AI Governance Is Becoming a Core Law Firm Responsibility

The legal profession has spent the last two years debating how generative AI belongs in legal practice. In California, that debate is now giving way to something more practical: governance. Earlier this year, the State Bar of California issued new ethics guidance addressing lawyers’ use of generative AI tools, signaling that AI competency is no longer a theoretical issue for attorneys. The guidance does not prohibit AI use, nor does it treat generative AI as categorically suspect. Instead, it frames AI as another professional tool that lawyers may use only if they understand its limitations, supervise its outputs, and protect client confidentiality throughout the process. For businesses and law firms alike, the message is clear: the question is no longer whether AI can be used in legal work, but whether it can be used competently and responsibly.

The guidance focuses heavily on the core duties that already govern attorney conduct: competence, confidentiality, supervision, communication, and independent professional judgment. Lawyers using generative AI remain fully responsible for the accuracy of their work product, even when portions are drafted or summarized by an AI system. That may sound obvious, but the opinion directly addresses several real-world failure points that have emerged over the last year, including fabricated case citations, inaccurate factual summaries, disclosure of confidential client information into public AI systems, and overreliance on AI-generated legal analysis without meaningful attorney review. In other words, California is not creating a separate body of “AI lawyering” rules. It is applying longstanding professional obligations to a technology that can accelerate legal work while simultaneously magnifying mistakes if used carelessly.

The most important takeaway from the guidance may be what it implies about AI governance inside organizations. Informal experimentation is no longer enough. Law firms and legal departments now need documented policies governing which AI tools may be used, what types of information can be entered into those systems, how outputs must be reviewed, and when human escalation is required. Governance also means understanding the underlying technology itself: whether prompts are retained by the vendor, whether client data is used for model training, how retrieval systems are configured, and what safeguards exist against hallucinations or inaccurate outputs. Firms that treat AI adoption as merely a productivity initiative risk creating compliance, confidentiality, and malpractice exposure at the same time. The California guidance effectively reinforces that competent AI use is inseparable from disciplined operational oversight.

The guidance also underscores that responsible AI governance is not just a concern for technology companies or large enterprises; it also applies directly to lawyers and law firms themselves. Firms deploying generative AI internally must think like regulated organizations: evaluating vendors, documenting acceptable use policies, training attorneys and staff, monitoring compliance, and periodically reassessing whether existing safeguards remain adequate as AI tools evolve. That includes establishing clear approval processes for client-facing AI use, defining supervision responsibilities, maintaining human review standards, and ensuring that convenience does not override professional obligations. In practice, this means AI governance is becoming part of modern law firm risk management, alongside cybersecurity, confidentiality, and conflicts procedures.

California’s new ethics guidance is unlikely to be the first or last word on AI regulation in the legal industry. If anything, it provides an early roadmap for how firms can use these tools responsibly while continuing to meet their professional obligations. Other state bars and regulators will likely follow with their own guidance as generative AI becomes more deeply embedded in legal practice. The firms that benefit most from AI will not necessarily be the ones using the most advanced tools, but the ones building the strongest governance frameworks around them. As clients increasingly expect efficiency, technical sophistication, and operational maturity from their outside counsel, AI competency is quickly becoming part of what clients evaluate when selecting legal advisors. Firms that develop thoughtful, defensible AI governance programs now will be far better positioned than those still treating AI use as an informal experiment. If you find yourself struggling to build out an AI governance program, contact us at info@rikkagroup.com for assistance.