IT, security and AI governance for firms where a disclosure isn’t an inconvenience — it’s a bar complaint. ABA Opinion 512 made competence with these tools an ethical question, not a technical one.
None of these are hypothetical. All of them are survivable if somebody owns them before they happen.
An associate pastes a contract in to summarise it faster. The duty under Rule 4-1.6 does not pause because the tool was convenient, and ABA Opinion 512 is explicit that competence includes understanding where the data goes.
An email that looked exactly right, new account details, a closing on a deadline. Real estate and trust work are targeted precisely because the money moves fast and the pressure is real.
Billable hours stop and deadlines don’t. The question is never whether something will break, it’s how long it stays broken and who is already on it.
Institutional clients now ask what you do about security and AI before they send work. The firms that answer quickly and confidently win work from the ones that scramble.
Not a product list. The specific things that make a firm defensible.
What your people may put into which tools, what must never go in, and who decides — in language the whole firm can follow.
A second check before anyone reaches mail or documents. The single change that stops the most damage.
A documented verification step before any bank detail changes, so the pressure of a closing never substitutes for the process.
Matters, documents and mail that can actually be brought back, proven on a schedule rather than assumed.
Your security answers written down and kept current, so client due diligence is a file you send.
A service desk your people can reach the same day, that knows your practice management system by name.
No. It means competence now includes understanding what the tool does with the information you give it, and getting informed consent where confidentiality is engaged. The practical answer is a written policy that distinguishes between tools with the right agreements behind them and a free consumer account, not a blanket ban your associates will quietly ignore.
We build and document the controls your obligations require and prepare the evidence a client or carrier will ask for. We are not your ethics counsel and we do not issue certifications — your professional obligations are yours. What we do is make them answerable with paperwork instead of hope.
Almost certainly. The specific product matters less than whether somebody is accountable for it staying up, backed up and restorable. We’ll ask what you run before we say anything about changing it.
The duty of confidentiality is not scaled to headcount, and neither is a client’s security questionnaire. Smaller firms usually need less than they fear and something more than they have.
A predictable monthly agreement based on how many people you have and what shape things are in. You see the figure before you commit, and the first conversation costs nothing.
Tell us what’s going on and an advisor calls you back within one business day. We ask about your business before we say anything about ours. No pitch deck, no pressure.
Regulatory guidance on this page last reviewed October 2026.