What a Law Firm Should Ask an AI Implementation Partner

What should a law firm look for when hiring an AI implementation partner? The question matters for firms comparing proposals, because in the Thomson Reuters Institute 2026 AI in Professional Services Report, 41% of law-firm respondents said their organization already uses generative AI (GAI), meaning AI that creates content, such as text, in response to a request. The survey covered 1,514 professionals across several professions in 27 countries in October and November 2025 and screened respondents for familiarity with AI, so the figure should not be read as an estimate for all law firms.

Our answer is that a law firm should choose the partner whose deliverables let its lawyers meet duties that stay with them. Legal experience, security, integration and return on investment all matter, but a law firm's professional rules also decide what the partner must hand over. Below, each duty becomes a question for the partner, and we then apply the questions to our own published law-firm case study.

Your professional duties stay with the firm when you hire a partner

Hiring outside help does not move responsibility for the work, because the rules require your firm to supervise whoever helps it. ABA Formal Opinion 512, issued on July 29, 2024, applies Rule 5.3, on supervising nonlawyers, to outside providers. It lists what earlier opinions expect when a firm outsources work, including reference checks, the vendor's security policies, confidentiality agreements and its conflicts check system, and then says, "These concepts also apply to GAI providers and tools."

ABA opinions interpret the Model Rules and are advisory and not legally binding, so your firm must follow the rules that apply where its lawyers practice and weigh the guidance of the bar in each of those places. The State Bar of California's Practical Guidance, updated in 2026 to address agentic AI, meaning systems that work through several steps without a person prompting each one, goes further and says that "the greater the level of system autonomy, the greater the lawyer's obligation to implement oversight mechanisms." For that reason, give the partner the applicable rules and your clients' outside counsel guidelines, which set each client's requirements for its outside lawyers, before you agree on the scope of work.

Five questions to ask, one for each duty

For each duty, ask the partner a question and request the documents your lawyers will need to assess the answer.

1. Competence (Rule 1.1): How will our lawyers learn what the system can and cannot do? Opinion 512 says lawyers need "a reasonable understanding of the capabilities and limitations" of the specific tool, and that the right amount of checking depends on the tool and the task. Ask for the system's limits in writing and for test results on your own documents; our note on what AI implementation consulting should deliver explains how that testing works.
2. Confidentiality (Rule 1.6): Where does client information go, and who can see each matter? The opinion asks lawyers to weigh disclosure outside the firm and to colleagues inside it, and it requires informed client consent before client information goes into a self-learning tool that learns from what users enter and could expose that information to other users. California adds that reasonable efforts "require more than reliance on generalized marketing assurances." Ask for a data-flow description, which shows how client information moves through the system and names each outside service, how long that service keeps the information and whether it uses it to train AI. Also ask how access will be limited to the people authorized on each matter.
3. Communication (Rule 1.4): Could we explain this system to a client in plain words? Opinion 512 says that adding "general, boiler-plate provisions to engagement letters" is not sufficient for informed consent, and it calls the engagement agreement "a logical place" for disclosures. Ask for a one-page description of what the system does with client information and where a lawyer decides.
4. Supervision (Rules 5.1 and 5.3): What records and controls will our managing lawyers use to supervise the system? The opinion says managerial lawyers "must establish clear policies regarding the law firm's permissible use of GAI" and train their people, and a footnote suggests marking AI-produced material in client and firm files. Ask for a list of the steps the system takes alone and the ones that stop for a named lawyer, a record of what it did on each matter, and training material your policy can point to.
5. Fees (Rule 1.5): Can our billing partner tell overhead from matter costs? Under the opinion, a tool that works like general office equipment is overhead, while a per-use tool bought for one client's matter can ordinarily be billed at actual cost. California's guidance says costs for a custom implementation developed for a particular matter may be billed separately if the fee agreement discloses this, the charge reasonably reflects actual cost and any markup has the client's informed written consent. Ask for running costs split into firm-wide and per-matter use.

Put these questions to every partner in writing, and have your ethics partner or general counsel review the answers before you sign.

The checklist applied to our own law-firm case study

A case study can show how a partner works, but it cannot answer the five questions for the system your firm is considering, and that is true of ours as well. Our published law-firm diagnostic describes ten stakeholder interviews and a review of the firm's software that traced how information passed between systems, which could inform a confidentiality answer. It also describes a business case and a phased plan weighing expected value against effort, which could inform a cost split but does not supply one.

The page then describes an email-triage assistant, built as a working demonstration of using AI to help review and organize incoming client messages, which the firm could assess against its lawyers' own handling of those emails. That gives a buyer a starting point for the competence and supervision questions, because it describes a tool the lawyers could examine, but the page does not report whether they evaluated it or what they found. It also does not say where email content was processed, which retention terms applied, how access was set by matter, what was logged, or whether the demonstration went into daily use. Those omissions leave the questions open, so a firm considering us should ask for those answers in writing, as it would from any other partner. We say this plainly for two reasons. We are not legal experts, so the professional judgment in any system we build stays with your lawyers. And the tools change faster than a case study can record, which is where we add the most: knowing what current AI systems can and cannot do, and adapting the build and its safeguards as the tools and your firm's needs change.

Questions buyers ask

Does an AI implementation partner need a SOC 2 report or ISO 27001 certification?

It depends on what the partner will touch and what your clients require, because Opinion 512 does not prescribe either one. A SOC 2 report examines a service provider's controls for handling data, while ISO/IEC 27001 certification concerns how an organization manages information security. Both can inform your review, but ask which systems and services they cover before you rely on them for your firm's implementation. Ask for the data-flow description whether or not the partner has either, and if it will host or store client data itself, also ask for its audit report or other evidence of how it protects that data. The Foregrounds holds no compliance certifications, and our FAQ describes the practices we provide instead.

Do we need client consent before using AI on a matter?

Sometimes, and the answer turns on the tool and the facts. Opinion 512 requires informed consent before client information goes into a self-learning tool that could disclose it to others and says boilerplate in an engagement letter does not count; it also says you must disclose your use of AI if a client asks or if the client's outside counsel guidelines require it. In other situations the opinion leaves the answer to the facts, and your state's rules may say more. Start by listing which matters and tools will involve client information, then check each affected client's guidelines before the system goes live.

Does an agentic system change what we should ask?

Yes, because a system that acts on its own needs closer oversight than one that only drafts for a lawyer. California's 2026 guidance notes that agentic systems may have "persistent or automated access to large volumes of confidential client information" through email, document management and client files, and that lawyers must limit the scope of that access. It also says a lawyer must not deploy one in a way that permits "autonomous external transmission of client information" without appropriate safeguards and human review. We recommend asking the partner to list every action the system can take outside the firm, such as sending an email or transferring a file, and requiring a named lawyer's approval for each one. We show how to write that kind of action list for a shared inbox in which inbox actions to hand an AI agent first.

Can our lawyers keep using public AI chatbots while the partner builds?

It depends on what goes into them. In the Thomson Reuters survey, 55% of law-firm respondents said they personally use publicly available tools such as ChatGPT, against 35% who use paid industry-specific tools, so ask which tools your lawyers already use. Opinion 512 notes that using a self-learning tool for idea generation, without entering information about a client's matter, does not require client consent, while entering that information into a tool that could disclose it to others does. Put a short interim policy in writing that keeps client information out of public tools unless your firm has approved the specific tool and use, including any required client consent.

Your firm keeps its duties to clients no matter who builds the system, so choose the partner whose written answers let your lawyers meet them. Our agentic systems work includes a written safety contract that sets the system's limits, approval steps with named approvers and a log of work the system could not handle for the owner to review, which is how we answer the supervision question.