What the Setup Involves, and Why It Takes the Hours It Takes
The short version: about a third of the work is settings, and two thirds is the policy, the procedures, the training and the record. The settings are what make the policy true. The record is what you can show. Every setup is quoted in writing after the $350 review; the hours below are my planning estimates, not measurements.
Read down as far as you need: where the hours go, the calendar, each platform, the devices, and the requirements.
WHERE THE HOURS GO | SOLO ABOUT 14 HOURS | UP TO THREE USERS ABOUT 22 | FIRM BASE ABOUT 30
Planning figures for a ChatGPT Business or Claude Team engagement, shown as solo, up to three users, and the five-user firm base. Google Workspace adds about 1.5 hours to the workspace block. Microsoft 365 adds about 1.5 hours to the workspace block, doubles the per-computer time, and adds a 48-hour wait before verification.
Workspace configuration, 3.5, 4.25 and 4.5 hours: plan and seats, domain and sign-on, memory, apps and connectors, sharing, recording and agent features, screenshots, the configuration record.
Each user, about 35 minutes: joining, separating the personal account, personal settings, connectors, phone sign-in. 0.6, 1.8 and 3 hours.
Each computer, about 45 minutes: the right workspace in the app and the browser, extensions, a second profile with a personal account, consumer AI apps, screenshots. 1.5, 2.25 and 3.75 hours.
Each phone or tablet, about 30 minutes: 1, 1.5 and 2.5 hours.
Policy, client intake materials, procedures, training, records, handoff and follow-up: 5, 7 and 8.5 hours. This is the part you have to be able to show.
Sessions and visits: remote sessions at 15 minutes each, on-site visits at two hours. 1, 3 and 5 hours.
Troubleshooting: a seat purchase that stalls, DNS for domain verification, a personal account that will not separate cleanly. 1.5, 2.5 and 3 hours.
Total: about 14, 22 and 30 hours. Planning estimates, not measurements from completed installations. A tangled personal account, a shared computer, or a device that is not available on the day moves an engagement toward the high end.
THE CALENDAR.
My Hours and Your Weeks Are Different Numbers.
Settings take time to reach the apps, and staff have to be in the room.
Day 1: plan and seats confirmed, workspace configured, screenshots taken. Days 1 to 3: users join, personal accounts separated, devices checked; Microsoft and Google settings need a day or two to land, so verification waits. Days 5 to 10: policy, intake materials and procedures delivered for counsel's review; training and acknowledgments. Days 10 to 14: records completed; handoff. Days 20 to 30: the included follow-up.
ChatGPT Business and Claude Team: settings apply at once; the wait is seats, DNS and staff availability. About one week for a solo, two weeks for three users, two to three for a firm. Google Workspace: most settings in minutes to 24 hours, Gemini history up to 72 hours, verification three days after the change. One to two weeks for a solo, two to three for three users, three to four for a firm. Microsoft 365: settings take 24 to 48 hours to reach the apps, and every device is verified on a return visit. One to two weeks for a solo, two to three for three users, three to five for a firm.
The waits that set the calendar are the client's: the card for the seats, DNS access for domain verification, the identity provider for single sign-on, and staff availability for training.
Attorney-directed support from a confidential independent contractor under a signed services agreement and confidentiality undertaking. VdVLaw is not a law firm and provides no legal advice. Setup and testing use harmless sample data.
REQUIREMENT BY REQUIREMENT.
What Goes Wrong Without a Setup, and What You Can Show After.
Restricted access to confidential information (Bus. & Prof. Code section 6068.1(a)(3)(A)). Without a setup: client material in personal accounts, in consumer apps, in a chat history nobody can find, in a meeting transcript nobody knew existed. After: one approved workspace, its settings recorded with dated screenshots, an authorized-user list, personal accounts separated, and a policy that says where client work happens.
Outputs and citations verified by a person (section 6068.1(a)(3)(B); Code Civ. Proc. section 128.7(b)(2)(A)). Without: a citation that does not exist in a filing with your name on it, and a sanctions hearing about how it got there. After: a written verification procedure, a record form for each filing, and staff trained to use it.
Court disclosure (section 6068.1(a)(3)(C)). Without: the honest answer to the judge is a guess. After: a disclosure procedure and an AI-use record per matter, prepared for counsel's review.
No delegation of judgment (section 6068.1(a)(2)). Without: drafts going out as written because nobody set the step where a person decides. After: the staff procedure with the attorney's review step built in, and the training that explains why.
Firm and supervisory responsibility (Code Civ. Proc. section 128.7(c)(1); Rules of Professional Conduct 5.1 and 5.3). Without: every attorney relying on every other attorney's habits, undocumented. After: a firm policy adopted by the responsible attorney, signed acknowledgments from every user, and a training record.
One matter, several AI workflows. Without: the same case in five tools with five retention rules. After: one workspace, one Project or folder per matter, a closeout procedure when the matter ends, and the second platform configured to the same standard or recorded as off limits.
Plain-language orientation, not legal advice. The responsible attorney reads the statute and decides what it requires.
WHAT I WILL NOT PROMISE
Four Things No Small-Office Plan Can Do.
That a setting stays set.
Users can reverse most settings. The policy, the training and the governance review are the answer, not a promise that nobody will ever click the switch.
That a personal account cannot be used.
No ChatGPT Business, Claude Team or Google Business plan can stop a personal account from running next to the firm account on the same laptop. Only Enterprise tiers and managed devices close that.
That the phone's own AI is governed.
Apple Intelligence, Gemini on Android and the share sheet stay with the user unless the firm owns and manages the phone. The work apps on the phone are configured; the phone itself is not.
That the firm is compliant.
The records document what was reviewed, configured, put in place, and who was trained, and when. The compliance determination is counsel's.
PLATFORM BY PLATFORM.
WHAT IS ON, WHAT I SET, WHAT YOUR PLAN CANNOT DO.
Every business plan protects your content from training. None gives a small office control of the device itself.
The gaps below are closed by the policy, the training and the record, or by a managed-device project the firm buys separately. Vendor pages checked October 14, 2026.
BUSINESS / ENTERPRISE
On by default: memory, apps and connectors, shared links, meeting recording on the Mac app, and the personal account in the next tab. I set: seats on a live call, memory, each app and connector and what it may do, recording, agent features, domain verification and single sign-on where the firm has an identity provider; everything screenshotted before and after. Your plan cannot: turn off shared links (Enterprise), restrict devices or IP addresses, force two-factor sign-in, or block a personal account on the same device.
ChatGPT (OpenAI)
TEAM / ENTERPRISE
On by default: Claude in Chrome, Cowork including cloud sessions, public sharing of artifacts, and memory once a member turns it on. I set: memory, one Project per matter, connectors one at a time with each tool set to allow, ask or block, external sharing off, Claude in Chrome and Cowork decided with the attorney, the domain verified so no new personal accounts can be created on it, and a written per-matter closeout procedure. Your plan cannot: delete a member's chats for them, show an audit trail, set a retention period, claim an existing personal account, or restrict devices. Deleted content is purged by Anthropic within 30 days.
Claude (Anthropic)
GOOGLE WORKSPACE
On by default: the Gemini app, 18 months of history, Gemini connected to Gmail, Drive and Calendar, NotebookLM, Gemini in Chrome for signed-in users, Meet note-taking where the edition has it. I set: the edition confirmed, organizational units, the Gemini app per unit, history retention, connected apps, NotebookLM and its sharing, Drive and link defaults, 2-Step Verification, Meet notes, Chrome generative AI policies where the firm manages Chrome, and the Vault question answered in writing. Your plan cannot (Business editions): switch Gemini off per app, keep one app's data away from Gemini in another, stop a user reversing the smart-features default, or block a personal Gmail on an unmanaged laptop or phone. Vault needs Business Plus.
Google Gemini
MICROSOFT 365
On by default: Copilot Chat in Word, Excel, PowerPoint, Outlook, Teams and the browser; Anthropic as a subprocessor; Teams meetings with Copilot and a saved transcript; Edge page context; the Windows Copilot app; Copilot memory. I set: the license label on each account, Copilot Chat removed from work accounts, Anthropic off, the privacy control that stops the apps sending content to connected experiences, Teams meeting and calling policies, sharing defaults, the Copilot app, Recall, Click to Do, Notepad, Paint and Edge on each computer, the work apps and the Copilot app on each phone, then a 48-hour wait and a return visit to verify every device, included in every Microsoft quote. Your plan cannot (Business Basic or Standard): enforce any device setting, block a personal Microsoft account, or govern the phone's own AI; enforcement needs Business Premium and an Intune project, quoted separately.
Microsoft Copilot
PROHIBITED
VdVLaw does not configure DeepSeek's hosted services for client work. Its current privacy terms state that personal data is processed and stored in the People's Republic of China. I provide the written policy, staff briefing, and cleanup if it's already been used.
DeepSeek
WHAT YOUR SETUP INCLUDES
A Configured System, Not a Settings Tour
● Commercial AI workspace: one approved commercial workspace configured and verified, covering administrator review, privacy, memory and history, retention where configurable, sharing and public links, connectors and integrations, account security and MFA, and authorized-user access, with personal accounts kept separate from firm work and prior personal-account use identified.
● SB 574 workflows: an implementation checklist, a confidential and nonpublic-information workflow, AI-use tracking while documents are drafted, the court-disclosure workflow, a responsible-attorney sign-off, and a staff escalation procedure.
● Citation verification: a procedure for the responsible attorney to personally verify every citation in a filing, AI-assisted or not, as amended Code of Civil Procedure section 128.7 requires, with a record showing the verification happened.
● Written firm policy: a firm-specific AI Use and SB 574 Operations Policy, built from the responsible attorney's decisions and delivered for attorney review and approval. Included: one decision meeting, one draft, and one round of revisions.
● Client materials: the Client AI Use Intake Form and Acknowledgment, adapted with the firm's name, including the question about AI use by anyone the client told about the case, attorney AI-use authorization language, and a preservation instruction when prior AI use turns up.
● Staff implementation: training for the included users, staff safety rules, signed acknowledgments, the approved-tool list, guidance on prohibited tools and accounts, and an incident and escalation process.
● Documentation: an authorized-user record, a Configuration Record, dated setup documentation, a Setup Completion Record, a handoff to the responsible attorney or administrator, and one follow-up after implementation.
● What the record shows: what was reviewed, what was configured, which procedures were put in place, who was trained, and when. It documents the work. It does not certify compliance.
DISCOVERY AND CLIENT DATA
Matter Data Gets a Workflow, Not a Free Pass
A commercial workspace makes it possible to work with matter data responsibly. It doesn't decide that you should. Whether a specific document, transcript, or discovery file may go into an AI platform is the responsible attorney's call, made matter by matter.
SB 574 makes the access question explicit. Confidential, personal identifying, and other nonpublic information may not be entered into a generative-AI system unless access to that information is restricted to the attorney and persons authorized by the attorney who are under obligations to protect confidentiality. Whether those conditions and any other applicable duties are satisfied in a particular matter remains counsel's determination.
Once that call is made, the workflow I configure handles the mechanics: which users are authorized, what gets logged, and when material is swept out of the workspace at the end of a matter.
Because I work with more than one firm, your matter data is kept separate and apart from every other client I serve: no cross-contamination, no shared records. What comes back to you is your own organized record, and nothing else.
DEVICES
What Can and Cannot Be Secured
The firm workspace, on every device. The device itself, only where the firm manages it.
Office computers. The firm workspace is signed in and set in the app and the browser, extensions and consumer AI apps are reviewed, and on Microsoft the Windows and Edge settings are set. Everything is screenshotted. What stays open on a small-office plan: a personal account in another browser profile, a local administrator reversing a setting, or a reset.
Phones and tablets. The work apps are signed into the firm account, consumer AI apps are signed out or removed, and the settings are recorded. What stays open: the phone's own AI (Apple Intelligence, Gemini on Android), the share sheet, and a personal account in the same app.
Home computers, devices not on the list, and meetings. A device that is not on the list is not configured, and that is recorded as excluded. Teams and Meet recording, transcription and note-taking are decided with the attorney and set. A meeting hosted by another organization follows the host's settings.
What closes each gap:
◆ Office computers: policy and training, or managed devices (Intune, Google endpoint management) as a separate project.
◆ Phones and tablets: a firm-owned, managed phone; otherwise policy.
◆ Home computers and devices not on the list: a policy rule that no firm work happens on them, or Enterprise-tier access controls.
◆ Meetings: a firm rule for outside meetings, and counsel's view on recording consent.
◆ A personal account next to the firm account: no ChatGPT Business, Claude Team or Google Business plan can block it. Enterprise tiers and managed devices can.
◆ Every exclusion is written into the records document, so the responsible attorney knows what was covered and what was not.
Every quote lists the computers, phones and tablets it covers. A device that is not on the list is not configured, and that is recorded. Microsoft devices take about twice as long as the others, and the quote says so. A managed-device project (Intune or Google endpoint management) is quoted separately, and it is only worth buying once the firm has a workspace, a policy and a record to manage.
The work account's AI settings can be configured and verified on every included device. What the vendor's plan cannot control is covered by the firm's policy and training, and by device management only where the firm already has it.
What was excluded is recorded too.
HOW IT WORKS
Four Steps, Start to Finish.
Step 1: Review and scope. Day 1. The $350 SB 574 and AI Readiness Review when the firm's AI use is not yet clear, or a written scope when it is. You approve the scope and the commercial subscription before I touch a setting; I walk you through the live checkout so the monthly cost is clear.
Step 2: Configuration. Days 1 to 3. Privacy, retention, sharing, connector, recording and account controls configured, restricted, tested and documented on the included devices, with harmless sample data only. Some settings take a day or two to reach the apps; on Microsoft 365 I wait 48 hours and come back to verify every device.
Step 3: Verification, policy and training. Days 5 to 10. I verify the configuration with dated evidence, deliver the firm policy and client intake package for the responsible attorney's review, walk the attorney through the handout, and train the staff, with signed acknowledgments.
Step 4: Handoff. Days 10 to 14, then one follow-up within 30 days. Temporary access is revoked, authorized users and settings are documented, and once the balance is paid the Setup Completion Record and Configuration Record are delivered. A solo takes about a week of calendar time; a firm two to three weeks.
"Not used for model training" is not the same thing as privileged, confidential, protected by a court order, or safe to upload.
Every setup client receives the full toolkit: a classification of the tools in the firm's environment (approved, usable only with strict data isolation, or not safe under any settings), configuration checklists, staff handouts, and a review checklist the firm can use to spot settings drift. Clients on the optional review have it re-checked against current vendor terms.
The supervising attorney decides what the firm adopts.
Frequently Asked Questions
Do I have to buy a new AI subscription?
Not because SB 574 requires a particular subscription. It doesn't. VdVLaw's standard for client-related work, however, is a commercial or business workspace that provides appropriate contractual data protections, administrator controls, restricted access, and configurable privacy and retention settings. If your existing plan already meets the technical standard, I verify and document it. If it does not, I recommend the appropriate commercial option and you purchase it directly from the vendor.
Can my firm use real client names and discovery in AI?
Potentially, but a commercial workspace is only one prerequisite. SB 574 requires restricted access to confidential, personal identifying, and other nonpublic information entered into a generative-AI system. The responsible attorney must still approve the specific matter, platform, purpose, authorized users, data categories, and retention or deletion plan, and determine whether client communication or informed consent, protective-order review, court permission, a BAA, contractual approval, or another safeguard is required. VdVLaw configures and documents the technical workflow but does not make those legal determinations.
Why does Microsoft 365 take longer?
Because the AI is not in one place. It is in Windows itself, in Word, Excel and PowerPoint, in Outlook, in Teams meetings and in the Edge browser, and each of those has its own switch on each computer. Microsoft's settings also take up to 48 hours to reach the apps, so I come back to verify every device. That return visit is in every Microsoft quote. DeepSeek, for the record, is not configured for client work at all; its own terms describe storing personal data in China.
Do you see my client files?
Setup and testing use harmless sample data. I access matter data only when the responsible attorney separately authorizes it in writing and only within the scope of that authorization, under the signed services agreement and confidentiality undertaking. Matter data is not required for ordinary setup and testing.
Why does a solo setup take about 14 hours?
About five of those hours are the workspace and the devices. The rest are the policy, the client intake materials, the procedures, the training, the records and the follow-up, which are the parts you have to be able to show. A Google Workspace setup takes about 15 hours and a Microsoft 365 setup about 19, because the AI sits in more places. The hours are my working hours; the calendar is about a week for a solo and two to three weeks for a firm.
Is this legal advice?
No. VdVLaw is not a law firm, and Robert van der Vijver is not an attorney. I configure the technology, document the controls, develop operational workflows, and provide training under attorney direction. The responsible attorney retains every legal, ethics, privilege, disclosure, client-consent, and professional-responsibility decision, including how SB 574 applies to a particular matter.
What actually happens during a monthly governance review?
Two things, every time. First, a technical review of browser extensions, app permissions, OS-level AI features, approved tools, and account or access changes on the firm devices and systems included in the engagement. Second, a direct staff check-in, because a perfectly configured system can still be undone by one person adding a tool nobody reviewed. After each review, you receive a dated findings log and an updated approved-tools and authorized-user record.
GET STARTED
SB 574 Is Signed. January 1 Is Coming.
California has now put specific generative-AI duties into statute for attorneys. If your firm is already using ChatGPT, Claude, Gemini, Copilot, AI meeting tools, browser extensions, or built-in AI features, now is the time to know exactly what is running, who can access it, what information it touches, and how the firm verifies and documents the work.
The goal is not to stop useful technology. It is to make sure the technology your firm is already using operates inside a system counsel can actually supervise.
Serving attorneys, firms, legal departments, public agencies, and legal organizations statewide, with remote and on-site setup available.
VdVLaw is an attorney-directed legal support and technology-configuration service operated by Robert van der Vijver. VdVLaw is not a law firm, Robert van der Vijver is not an attorney, and neither provides legal advice. Services are performed for attorneys, law firms, legal departments, public agencies, and organizations under the direction of the responsible attorney.
The responsible attorney retains all legal and professional-responsibility decisions, including how SB 574 and other applicable authority apply to the firm's practice, client communication, informed consent, privilege, protective orders, regulated information, court disclosure, and whether particular information may be processed through an AI platform. VdVLaw does not certify legal compliance. Contacting VdVLaw does not create an attorney-client relationship.
Platform names and trademarks belong to their respective owners. VdVLaw is independent and is not affiliated with, sponsored by, or endorsed by any AI vendor. Vendor plans, pricing, terms, features, and controls may change.
The live vendor terms and signed engagement documents control.