Can Your AI Keep a Secret?
It’s 9 p.m. on a Thursday, and a paralegal is racing to summarize three deposition transcripts before a Friday morning strategy meeting. She pastes a few hundred pages into a free AI chatbot on her laptop, and ten minutes later she has a tidy, organized summary. Mission accomplished, right?
Not so fast. Depending on that tool’s terms of service, those transcripts, complete with client names, medical details, and sensitive testimony, may now sit on a server the firm does not control. They may be retained indefinitely, reviewed by the vendor’s staff, or used to train future versions of the model. In one late night shortcut, the firm may have exposed privileged material and created a potential ethics problem without anyone realizing it.
This scene is playing out in firms of every size. According to a Clio Legal Trends report cited by the North Carolina Bar Association, 79% of legal professionals were using AI tools while 44% of law firms still had no formal governance policies. That gap between adoption and oversight is where risk lives. The answer is not banning AI, which tends to push usage underground. The answer is using it deliberately, with the right tools and the right guardrails.
The Rules
North Carolina lawyers have two key sources of guidance. Nationally, the ABA issued Formal Opinion 512 in July 2024, its first formal guidance on generative AI. Here at home, the North Carolina State Bar adopted 2024 Formal Ethics Opinion 1, which remains the state's primary word on the subject.
The NC opinion's bottom line is simple. The Rules of Professional Conduct do not prohibit lawyers from using AI, but a lawyer who does must use it competently, securely, and must apply independent judgment in supervising it.
On confidentiality, both opinions urge caution. The ABA specifically warns that tools which learn from user inputs could reveal one client's information in a later response, so informed client consent is needed first, and boilerplate engagement letter language is not enough. The NC opinion takes a similarly careful view of public AI tools.
The practical lesson is that a free chatbot and a properly configured enterprise platform are not comparable.
Where AI Earns Its Keep
Once your firm has a secure, approved platform in place, a wide range of everyday work becomes fair game.
First draft correspondence. Scheduling letters, status updates, engagement reminders, and routine client emails are ideal candidates. AI gets you to a solid starting point quickly, and a human reviews and polishes the final version before it goes out.
Summarizing discovery. Lengthy transcripts and large document productions can be condensed, so your team knows where to focus. Think of AI as a tireless first reader that never needs coffee, not as the final word on what the record says.
Intake and administrative work. Organizing intake information, building matter checklists, drafting internal procedures, and cleaning up templates reclaim meaningful time without touching legal judgment at all.
The North Carolina opinion indicates that lawyers generally do not need to tell clients when they use AI for ordinary tasks, much as they would not disclose the use of spellcheck or a research database. Even so, we recommend transparency. Clients increasingly ask about AI, and a firm that can explain its approach confidently builds trust rather than raising eyebrows.
Where the Attorney Stays in Charge
AI makes an excellent assistant, but it should never be the one arguing your case.
Court filings. Every citation, quotation, and argument requires human verification before it leaves the office. Generative AI has a documented habit of inventing case law that looks entirely convincing.
In the widely reported 2023 case Mata v. Avianca, a federal court in New York sanctioned attorneys who submitted a brief citing decisions that ChatGPT had fabricated, and courts across the country have since confronted similar filings. A growing number of judges now require lawyers to disclose or certify their use of AI in court submissions, so checking local rules and standing orders has become part of the routine.
Substantive legal work. When a lawyer relies on an AI tool to perform substantive work on a client’s matter, the North Carolina opinion treats that much like outsourcing to a nonlawyer, which calls for the client’s advance informed consent. The lawyer remains fully responsible for the final work product either way.
Billing. Efficiency gains belong in the client’s column, not hidden in the timesheet. A lawyer cannot bill three hours for a task AI helped complete in one, and the ABA adds that firms generally should not charge clients for the time lawyers spend learning a tool they will use across their practice. Flat fees, or passing along the actual cost of a specialized AI tool, may be appropriate when clearly explained and agreed to in advance.
Questions to Ask Before You Trust an AI Tool
AI is no longer something firms seek out. It is arriving on its own. Practice management systems, document management platforms, email clients, and legal research services are rolling out built-in AI features, sometimes switched on by default. Before anyone at your firm uses them, get clear answers to a handful of questions.
- Does the vendor use your firm’s data, including prompts and uploaded documents, to train or improve its models?
- Where is your data kept, in what jurisdiction, and for how long? Can it be permanently deleted on request, and will the vendor confirm that deletion?
- Who can access your information and under what circumstances? Is it encrypted both in transit and at rest?
- What access controls are present, such as single-sign-on, multifactor authentication, and audit logs showing who used the tool and when?
Finally, and most importantly, confirm that the contract puts every one of these promises in writing. A reassuring marketing page is not a data processing agreement. If the answers are vague, evasive, or buried in terms that change without notice, that is your cue to pause and dig deeper.
Put It in Writing
Remember our late-night paralegal? She wasn’t reckless. She was resourceful, under pressure, and missing one essential thing, a policy telling her which tools were approved and what information was off limits. A clear, practical AI use policy is the single most effective way to prevent that scenario, and it doesn’t need to be fifty pages long to be effective. A strong policy identifies approved tools and prohibits unapproved ones for client work.
Net Friends Pro-Tip: Download our free AI Use Policy Template.
How Net Friends Helps
Nearly every obligation in these ethics opinions rests on the technology underneath. Protecting client data, vetting vendors, controlling access, and training staff are IT questions just as much as they are ethics questions, and they are exactly where Net Friends lives.
We help North Carolina law firms evaluate AI tools and vendor contracts with confidentiality in mind, deploy and configure enterprise AI platforms so client data stays protected, review the AI features already embedded in the software you use every day, and put identity, access, and data protection controls in place that support your professional obligations. We also help train your team so that good habits become second nature, even at 9 p.m. on a Thursday.
Follow Us on LinkedIn
More Reading:
Artificial Intelligence Resource Hub
A Law Firm's Cybersecurity Primer
What the Texas Bar Hack Reveals About Cybersecurity Gaps
Take IT Off Your To-Do List.
Tech holding you back? Losing productivity to downtime?
Discover how we can simplify your tech and free up your time, contact us today.
At Net Friends, we believe in the power of human expertise. While we leverage AI to enhance our content and processes, all blog posts are written and edited by our knowledgeable staff. You can trust you are getting insights directly from our team.