AI clause for engagement letters: what firms actually wrote
At least one mid-size firm is holding its engagement letter clause until the professional liability carrier signs off, treating the insurer, not the state bar, as the binding governance voice on AI risk. That finding upends the standard story about what the holdouts are waiting for. Of firms that have added AI language to their engagement letters, 45% address billing explicitly. Almost none of them address what happens when the client feeds privileged documents into a public AI tool.
| What mid-size firms report | Share |
|---|---|
| Of firms with active AI language, address billing explicitly | 45% |
How we know this
Sidebar puts one question a week to legal management professionals at firms of 10 to 200 attorneys. Members are verified by title, employer, and firm size before they are admitted, and every reply is private. This page draws on every Sidebar cycle that has touched this question, and it is updated as new replies come in. We publish patterns across the group, never individual firms, and only once at least five members have replied to that question. Full methodology at gosidebar.ai/methodology.
Disclosure adoption has no standard, and the gap is wide
Roughly half of mid-size firms have added some kind of AI language to their engagement letters, and the other half have not. Among the half that moved, the range runs from a single clause folded into the expenses section on one end to a multi-section disclosure covering both firm obligations and client conduct on the other. That spread is itself the finding. There is no emerging norm for a firm to copy, so each one is drafting from a blank page instead of adapting language the market has already settled on. Firms waiting for a template to borrow will be waiting past their next few matters. The absence of a standard also means the firms that did move first are not necessarily the ones with the strongest legal reasoning behind their language. Some are simply the firms whose managing partner happened to raise it in a meeting before anyone else's did, which is a strange basis for what is functionally becoming the market's reference clause.
The insurer is the real governance authority
Bar guidance is the official reason firms give for waiting. But some are sitting on their clause until the professional liability carrier signs off first, not the state bar. Carriers have a direct financial stake in how AI use gets disclosed and documented, and they can move the premium when they speak. The bar can only sanction. Firms do not say this out loud because it implies the bar is the secondary authority. The implication holds up. A carrier that has priced the risk of undisclosed AI use into a firm's premium has more leverage over that firm's behavior in a single renewal cycle than a bar association is likely to exercise in years of rulemaking, and firms that carry professional liability coverage know it even when they will not say so in a committee meeting.
Firms covered their own AI use. They left the client side wide open.
Among firms that have active engagement language, 45% address how AI-assisted work is billed. What those same clauses almost never touch is what the client does: feeding attorney communications, privileged documents, or case strategy into a public AI tool. Once that happens, the firm cannot reverse the privilege-waiver exposure it created. The engagement letter is the one place the firm can say something before a matter opens, while the client's own behavior is still an open question rather than a fact already in the record. Most skip it.
Internal approval, not drafting, is the actual bottleneck
Among firms without finalized language, the holdup is rarely the writing itself. Draft clauses sit in plenty of firms that have not adopted anything. What stalls is internal alignment: an executive committee debating whether disclosure invites client friction, layered on top of a separate and unresolved argument about whether bar rules in a given jurisdiction compel any of this at all. A clause sitting in committee for two quarters is not a drafting problem wearing extra steps. It is a decision nobody has been willing to force, dressed up as further review. The committee is not wrong to be cautious. Client-facing language carries real risk if it is worded badly, and a rushed clause can create exposure a firm did not have before. But caution and paralysis produce the same outcome from a client's perspective: no disclosure at all, for as long as the internal debate runs.
Consent by engagement is becoming the default
Firms are not requiring affirmative opt-in. The pattern across these agreements is consent-by-engagement: the client gets a disclosure clause and signing means they accept it. That sidesteps the client-friction concern and matches how firms handle other technology disclosures. The firms that did not wait for the bar-rules question to resolve are the ones whose clauses are now the reference point everyone else is quietly measuring against.
The consent-by-engagement default already has an answer moving through it
In July 2024 the ABA Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512 on generative AI, and it states plainly that merely adding general, boiler-plate provisions to an engagement letter to authorize the use of generative AI is not sufficient. The one-clause, signed-once model many of our members have landed on sits close to the pattern the opinion singles out. That does not mean the clause needs to run for pages. It means the language has to be specific to what the firm really does with the tool on that particular matter, not one general sentence doing duty for every future use case the firm has not yet decided on. A single boiler-plate sentence signed once at intake is exactly the pattern the opinion calls out by name, no matter how prominently it is placed in the letter or how official and reassuring it sounds to a client reading it for the first time.
Source: Clear Guidance Partners, ABA Formal Opinion 512: Generative Artificial Intelligence Tools
What to do with this
Do not wait for a regulator, an insurer, or a malpractice case to settle which question, risk management, client relations, or bar compliance, matters most. Draft a clause this quarter that covers two things at minimum: how the firm uses AI on client matters, specific enough to clear the boiler-plate bar the ABA has already named, and what the firm expects from the client on the other side of the table, whether that is a warning against feeding privileged material into a public tool or something more tailored to the matter type. The smallest firms in this group moved fastest, not because they had better answers, but because they had less committee friction to push through and less to lose from an imperfect first version. A clause you can revise next year beats a draft still sitting in committee next year. If the internal debate is genuinely stuck on whether bar rules compel disclosure, set that question aside and answer a narrower one instead: what would you want a client to know if they asked you directly. Draft to that standard, and the bar question stops being a blocker.
We tell our clients don't talk about your case to your neighbor, don't post about it on social media. But are we telling them don't put this into a publicly available model that trains large language models? No, we're not telling them that yet.
Members get more. The breakdown by firm size, practice area, and tech stack. A new question every Tuesday, the outlier answers that cut against the pattern, and most weeks an expert take with one clear next step.
Frequently asked questions
- Do law firms really need an AI clause in their engagement letters?
- There is no single universal bar mandate requiring one everywhere, but the ABA's Formal Opinion 512 makes clear that any consent covering generative AI use must be specific rather than boilerplate. Roughly half of mid-size firms have already added some form of AI language, and the share is climbing.
- What exactly should an AI clause in a law firm engagement letter cover?
- The strongest clauses cover both sides: how the firm uses AI on the matter, specific enough to satisfy informed consent, and what the firm expects from the client, including a warning against feeding privileged material into a public AI tool. Most current clauses only cover the firm side.
- Why do some law firms wait for their insurance carrier before adding AI language?
- Malpractice carriers have a direct financial stake in how AI use is disclosed and documented, and they can adjust premiums based on it directly. Some firms treat carrier sign-off as the real governance authority, well ahead of formal bar guidance.
- Is boilerplate AI consent language enough for a law firm engagement letter?
- No. The ABA's Formal Opinion 512 states that merely adding general, boilerplate provisions to an engagement letter to authorize generative AI use is not sufficient. Consent needs to be specific and current to how the firm is really using the tool day to day.
- Should an AI engagement letter clause require the client to opt in affirmatively?
- Most firms with active language are not requiring it. The dominant pattern is consent-by-engagement: the client receives the disclosure, and continuing to engage the firm counts as accepting it. That lower-friction approach matches how firms already handle other technology disclosures, though it has not yet been tested by a client dispute or a malpractice claim that turns on what the client understood at the moment they signed.