Kaufman Ops

AI settings for a small law firm in New York

Checked against the source documents on October 26, 2026

NYC Bar Formal Opinion 2024-5 says to check that a provider doesn't train on your inputs, and to keep checking, because terms of use change. The settings that answer that are on the main checklist. This page says which ones New York points at, and why.

What New York has said

New York City Bar Association Committee on Professional Ethics: Formal Opinion 2024-5, Ethical Obligations of Lawyers and Law Firms Relating to the Use of Generative Artificial Intelligence in the Practice of Law, 2024-08-07.

  1. Confidentiality. NYC Bar 2024-5 p.2-3: no confidential client info into any system that shares inputs with third parties or lacks adequate security, absent client consent; even with consent avoid client-identifying details. NYSBA report p.58: get provider assurance it will protect and segregate client data.
  2. Competence. Rule 1.1 and comment 8: understand how the tool works, its risks and limits; hallucinations are a known risk (NYC Bar p.4-5; NYSBA p.29, p.57).
  3. Supervision. Rules 5.1-5.3 apply; supervisors must set policies and train lawyers and staff on ethical AI use (NYC Bar p.5-6; NYSBA p.59-60).
  4. Fees. Bill only time actually spent; AI costs disclosed in advance under Rule 1.5(b); surcharge over cost only if stated in engagement letter (NYC Bar p.7-8; NYSBA p.58).
  5. Disclosure. Consider telling the client when using non-routine generative AI, especially in fee explanations; routine tools need no disclosure (NYC Bar p.6 and n.21). Candor to tribunal under Rule 3.3; comply with any court AI order (NYC Bar p.7).
  6. Verification. Lawyer must check output and confirm citations are genuine; Mata v. Avianca and United States v. Cohen cited (NYC Bar p.5, p.7, n.18, n.22).

The line about the tool itself. NYC Bar 2024-5 p.3: review the system's Terms of Use; ensure provider does not share inputs or use them to train; Terms change often so monitor them periodically; consult IT or cybersecurity experts on security, confidentiality and data retention protocols; open vs closed systems distinguished (n.3, p.2-3). (NYC Bar Formal Op. 2024-5, p.3 (Duty of Confidentiality, Rule 1.6 row))

One line from it: "lawyers need guardrails and not hard-and-fast restrictions" (NYC Bar Formal Op. 2024-5, Introduction, second paragraph (p. 2)).

The settings that answer it

  1. Use the business plan, not a personal one. On Claude Pro, Claude Max and ChatGPT Plus, training on chats is each user's own setting. On Claude Team, ChatGPT Business and Microsoft 365 Copilot with a work sign-in, business data is not used for training by default. On the checklist
  2. Turn off the training and feedback exceptions an admin can still turn off (Claude feedback, ChatGPT personal accounts that are still in use). On the checklist
  3. Set retention on purpose instead of taking the default. On the checklist
  4. Turn on single sign-on so a lawyer who leaves loses access the same day. On the checklist
  5. Decide on connectors, apps and agents before staff add them. On the checklist
  6. Pick a rule on memory, and teach temporary or incognito chats for one-off matter questions. On the checklist
  7. Put the vendor's written terms on training, retention, subprocessors and breach notice in the file. On the checklist
  8. Write the one-page staff instruction and a note for each new hire. On the checklist
  9. Keep a verification step before anything is filed. That is a procedure, not a setting, and no vendor sells it. On the checklist
  10. Decide what the engagement letter says about AI use and billing. That is yours to write; I only flag that the opinion raises it. On the checklist

Rules around it

Technology competence: Yes. 22 NYCRR Part 1200, Rule 1.1 Comment [8] (benefits and risks associated with technology), effective 2015-03-28

Technology CLE: 1 credit per biennial reporting cycle in Cybersecurity, Privacy and Data Protection (0.5 may be ethics-type), effective 2023-07-01, 22 NYCRR 1500.22 (experienced attorneys) and 1500.12 (newly. (rule)

Court rule on AI in filings: 22 NYCRR Part 161, Use of Artificial Intelligence Technology, effective 2026-06-01 per secondary source (promise.legal 202. What it asks of the signer: none statewide (disclosure should not be required); optional model part rule requires certification by signature that..

In motion: NYSBA Task Force recommended amending the RPC Preamble and Rule 1.1 Comment [8] to address AI and creating a standing committee to update the guidelines; NYC Bar Op. 2024-5 n.2 calls rule changes premature. No proposed rule with a comment deadline found. 2024-04 source; UCS Interim Policy on the Use of AI is interim and applies to judges and court staff, not private lawyers; a final policy may follow. 2025-10-10 source

What this page is not

This is a tech settings page, not legal advice. The state document above is the ethics half and it is yours to read and decide on. I am not a lawyer. I link the source so you can check me.

Send me one screenshot

Crop out client names, send me a screenshot of your Claude, ChatGPT or Microsoft 365 admin settings page, and I'll write back what I'd change. Free. I never need a login.

If you want this kept current for your firm, that is the monthly desk: I watch these settings as the vendors change them and as your state changes its guidance, answer staff questions in writing, usually within one business day, and write up setup notes for each new hire. $500 a month, cancel any month.

Email [email protected]

Who wrote this

Nick Kaufman

I'm Nick Kaufman. I've spent six years in customer-facing technical support for SaaS, payments and CRM software, including three years at Tier 2 on a CRM built for financial advisors, whose firms work under SEC and FINRA rules. I'm not a lawyer and I don't give legal advice. I set up software so it does what the people responsible for it decided it should do.

Other states: the full list.