AI Use Policy Development for California Law Firms and Legal Organizations
Turn your firm’s AI decisions and California’s new SB 574 requirements into rules attorneys and staff can actually follow.
The responsible attorney decides what the firm allows. I write it down as an operating policy: approved tools, client-data rules, who does what, verification, court disclosure, new tools, mistakes and staff changes. Then the setup makes it true.
THE PROBLEM
“Use AI carefully” is not a policy.
A general warning does not tell an associate whether a browser extension is approved, whether a client name
may be entered into a commercial workspace, whether a meeting bot may join a client call,
or what to do after someone uses a personal account by mistake.
A useful policy must answer the operational questions:
-
Which tools and account types are approved?
-
What information may be entered?
-
Who approves a new tool or matter use?
-
What must never be uploaded?
-
How are staff accounts created and removed?
-
What happens when a mistake is discovered?
-
Who checks whether the rules and vendor settings have changed?
Starting January 1, 2027, Business and Professions Code section 6068.1 requires an attorney who uses generative AI to restrict access to confidential information entered into it, verify the output and correct errors, and disclose generative-AI use to the court as the statute requires. Code of Civil Procedure section 128.7 now requires the attorney responsible for a filing to personally verify every citation in it. A written policy is how the firm shows it did those things.
CLEAR RULES FOR REAL LAW-FIRM USE
What the Policy Covers
1. Approved tools and accounts:
Which firm-controlled workspaces are approved, who may use each one, and the rule for personal, free, trial and shared accounts. Embedded AI counts: Copilot in Word, Outlook, Teams and Windows has to be named and set, program by program.
2. Client and matter information:
When client names, documents, discovery, communications and medical or protected material may go into an approved system, which account must be used, and what needs the attorney's sign-off for the specific matter.
3. Staff responsibilities:
Practical rules for attorneys, staff, contractors and experts on accounts, verification, sharing, memory, connectors, extensions, meeting tools and incident reporting, and when to stop and ask the attorney instead of deciding alone.
4. Approved, restricted, and prohibited uses:
Three groups. Approved: allowed in firm workspaces without matter-by-matter sign-off, such as drafting from public sources. Restricted: only with the attorney's authorization for that matter, such as uploading discovery or medical records. Prohibited: never, such as client information in a personal account, legal judgment left to the tool, or a citation nobody verified.
5. New tools and features:
Who approves a new tool, browser extension, agent, meeting bot, connector or embedded AI feature before anyone uses it for firm work, what the review looks at, and a simple request path so the alternative to "not yet" is not a personal workaround.
6. Mistakes and incident response:
Stop, preserve, report. After a wrong-account use, an accidental upload, a public share link or a meeting bot that joined on its own, staff report it to the designated attorney and do not hide it, delete records, change settings or call the vendor. The responsible attorney decides what follows.
7. Onboarding and offboarding:
How accounts are created, approved, trained and removed: least-privilege roles, multifactor sign-in, signed acknowledgments, matter access, and confirmation that a departing user keeps no access to firm or client information.
8. Review and recurring checks:
Who checks users, roles, settings, extensions, connected apps, meeting tools, vendor terms and retention on a schedule, writes down what changed, and decides when the policy needs a revision or staff need another instruction.
MORE THAN A POLICY PARAGRAPH
What the Firm Receives
Depending on the agreed scope, the engagement may include:
- Firm-specific AI use and SB 574 operations policy
- Approved, restricted and prohibited tool and account list
- Who-does-what chart for users and administrators
- Client-data and matter-authorization rules
- Verification and court-disclosure procedure
- Incident procedure and reporting form
- Onboarding and offboarding checklist with acknowledgment language
- Review schedule, then an editable Word draft and the approved final version
REVIEW. DECIDE. DRAFT. TEST. TRAIN. RE-CHECK.
How the Engagement Works
Step 1, Review the current environment:
I inventory the tools, accounts, browser extensions, meeting bots, connected apps, devices and any written rules the firm already has.
Step 2, Identify the firm's decisions:
The responsible attorney decides the legal, ethical, client-communication, protective-order, records and matter-use positions. I ask the questions; the attorney answers them.
Step 3, Build the operating rules:
I turn those decisions into procedures staff can follow: approved tools, client information, authorization, verification, sharing, retention, incidents and new-tool review.
Step 4, Review with the attorney and administrator:
The draft goes to the attorney who supervises and the person who runs the office. Ambiguous rules are fixed before they reach staff.
Step 5, Train the users:
Every SB 574 setup includes training and signed acknowledgments for the included users. More staff, demonstrations or new-hire sessions can be added, so the policy becomes a practice rather than another unread attachment.
Step 6, Review it regularly:
The optional AI Configuration & Governance Review, monthly or quarterly, checks for settings drift, new users, unapproved tools and extensions, meeting bots, new AI features, vendor changes and policy provisions that need updating, and leaves a dated findings record. It covers what the engagement gives me visibility into, not every device on the network.
HOW IT STARTS
Every engagement starts with the $350 SB 574 and AI Readiness Review, credited in full if the firm proceeds within 14 days, and a written scope and quote. Training beyond the included users is quoted the same way.
One Price Up Front. The Rest in Writing.
Service
Price
Scope
Firm AI Use and SB 574 Operations Policy
Included with
SB 574 setup
A firm-specific policy built from the responsible attorney's decisions, with one decision meeting, one draft, and one round of revisions.
Policy without setup, or policy work beyond the included policy
Written quote
A firm-specific policy for firms not doing an SB 574 setup, or policy work beyond the included policy, such as handbook rewrites, multiple offices or practice groups, employment-policy integration, extensive Microsoft or Google governance work, regulated environments, and additional meetings or revision rounds.
Justice Access pricing
Eligible court-appointed counsel, public defender and alternate defender offices, conflict-defense organizations, nonprofit legal-aid organizations, and qualifying public-interest practices receive a 25% Justice Access reduction on SB 574 setup, policy-only engagements, additional training, and AI Configuration & Governance Review fees.
Vendor subscriptions, State Bar filing fees, mileage, lodging, third-party charges, and incident response are not discounted.
WHY ME
Why a Case Cartographer Writes AI Policies
My main work is organizing discovery for defense attorneys: the client files, the recordings, the medical records, the same material staff are now pasting into chatbots. I teach California attorneys about AI as a State Bar single-activity MCLE provider (No. 21034), and I have set up firms for SB 574 already. The policy is the part of that work a court can ask to see. Both jobs are the same job: take what the firm already has, make it findable, and make it defensible.
"A computer can never be held accountable, therefore a computer must never make a management decision."
Often attributed to an IBM training presentation, 1979.
Four Questions
Is this included with AI workspace setup?
Yes. Every SB 574 setup includes a firm-specific AI Use and SB 574 Operations Policy, with one decision meeting, one draft, and one round of revisions. Handbook rewrites, multi-office or practice-group policies, employment-policy integration, and drafting beyond that are a separate engagement.
Will VdVLaw decide what the firm's legal policy should be?
No. The responsible attorney makes the firm's legal, ethical, professional-responsibility, client-consent, privilege, protective-order, employment, records-management, and SB 574 decisions. VdVLaw helps identify the operational questions, organize those decisions, and translate counsel's answers into a usable policy, staff workflow, and documented process.
Can the policy allow client information in AI?
Potentially, but the answer is matter-specific. The responsible attorney must determine whether the particular platform, account, purpose, information, users, access controls, retention settings, client obligations, protective orders, and other applicable requirements permit the use. Under SB 574, access to confidential, personal identifying, and other nonpublic information entered into a generative-AI system must be restricted to the attorney and persons authorized by the attorney who are under obligations to protect its confidentiality. The policy should therefore define the approval process, not declare that client information is categorically allowed across all approved tools or matters.
Can you update an existing policy?
Yes. VdVLaw can review an existing technology, confidentiality, acceptable-use, employment, information-security, or AI policy and prepare attorney-review revisions that reflect the firm's current platforms, account types, staff roles, matter-data rules, incident procedures, and SB 574 workflows. The goal is to update what the firm already has rather than replace it unnecessarily.
SB 574 Is Signed. January 1 Is Coming.
GET STARTED
If your firm is already using ChatGPT, Claude, Gemini, Copilot, meeting transcription or browser extensions, the habits exist. The policy turns them into one attorney-directed set of rules, and the responsible attorney keeps every legal decision.
Attorneys, firms, legal departments and public agencies statewide, remote and on-site.
VdVLaw is an attorney-directed legal support and technology-policy service operated by Robert van der Vijver. VdVLaw is not a law firm, Robert van der Vijver is not an attorney, and neither provides legal advice. Services are performed for attorneys, law firms, legal departments, public agencies, and organizations under the direction of the responsible attorney.
The responsible attorney retains all legal and professional-responsibility decisions, including how SB 574 and other applicable authority apply to the firm's practice, client communication, informed consent, privilege, protective orders, court disclosure, employment matters, regulated information, records management, and whether particular information may be processed through an AI platform. VdVLaw helps translate counsel's decisions into operational policy and workflow but does not certify legal compliance. Contacting VdVLaw does not create an attorney-client relationship.
Platform names and trademarks belong to their respective owners. VdVLaw is independent and is not affiliated with, sponsored by, or endorsed by any AI vendor. Vendor plans, pricing, terms, features, and controls may change. The live vendor terms and signed engagement documents control.