at once. A client's general counsel wants control over each of those risks before your firm applies AI to their work.

The Association of Corporate Counsel now publishes a sample set of AI guidelines for outside counsel. That template is one reason similar clauses are spreading across many client OCGs.

Why corporate clients are adding AI clauses now

Clients add AI clauses because generative AI can expose their confidential data and produce false results. A public model may store or reuse whatever your firm types into it.

High-profile filings with fake AI-invented case citations alarmed in-house teams. The Mata v. Avianca sanctions made clients worry that AI errors could reach their matters.

Clients also want to capture the cost savings AI creates. If a tool cuts drafting time, many clients expect that saving, not a full hourly bill.

So the AI clause is now a standard part of vendor risk management. The client treats your firm like any other vendor handling sensitive data with new technology.

Clause 1: Disclosure and prior written consent

The most common clause requires disclosure or prior written consent before your firm uses AI on the matter. Some clients want notice; stricter clients want approval in writing first.

Read the exact wording. A disclosure clause means you inform the client. A consent clause means you cannot start until the client says yes.

This mirrors legal ethics guidance. ABA Formal Opinion 512 says lawyers should get a client's informed consent before entering client information into many self-learning AI tools.

The ABA also warns that boilerplate consent buried in an engagement letter is not enough. The client needs specific information about the tool and its risks.

Clause 2: Approved tools and prohibited tools

Many OCGs limit your firm to an approved list of AI tools. Some name specific tools; others ban all consumer or public models outright.

A common line bans free public chatbots for any client work. Enterprise tools with contractual data protections are often allowed instead.

Match every tool your team uses against the client's list before the work starts. A tool that is fine for one client may be banned by another.

Keep a simple record of which tool touched which matter. If the client asks, you can show that every tool used was on their approved list.

Clause 3: Confidentiality and privilege protection

AI clauses almost always forbid putting client data into public models. The core rule is simple: no client confidences go into a tool that could leak or reuse them.

This protects both confidentiality and privilege. Sharing client information with an outside AI vendor can risk waiving attorney-client privilege.

ABA Formal Opinion 512 tells lawyers to weigh the risk that client information could be disclosed before entering it into any AI tool. Self-learning tools raise the biggest concern.

Practical compliance means isolating client data. Use tools that do not train on your inputs, and turn off any data-retention or history features.

Clause 4: Billing rules for AI-assisted work

Billing clauses stop your firm from charging full hourly time for work that AI made faster. If a tool cuts a task from four hours to one, many clients expect to pay for one.

Some OCGs go further and bar charging for AI time at all. Others simply require your bill to reflect actual attorney time spent.

ABA Formal Opinion 512 sets the ethical floor. Lawyers who bill hourly must bill for their actual time, not the time a task would have taken without AI.

You also usually cannot bill a client to learn a general AI tool. You may bill for learning a tool only when that client specifically asks you to use it.

Clause 5: Data security, retention, and human review

Data-security clauses set rules for how AI tools store and protect client information. They often require encryption, limited retention, and deletion of client data after the matter.

Human-review clauses require a qualified lawyer to check all AI output. AI can invent facts and citations, so a person must verify accuracy before anything is used or filed.

The ACC sample guidelines group these together, covering disclosure, data security, accuracy, and performance. Many client OCGs borrow that same structure.

Treat AI output as a first draft, never a final product. A lawyer's independent judgment must sit behind every deliverable that reaches the client or a court.

Court orders that also require AI disclosure

Client OCGs are not the only source of AI rules. A growing number of judges have issued standing orders requiring lawyers to disclose AI use in court filings.

The rules vary by judge. Some require you to certify no generative AI was used, while others require you to name the specific tool and confirm a human verified every citation.

For example, some standing orders require a certification that either no AI was used, or that a person checked every statement and citation for accuracy. Standard research platforms like Westlaw and Lexis are often carved out.

So your firm may face two layers of AI rules on one matter: the client's OCG and the court's standing order. Check both before you file.

The bar ethics duties behind the clauses

Even without a client clause, bar ethics rules already govern AI use. ABA Formal Opinion 512, issued July 29, 2024, is the leading national guidance.

The opinion ties AI use to core duties: competence, confidentiality, communication, and reasonable fees. A lawyer must understand a tool well enough to use it responsibly.

It confirms lawyers must comply with any AI disclosure requirements in their engagement agreements or applicable outside counsel guidelines. So the client's OCG and your ethics duties point the same way.

Several state bars have issued their own AI opinions that build on this framework. Your firm should check the rules in every state where it practices.

The step-by-step OCG AI compliance checklist

Follow this numbered process every time a client's OCG restricts AI. Each step maps to a common clause and keeps your firm inside the client's rules.

1. Inventory the clause. Read the OCG and any separate AI policy, then write down exactly what it requires: disclosure, consent, tool limits, billing rules, and data terms.

2. Map to approved tools. Compare the client's allowed and banned tools to what your team actually uses on the matter. Remove any tool that is not permitted.

3. Get written consent. If the clause requires consent, request it in writing with specific detail about the tool and its risks, not boilerplate. Wait for approval before starting.

4. Isolate client data. Use only tools that do not train on your inputs, turn off history and retention, and never paste client confidences into a public model.

5. Log usage. Record which tool touched which task on the matter, so you can answer any client audit or court certification later.

6. Adjust billing. Bill actual attorney time, remove AI-driven efficiency gains the client is entitled to, and do not bill to learn a general tool.

7. Train the team. Make sure every lawyer and staff member on the matter knows the client's specific AI rules before they touch the file.

8. Audit and verify. Have a qualified lawyer review all AI output for accuracy, and periodically check that the matter still complies with the clause.

What happens if your firm violates an AI clause

Violating a client's AI clause is not just an awkward call. The real risk is financial, reputational, and ethical, and it can hit all three at once.

First comes the money. A client who spots AI-billed hours or an unapproved tool will write off the invoice, and your firm eats the loss.

Next comes the relationship. OCG breaches erode client trust and can cost your firm the matter, or the entire client relationship, at renewal time.

The most serious risk is malpractice and ethics exposure. If unreviewed AI output causes an error, or if a data leak waives privilege, your firm can face a claim or a bar complaint.

How to build a repeatable internal AI process

The way to comply at scale is one internal AI policy, not case-by-case guesswork. A firm policy sets your baseline, and each client's OCG tightens it where needed.

Start with a written firm AI policy that covers approved tools, confidentiality, human review, and billing. Our law firm AI policy template gives you a fill-in-the-blank starting point.

Then add a matter-intake step that runs the checklist above whenever a client restricts AI. Assign one person to own OCG review so nothing slips through.

This section is general information, not legal advice. Every clause is different, so consult your own counsel and the specific client OCG before acting. When in doubt, ask the client directly.