# Questions Oregon firms can ask an AI vendor, drawn from the bar's own guidance > A vendor-neutral list of questions about AI tools, each tied to what Oregon State Bar Formal Opinion 2026-208, the OSB's AI opinion draft, the PLF and NIST say about vetting technology vendors. Law + AI Daily by TacticalMS · Bring in the tech · Published 2026-10-29 Canonical: https://tacticalms.dev/blog/questions-to-ask-ai-vendor-oregon-law-firm ## The short version - Oregon State Bar Formal Opinion 2026-208 says lawyers should conduct due diligence on a chatbot and its vendors, including the other software products the tool relies on [1]. - Opinion 2026-208 lists reference checks, the vendor's security policies, its hiring practices and specific confidentiality agreements as part of overseeing outside providers [1]. - The AI opinion draft presented to the Oregon State Bar Board of Governors in February 2025 pointed to contract terms on how data is "handled, encrypted, stored, and ultimately destroyed" [2]. - The OSB Professional Liability Fund's vendor checklist asks what access a provider has to a firm's data and whether the provider stores the data itself [3]. Oregon State Bar guidance does not name approved AI vendors, but it does describe what lawyers are expected to look into before relying on one. Formal Opinion 2026-208, approved by the Oregon State Bar Board of Governors in February 2026, says "lawyers should conduct due diligence on the chatbot and potential vendors" [1]. This post turns that guidance, and related Oregon and federal sources, into a list of questions a firm can put to any AI vendor. It does not evaluate any product. ## Why vendor questions matter under the Oregon opinions Opinion 2026-208 deals with chatbots and AI agents that talk with clients and prospective clients, and it treats the vendor behind the tool as someone the lawyer supervises [1]. The opinion says Oregon lawyers "are professionally responsible to supervise the accuracy of all work product" [1]. Our [plain-English guide to Opinion 2026-208](/osb-formal-opinion-2026-208) walks through the rest of that opinion rule by rule [1]. The bar's general AI opinion, Formal Opinion 2025-205, covers AI tools used behind the scenes. NWSidebar reported in March 2025 that the Oregon State Bar had issued it [5]. The draft presented to the Board of Governors for its February 21, 2025 meeting said "lawyers should approach contract negotiations with any AI providers carefully" [2]. The quotes below come from that draft as presented to the Board; the published opinion is on the Oregon State Bar website, and our [overview of Oregon's two AI ethics opinions](/blog/oregon-ai-ethics-opinions-explained) summarizes both [2, 5]. ## Questions about training and data use - **Does the tool use our prompts or client information to train its model?** Opinion 2026-208 says lawyers should confirm "that client information is not used for chatbot training" [1]. - **Is this an "open" or "closed" system?** The February 2025 draft described some models as "open," continuously learning from data inputs, and others as "closed," operating in isolation [2]. For closed models, the draft said data "is processed and retained within a secure environment" [2]. - **Can the firm limit what it sends?** The draft said that where consent is not obtained, lawyers need to anonymize or redact sensitive information, and that "the anonymization or redaction is complete and effective" [2]. ## Questions about storage, encryption and deletion - **How is data handled, encrypted, stored and destroyed?** The February 2025 draft pointed to contract "provisions that address how data is to be handled, encrypted, stored, and ultimately destroyed" [2]. - **Is data encrypted at rest and in transit, and who holds the key?** The OSB Professional Liability Fund's "Online Data Storage Providers" checklist asks "Is data encrypted both at rest and in transit?" and whether the system offers a private encryption key held only by the firm [3]. - **Where is the data, and does the vendor store it itself?** The PLF checklist asks whether the provider "actually store[s] your data, or is it stored elsewhere" and suggests reviewing the agreement between the provider and its data storage facility [3]. - **What access does the vendor have?** The PLF checklist asks "What access does the cloud service provider have to your data?" and says to review the terms of service or end user license agreement, adding "Make no assumptions" [3]. ## Questions about the vendor itself Opinion 2026-208 lists several steps for overseeing outside providers such as chatbot vendors [1]: - **References and credentials.** The opinion notes "the importance of reference checks and vendor credentials" [1]. - **Security policies.** It points to "understanding the vendor's security policies and protocols" [1]. - **Hiring practices.** It mentions "familiarity with the vendor's hiring practices" [1]. - **Confidentiality terms.** It refers to "using specific confidentiality provisions or agreements" [1]. - **The vendor's own software suppliers.** The opinion observes that a software product may rely on products from other vendors, and says those "should also be considered as part of the due diligence" [1]. ## Questions for client-facing chatbots For tools that talk with the public, Opinion 2026-208 adds questions about review and control [1]: - **Can a lawyer see every conversation?** The opinion says a lawyer should review "all communications so that any misstatements can be promptly corrected" [1]. - **Can a responsible lawyer be notified automatically?** The opinion says it "would be prudent to have a responsible lawyer be automatically notified" [1]. - **Can responses be changed?** The opinion says chatbot communications should be monitorable and "the responses modified if necessary" [1]. - **Can autonomous actions wait for approval?** It says it would be prudent to subject autonomous actions by a chatbot "to lawyer approval" [1]. - **Does it support disclaimers and conflict checks?** The opinion refers to "appropriate disclaimers" and to entering prospective clients promptly into the firm's conflict management system [1]. ## A broader framework for AI risk The National Institute of Standards and Technology released the AI Risk Management Framework (AI RMF 1.0) on January 26, 2023, and says it "is intended for voluntary use" [4]. On July 26, 2024, NIST released NIST-AI-600-1, a Generative Artificial Intelligence Profile that helps organizations identify risks specific to generative AI [4]. Neither document is an ethics rule, but both give vocabulary some vendors use when describing their risk controls [4]. ## What these sources do not settle None of these sources certifies any vendor as meeting the Oregon Rules of Professional Conduct, and the PLF checklist was written for online data storage, not AI specifically [1, 3]. Whether a particular tool and contract fit a firm's obligations is a question for the firm and, where needed, a licensed Oregon attorney or the Oregon State Bar's ethics resources [1]. ## Common questions ### What does the Oregon State Bar say about vetting an AI vendor? Formal Opinion 2026-208, approved in February 2026, says lawyers should conduct due diligence on the chatbot and potential vendors, and points to reference checks, vendor security policies and confidentiality agreements [1]. ### Does Oregon ethics guidance address AI tools training on client data? Opinion 2026-208 says lawyers should confirm that client information is not used for chatbot training [1]. The February 2025 draft of the bar's general AI opinion described "open" models that keep learning from what users enter [2]. ### Is there an Oregon checklist for vetting a cloud or data vendor? The OSB Professional Liability Fund publishes "Online Data Storage Providers," revised in August 2017, with questions on encryption, backups, server location and provider access [3]. ### Is the NIST AI Risk Management Framework required for law firms? No. NIST says the AI Risk Management Framework, released January 26, 2023, "is intended for voluntary use" [4]. ## Sources 1. [Formal Opinion No. 2026-208: Chatbots and AI Agent Communications](https://www.osbar.org/_docs/ethics/2026-208.pdf), Oregon State Bar, approved February 2026 2. [Board of Governors agenda item 6C, Legal Ethics Committee (draft AI opinion)](https://bog.osbar.org/files/6C-2025.02-LEC-Combined.pdf), Oregon State Bar, February 21, 2025 3. [Online Data Storage Providers](https://www.osbplf.org/assets/forms/pdfs//Online%20Data%20Storage%20Providers.pdf), Oregon State Bar Professional Liability Fund, revised August 2017 4. [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), National Institute of Standards and Technology 5. [Oregon Issues Ethics Opinion on AI in Law Practice](https://nwsidebar.wsba.org/2025/03/24/oregon-issues-ethics-opinion-on-ai-in-law-practice/), NWSidebar (Washington State Bar Association), March 24, 2025 --- Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation.