A one-page AI use policy for a small firm: the questions to answer

Informational only, not legal advice. TacticalMS is not a law firm. Read more.

Most small firms already use some AI, whether it is a drafting assistant, a research tool, transcription or a chatbot on the website. Oregon's ethics guidance expects firms to have written down how. Formal Opinion 2025-205 says managerial lawyers "must establish clear policies regarding the law firm's permissible use of AI," and that "Training must include the basics of the actual type of AI being used" ¹. Background on both of the bar's AI opinions is in Oregon's two AI ethics opinions, explained, and our guide to the bar's chatbot opinion covers website chatbots.

A policy does not need to be long to do that job. Below are the questions a one-page policy commonly answers, each tied to what the Oregon State Bar's opinions say. This is a list of topics to consider, not a template, and it is no substitute for reading the opinions or getting advice from a licensed Oregon attorney.

1. Which tools are approved?

Start with an inventory: every AI tool anyone at the firm uses, including features built into software the firm already pays for. The 2025 opinion says competence means understanding "the benefits and risks associated with the specific use and type of AI being used," including how a tool stores information and whether it uses prompts for training ¹. A named list of approved tools makes that review possible.

2. Is each tool "open" or "closed"?

Opinion 2025-205 draws a line between open models, which may learn from what users enter, and closed models that keep data in a secure environment. It says "An open model poses confidentiality risks" and that putting client information into one calls for the client's informed consent or complete anonymization ¹. For closed tools, the opinion points to reviewing the vendor's terms on data handling, encryption, storage and destruction ¹.

A policy can record, for each approved tool, which category it falls in and what kinds of information may go into it.

3. Who checks the output?

The opinion says lawyers must verify AI-assisted work, including citations, quotations and conclusions, and must check court rules and standing orders on AI use ¹. Oregon's appellate courts have sanctioned filings with fabricated authority in 2026, which made this point concrete for many firms ⁴. A policy can say who reviews AI-assisted work before it leaves the firm and what "checked" means.

4. How is AI-assisted work billed?

According to the opinion, lawyers may bill reasonable time for case-specific AI-assisted work but may not duplicate charges; time spent learning a tool is generally not billable unless the client asks and agrees; and actual AI costs passed to a client should be disclosed in advance, preferably in writing ¹. A billing section turns those points into the firm's own practice.

5. When are clients told?

The opinion says lawyers should consider talking with clients about AI use, and that disclosure is needed when AI use would deviate materially from what the client expects. It also notes engagement letters can describe AI use ¹. A policy can set the firm's default wording and say who decides in unusual matters.

6. What about client-facing chatbots?

If the firm uses a chatbot on its website or for intake, Formal Opinion 2026-208 adds its own points: protecting what prospective clients share, avoiding an accidental attorney-client relationship, making sure the tool does not give legal advice, and supervising the vendor ². Commentary on the opinion notes that it treats the vendor, not the AI itself, as the party the lawyer supervises ⁵.

7. Who is trained, and when is the policy reviewed?

The 2025 opinion calls competence an ongoing duty because tools and their risks change ¹. A policy can name who gets trained on each tool, and set a date to review the tool list and the policy itself.

For a general structure, some organizations borrow from the NIST AI Risk Management Framework, released January 26, 2023 and "intended for voluntary use" ³. Its four functions, Govern, Map, Measure and Manage, are written for organizations of any size and can serve as a checklist for the review ³.

Where to read more

• Formal Opinion 2025-205 and Formal Opinion 2026-208 on the Oregon State Bar website ^{1, 2}.
• A summary of the 2025 opinion from NWSidebar ⁶.
• The NIST AI RMF and its companion playbook ³.

Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation. Researched and drafted with AI tools from the sources above and checked against our editorial standards. Spot an error? Email intake@tacticalms.dev and we'll fix it.