Questions Oregon firms can ask an AI vendor, drawn from the bar's own guidance

Informational only, not legal advice. TacticalMS is not a law firm. Read more.

Oregon State Bar guidance does not name approved AI vendors, but it does describe what lawyers are expected to look into before relying on one. Formal Opinion 2026-208, approved by the Oregon State Bar Board of Governors in February 2026, says "lawyers should conduct due diligence on the chatbot and potential vendors" ¹. This post turns that guidance, and related Oregon and federal sources, into a list of questions a firm can put to any AI vendor. It does not evaluate any product.

Why vendor questions matter under the Oregon opinions

Opinion 2026-208 deals with chatbots and AI agents that talk with clients and prospective clients, and it treats the vendor behind the tool as someone the lawyer supervises ¹. The opinion says Oregon lawyers "are professionally responsible to supervise the accuracy of all work product" ¹. Our plain-English guide to Opinion 2026-208 walks through the rest of that opinion rule by rule ¹.

The bar's general AI opinion, Formal Opinion 2025-205, covers AI tools used behind the scenes. NWSidebar reported in March 2025 that the Oregon State Bar had issued it ⁵. The draft presented to the Board of Governors for its February 21, 2025 meeting said "lawyers should approach contract negotiations with any AI providers carefully" ². The quotes below come from that draft as presented to the Board; the published opinion is on the Oregon State Bar website, and our overview of Oregon's two AI ethics opinions summarizes both ^{2, 5}.

Questions about training and data use

• Does the tool use our prompts or client information to train its model? Opinion 2026-208 says lawyers should confirm "that client information is not used for chatbot training" ¹.
• Is this an "open" or "closed" system? The February 2025 draft described some models as "open," continuously learning from data inputs, and others as "closed," operating in isolation ². For closed models, the draft said data "is processed and retained within a secure environment" ².
• Can the firm limit what it sends? The draft said that where consent is not obtained, lawyers need to anonymize or redact sensitive information, and that "the anonymization or redaction is complete and effective" ².

Questions about storage, encryption and deletion

• How is data handled, encrypted, stored and destroyed? The February 2025 draft pointed to contract "provisions that address how data is to be handled, encrypted, stored, and ultimately destroyed" ².
• Is data encrypted at rest and in transit, and who holds the key? The OSB Professional Liability Fund's "Online Data Storage Providers" checklist asks "Is data encrypted both at rest and in transit?" and whether the system offers a private encryption key held only by the firm ³.
• Where is the data, and does the vendor store it itself? The PLF checklist asks whether the provider "actually store[s] your data, or is it stored elsewhere" and suggests reviewing the agreement between the provider and its data storage facility ³.
• What access does the vendor have? The PLF checklist asks "What access does the cloud service provider have to your data?" and says to review the terms of service or end user license agreement, adding "Make no assumptions" ³.

Questions about the vendor itself

Opinion 2026-208 lists several steps for overseeing outside providers such as chatbot vendors ¹:

• References and credentials. The opinion notes "the importance of reference checks and vendor credentials" ¹.
• Security policies. It points to "understanding the vendor's security policies and protocols" ¹.
• Hiring practices. It mentions "familiarity with the vendor's hiring practices" ¹.
• Confidentiality terms. It refers to "using specific confidentiality provisions or agreements" ¹.
• The vendor's own software suppliers. The opinion observes that a software product may rely on products from other vendors, and says those "should also be considered as part of the due diligence" ¹.

Questions for client-facing chatbots

For tools that talk with the public, Opinion 2026-208 adds questions about review and control ¹:

• Can a lawyer see every conversation? The opinion says a lawyer should review "all communications so that any misstatements can be promptly corrected" ¹.
• Can a responsible lawyer be notified automatically? The opinion says it "would be prudent to have a responsible lawyer be automatically notified" ¹.
• Can responses be changed? The opinion says chatbot communications should be monitorable and "the responses modified if necessary" ¹.
• Can autonomous actions wait for approval? It says it would be prudent to subject autonomous actions by a chatbot "to lawyer approval" ¹.
• Does it support disclaimers and conflict checks? The opinion refers to "appropriate disclaimers" and to entering prospective clients promptly into the firm's conflict management system ¹.

A broader framework for AI risk

The National Institute of Standards and Technology released the AI Risk Management Framework (AI RMF 1.0) on January 26, 2023, and says it "is intended for voluntary use" ⁴. On July 26, 2024, NIST released NIST-AI-600-1, a Generative Artificial Intelligence Profile that helps organizations identify risks specific to generative AI ⁴. Neither document is an ethics rule, but both give vocabulary some vendors use when describing their risk controls ⁴.

What these sources do not settle

None of these sources certifies any vendor as meeting the Oregon Rules of Professional Conduct, and the PLF checklist was written for online data storage, not AI specifically ^{1, 3}. Whether a particular tool and contract fit a firm's obligations is a question for the firm and, where needed, a licensed Oregon attorney or the Oregon State Bar's ethics resources ¹.

Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation. Researched and drafted with AI tools from the sources above and checked against our editorial standards. Spot an error? Email intake@tacticalms.dev and we'll fix it.