AI settings for a small law firm in California

Checked against the source documents on October 26, 2026

The State Bar of California's practical guidance says to read a tool's terms of use and privacy policy to learn how inputs are used, and warns you may accept those terms just by using the product. The settings that answer that are on the main checklist. This page says which ones California points at, and why.

What California has said

State Bar of California, Standing Committee on Professional Responsibility and Conduct (COPRAC): Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026 Practical Guidance), 2026-05.

Confidentiality. Do not put client confidential information into a tool with material risks absent informed client consent; understand how the product collects, uses, stores and discloses data (2026 guidance p. 6).
Competence. Lawyer must keep control of strategy and judgment; professional judgment cannot be delegated to AI; review, verify and correct outputs (pp. 4-6).
Supervision. Managerial and supervisory lawyers should set clear AI policies, train staff, and update controls as tools become more autonomous (p. 7).
Fees. May bill actual time spent on AI-assisted work, not time saved; subscriptions are overhead; separately billed AI costs must be in the fee agreement at actual cost, no markup without informed written consent (p. 8).
Disclosure. Consider disclosing AI use to the client, especially where it materially affects decisions (p. 8); check court rules on AI disclosure and never let AI file or talk to a court without lawyer review (Candor section).
Verification. Review all outputs including citations before use; AI can produce plausible but false material and fake citations (pp. 2, 9).

The line about the tool itself. Lawyers should review vendor terms of use, privacy policies and documentation to learn how inputs are used; a user may accept terms merely by using the product (2026 p. 5). 2023 version: review the Terms of Use to see how the product uses inputs and whether it has data retention protocols (2023 p. 3). (2026 Practical Guidance, Confidentiality section, p. 5; 2023 version Confidentia)

One line from it: "any use of AI must not diminish or abdicate professional judgment" (2026 Practical Guidance, Conclusion, p. 3).

The settings that answer it

Use the business plan, not a personal one. On Claude Pro, Claude Max and ChatGPT Plus, training on chats is each user's own setting. On Claude Team, ChatGPT Business and Microsoft 365 Copilot with a work sign-in, business data is not used for training by default. On the checklist
Turn off the training and feedback exceptions an admin can still turn off (Claude feedback, ChatGPT personal accounts that are still in use). On the checklist
Set retention on purpose instead of taking the default. On the checklist
Turn on single sign-on so a lawyer who leaves loses access the same day. On the checklist
Decide on connectors, apps and agents before staff add them. On the checklist
Pick a rule on memory, and teach temporary or incognito chats for one-off matter questions. On the checklist
Put the vendor's written terms on training, retention, subprocessors and breach notice in the file. On the checklist
Write the one-page staff instruction and a note for each new hire. On the checklist
Keep a verification step before anything is filed. That is a procedure, not a setting, and no vendor sells it. On the checklist
Decide what the engagement letter says about AI use and billing. That is yours to write; I only flag that the opinion raises it. On the checklist

Rules around it

Technology competence: Yes. Cal. Rules of Professional Conduct, Rule 1.1, Comment [1] (benefits and risks of relevant technology), approved by California Supreme Court March 22, 2021

Technology CLE: At least 1 credit hour on technology in the practice of law within the 25-hour, 36-month MCLE cycle; shown as required for compliance periods ending March 29, 2025 and later (State Bar MCLE rules. (rule)

Court rule on AI in filings: SB 574 (Stats. 2026, ch. 858), Bus. and Prof. Code sec. 6068.1 (statute, not a court rule), enacted 2026-09-30, effective 2027-01-01. What it asks of the signer: verify and disclose.

In motion: COPRAC proposed new comments on AI to Rules 1.1, 1.4, 1.6, 3.3, 5.1 and 5.3; approved for 45-day public comment March 13, 2026; comment period closed May 4, 2026; COPRAC reviewing input, then Board of Trustees and California Supreme Court approval needed; no effective date set 2026-05-04 source; Board of Trustees agenda item 6.3 to approve and publish the 2026 Practical Guidance (adds agentic AI) and depublish the 2023 version; the 2026 version is now the document served at the calbar Practical Guidance URL 2026-05-14 source

What this page is not

This is a tech settings page, not legal advice. The state document above is the ethics half and it is yours to read and decide on. I am not a lawyer. I link the source so you can check me.

Send me one screenshot

Crop out client names, send me a screenshot of your Claude, ChatGPT or Microsoft 365 admin settings page, and I'll write back what I'd change. Free. I never need a login.

If you want this kept current for your firm, that is the monthly desk: I watch these settings as the vendors change them and as your state changes its guidance, answer staff questions in writing, usually within one business day, and write up setup notes for each new hire. $500 a month, cancel any month.

Email [email protected]

Who wrote this

I'm Nick Kaufman. I've spent six years in customer-facing technical support for SaaS, payments and CRM software, including three years at Tier 2 on a CRM built for financial advisors, whose firms work under SEC and FINRA rules. I'm not a lawyer and I don't give legal advice. I set up software so it does what the people responsible for it decided it should do.

Other states: the full list.