Summary: Opinion 512 does not ban generative AI, does not require on-premises deployment, and does not name approved tools. It treats AI the way earlier opinions treat cloud computing: as a diligence question. Read the terms, understand what the vendor retains, make sure the confidentiality obligation is enforceable, and make sure you would be told about a breach. It also says explicitly that you may rely on someone else who has read and analysed those terms.
I am not a lawyer, and this is not ethics advice. I am a consultant who reads vendor terms for a living, and I am going to quote the opinion rather than characterise it, so you can check every claim against the source. Your obligations are yours, and your interpretation of them should come from someone qualified to give it.
The thing almost everyone gets wrong
The most common reason a small firm has not touched AI is a belief that using it means putting client confidences somewhere they should not go, and that the only safe version is something running on a server in the closet.
The words “on-premises” and “on-prem” do not appear anywhere in the fifteen pages of Opinion 512.
What it does instead is reason by analogy to guidance that already existed for cloud services and outsourcing. Here is the operative passage:
“opinions developed to address cloud computing and outsourcing of legal and nonlegal services suggest that lawyers should: ensure that the [GAI tool] is configured to preserve the confidentiality and security of information, that the obligation is enforceable, and that the lawyer will be notified in the event of a breach… determine whether the [GAI tool] retains information submitted by the lawyer before and after the discontinuation of services or asserts proprietary rights to the information”
ABA Formal Opinion 512
Read that as a checklist and it turns into four questions. Is it configured properly. Is the obligation enforceable. Will you be told about a breach. What does the vendor keep.
Every one of those is a question about configuration and contract. None of them is a question about hardware.
North Carolina says it more directly
If you practise in NC, the state opinion is more useful because it answers the actual question a partner asks out loud. The question put to the State Bar was whether a lawyer may provide client information to a third-party AI vendor. The answer:
“Yes, provided the lawyer has satisfied herself that the third-party company’s AI program is sufficiently secure and complies with the lawyer’s obligations to ensure any client information will not be inadvertently disclosed or accessed by unauthorized individuals pursuant to Rule 1.6(c).”
NC 2024 Formal Ethics Opinion 1
Yes, conditioned on diligence. The work is in the phrase “has satisfied herself”.
The line that matters most for a firm with no IT department
Opinion 512 anticipates that most lawyers are not going to parse a data processing agreement themselves, and says so:
“As a baseline, all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool or consult with a colleague or external expert who has read and analyzed those terms and policies. Lawyers may need to consult with IT professionals or cyber security experts”
ABA Formal Opinion 512
So the duty is to know, not necessarily to personally read. That is a meaningful difference for a six-attorney firm where nobody has time to compare three vendors’ retention policies.
I will declare my interest plainly: reading those terms and configuring tools to match what a firm has decided is the work I do. I am pointing at the sentence because it is in the opinion, not because it is convenient for me. Check it yourself.
What this does not mean
- It does not mean any particular tool is fine. The opinion sets out what to establish, not which vendors clear the bar.
- It does not mean the consumer app is the same as the business one. Same brand, frequently different data terms. Whatever you conclude about one may not carry to the other.
- It does not remove your responsibility for the output. A tool that drafts is one thing. A tool that sends is a decision you should make on purpose.
- It does not mean hiring anyone makes you compliant. Not me, not a vendor, not a consultant. The obligations stay with the firm.
Where to start
Read both opinions. They are short, and reading them yourself is worth more than reading anyone’s summary, including this one.
Then work through the questions they imply, tool by tool. I wrote those out as ten questions to ask any AI vendor before client information touches it, each traceable back to one of the two opinions. It is free and not gated.
If your firm is in one of the practices where the administrative load is heaviest, the practice-specific version is here: estate planning and elder law, personal injury, immigration.