Artificial intelligence contract analysis does not create a separate ethics universe. That is the useful part of ABA Formal Opinion 512: it applies existing duties to generative AI rather than inventing a new professional-responsibility code for software.[1] For contract work, that means the familiar obligations—competence, confidentiality, fees, candor, supervision, and communication—have to be located inside the actual review process, not stored in a policy PDF that nobody opens after procurement signs the order form.
The harder part is that the process is already moving faster than governance. More than 35 state bar opinions had been issued by early 2026, and they do not line up neatly on confidentiality, disclosure, or fee treatment.[2] At the same time, reported industry data shows a supervision gap: 44% of law firms lacked formal AI governance policies, only 40% of legal organizations provided AI training in 2025, and New York had moved to require at least two annual CLE credits in AI competency by Q3 2025.[3] Another 2026 legal-industry report put the mismatch more bluntly: 79% of legal professionals used AI tools, while only 9% worked at firms with an enforced AI policy.[4]
Vendor-sponsored adoption figures should not be treated as a census of the profession. They may overrepresent organizations already interested in legal technology. But even with that caveat, the direction of the risk is familiar: the matter team starts using a tool before anyone can show who approved it, what data was uploaded, what output was checked, what the client was told, and how the time was billed.
The Workflow Is Where the Ethics Questions Appear
A lawyer does not meet professional responsibility duties merely by choosing a reputable AI vendor or by adding “attorney review required” to a policy. In contract analysis, the obligations attach at separate points. Competence begins before the tool is selected. Confidentiality is implicated before a document is uploaded or a prompt is written. Supervision applies while associates, contract lawyers, vendors, and nonlawyer staff use the system. Communication may be required before or during the matter, depending on the jurisdiction and client expectations. Fees are tested when the time entry is written. Candor becomes relevant if the AI-assisted work is used in a representation context where a tribunal, counterparty, or client receives or relies on the output.
| Workflow stage | Primary ethics duties | What the record should be able to show |
|---|---|---|
| Intake and tool selection | Competence; supervision | The tool was approved for this type of contract work, and the lawyer understood its limits well enough to use it responsibly. |
| Playbook setup | Competence; communication; supervision | The review standard came from the client, matter team, or governing playbook—not from an unexplained model default. |
| Data handling and prompt construction | Confidentiality; supervision | The team knew what data entered the system, whether it could be retained or used for training, and who was permitted to submit it. |
| AI review | Competence; supervision | The output was treated as draft analysis, triage, or extraction—not as an unreviewed legal conclusion. |
| Lawyer verification | Competence; candor; supervision | A qualified lawyer checked material provisions, assumptions, citations, defined terms, and risk calls before relying on the output. |
| Client communication | Communication; confidentiality; fees | The client received required or prudent information about AI use, scope, cost, or material limitations. |
| Billing | Fees | The entry separated compensable matter work from nonbillable learning, experimentation, or internal tool training. |
| Supervision records | Supervision; competence | The firm could reconstruct approval, training, access controls, review steps, and exceptions after the fact. |
That map is not a safe harbor. It is a working structure for asking the right questions before a problem has to be reconstructed from emails, time entries, and a vendor activity log.
Intake Starts With Tool Fitness, Not Tool Availability
Rule 1.1 competence is active before anyone uploads the first agreement. A lawyer using AI for contract review has to understand the tool well enough to make a reasonable judgment about whether it is fit for the task. That does not require the lawyer to become a machine-learning engineer. It does require more than knowing that the tool “uses AI.”
For artificial intelligence contract analysis, tool fitness depends on the work being assigned. Extracting renewal dates from a set of vendor agreements is not the same task as deciding whether an indemnity provision departs from a client’s negotiated risk position. Comparing assignment clauses against a playbook is not the same as drafting a litigation position based on a contract history. A competent workflow identifies the task first, then selects the tool.
The distinction between purpose-built legal AI and general-purpose AI matters here. LegalOn’s 2026 contract-review benchmark reported 90% to 95% accuracy for purpose-built contract-review AI on benchmarked contract tasks.[5] That kind of result is relevant to competence, but it does not eliminate verification. It helps define what verification should focus on: the clauses, document types, languages, jurisdictions, and playbook judgments where the system was tested, and the areas where the benchmark says little or nothing.
A general-purpose model used for the same review raises a different supervision problem. It may be useful for summarizing language, converting a clause into a checklist, or helping a lawyer think through issue spotting. But if the tool has not been designed, tested, or contracted for the specific legal task, the lawyer’s verification burden increases. “Human in the loop” cannot mean a lawyer glances at a fluent paragraph and moves on. It means someone competent checks the output against the contract, the playbook, and the matter context.
A practical intake record can be short. It should identify the tool, the task category, the person approving use, any prohibited document types, whether client consent or notice is required, and the expected review level. Small firms do not need an enterprise governance portal to make that record. They do need something better than an oral understanding that “the associate used the AI tool.”
Playbook Setup Is a Legal Judgment Stage
Many contract-analysis tools look most impressive after a playbook has already been built. The system flags nonstandard governing-law clauses, identifies missing limitation-of-liability language, or ranks a change-of-control provision as high risk. The ethics question is what standard the model is applying.
If the playbook reflects a client-approved position, a negotiated fallback, or a firm-approved review protocol, the AI output has an anchor. If the playbook is a vendor template, a recycled checklist, or a prompt assembled by someone who does not know the matter, the lawyer still owns the legal judgment. Rule 1.1 is implicated because the system’s output will only be as useful as the instruction set. Rules 5.1 and 5.3 are implicated because a partner or managing lawyer must have a reasonable way to supervise the people and nonlawyer systems producing the first-pass review.
The playbook record should answer three questions: whose risk position is being applied, who approved it for this matter, and what issues require lawyer escalation. The third question is often the most important. A tool can flag a missing audit right. It cannot decide, without legal and business context, whether that absence matters in a low-value pilot agreement, a regulated-services contract, or a long-term outsourcing deal.
Confidentiality Has to Be Resolved Before Upload
Rule 1.6 is not satisfied by good intentions after the document has already entered a system. The confidentiality decision belongs before upload, before copy-and-paste, and before a prompt includes the client’s facts. ABA Formal Opinion 512 treats confidentiality as a central duty when lawyers use generative AI, including the need to understand whether information may be disclosed to, retained by, or used by the technology provider.[1]
State guidance makes this less tidy. The state-bar synthesis reports more than 35 opinions as of early 2026, with variation on what lawyers must do before entering client information into AI systems and when informed consent may be required.[2] That variation matters in a contract workflow because the same operational act—uploading a draft merger agreement, pasting a vendor indemnity clause into a public model, or submitting a customer data-processing addendum to a review platform—may be treated differently depending on the jurisdiction, client terms, and tool configuration.
A defensible confidentiality screen is practical, not theatrical. Before documents go into an AI contract-analysis system, the matter team should know:
- Whether the tool is approved for confidential client information or only for public or anonymized text.
- Whether the vendor can retain prompts, documents, outputs, metadata, or user activity logs.
- Whether submitted material may be used to train, fine-tune, or improve models outside the client matter.
- Whether access is limited to the matter team and necessary vendor personnel.
- Whether the client’s engagement terms, outside counsel guidelines, protective orders, or deal restrictions limit AI use.
- Whether the jurisdiction requires consent, notice, or additional safeguards for the contemplated use.
This is where free or public general-purpose tools become especially difficult to defend for client contract review. The problem is not that a free tool is automatically unethical. The problem is that the lawyer may not be able to show the confidentiality terms, retention limits, access controls, or training restrictions needed to justify submitting client material. For more on that narrower issue, see The Ethics of Free AI for Lawyers.
Prompt Construction Can Leak Facts or Change the Assignment
Prompting sounds clerical until it changes the legal assignment. A prompt that asks, “Is this enforceable?” invites a broader legal conclusion than a prompt that asks, “Identify whether the clause contains a unilateral termination right and quote the relevant language.” A prompt that includes party names, pricing, transaction strategy, or negotiation history may raise confidentiality issues even if the underlying agreement is not uploaded in full.
The safest prompt is not always the shortest prompt. In contract analysis, the useful prompt often includes the governing playbook standard, the role of the reviewer, the expected output format, and the escalation rule. What should be avoided is unnecessary client-identifying or strategy-sensitive information when the same result can be obtained with clause text, defined parameters, or anonymized facts.
For recurring matters, prompt templates should be treated like supervised work product. Someone should approve them, version them, and retire them when the client’s position changes. If nonlawyer staff or junior lawyers are using the templates, Rules 5.1 and 5.3 require reasonable supervision of the way those templates are used, not merely approval of the vendor contract.
AI Review Is Triage Until a Lawyer Verifies It
The output stage is where contract-analysis tools can save real time and create real disciplinary exposure. A system may identify clauses, summarize obligations, compare language against a playbook, or mark provisions for escalation. None of that should be treated as final legal analysis until the verification step has occurred.
Verification is not a single action. It depends on what the AI did. If the tool extracted effective dates, the lawyer or supervised reviewer checks the date against the source language and defined terms. If it ranked a clause as high risk, the lawyer checks the playbook, the clause, the surrounding provisions, and any business assumptions behind the risk call. If it summarized a long agreement for a client, the lawyer checks that material exceptions, carveouts, and cross-references did not disappear in the summary.
The verification burden also changes with the tool. A benchmarked, purpose-built contract-review system may justify a more targeted review for tasks within its validated use case, while still requiring lawyer judgment on material issues.[5] A general-purpose model used outside a controlled legal workflow calls for more skeptical review because the lawyer has less reason to rely on its task-specific performance. The ethics analysis should follow the actual tool and task, not the label “AI.”
A workable verification protocol can be short, but it should be specific. For example, a contract team might require full lawyer review of all AI-flagged high-risk provisions, sample review of low-risk extractions, mandatory checking of all defined-term dependencies, and escalation when the tool reports uncertainty or produces inconsistent outputs. That example is hypothetical; the point is not the exact sampling method. The point is that the file should show how the team decided what to trust, what to check, and what to escalate.
What the Reviewer Should Look For
- Source mismatch: the output cites or summarizes language that is not in the contract.
- Defined-term error: the output treats a capitalized term as ordinary language or misses a definition in another section.
- Cross-reference failure: the output evaluates one clause without reading an exception, schedule, exhibit, or incorporated document.
- Playbook drift: the output applies a general market view instead of the client’s approved position.
- Material omission: the output summarizes the favorable rule but omits a carveout, cap, condition, or timing requirement.
- False confidence: the output states a legal conclusion where the tool should only have identified an issue for review.
For a deeper discussion of accuracy benchmarks, see How Accurate Is AI Contract Review? 2026 Benchmark Results. For the tool-category distinction, see Purpose-Built Legal AI Outperforms ChatGPT for Contract Review.
Supervision Is More Than Saying a Lawyer Reviewed It
Rules 5.1 and 5.3 are the obligations most likely to be underbuilt in an AI contract-analysis workflow. The partner responsible for the matter, the senior lawyer supervising review, and the legal operations manager administering the tool may all assume someone else has handled the control environment. That assumption is hard to defend when only 9% of legal professionals in one 2026 report said they worked at firms with an enforced AI policy.[4]
Supervision has two layers. The first is people: who may use the tool, who trains them, who checks their work, and who decides when an issue escalates. The second is system administration: which tools are approved, what matter types they may be used for, what data may enter them, and how logs or review records are retained. A firm with no formal AI governance may still be able to supervise a narrow use case, but it needs a written procedure tied to that use case.
The most useful supervision record is not a long policy. It is an audit trail that answers operational questions after the matter has gone quiet:
- Who approved AI use for this contract-analysis task?
- Which version of the playbook or prompt template was used?
- Which documents or clauses were submitted?
- What output did the system produce?
- Who reviewed the output and what did they change?
- Which issues were escalated to a lawyer with appropriate experience?
- What was communicated to the client, and when?
- How was the work billed?
That record protects clients first. It also protects the supervising lawyer from the worst possible version of an AI incident: trying to reconstruct a workflow from memory after a missed clause, disclosure dispute, or billing objection.
Client Communication Belongs Before Surprise
Rule 1.4 communication does not require the same disclosure in every AI-assisted contract review. ABA Formal Opinion 512 does not turn every internal use of generative AI into a mandatory client notice event.[1] But communication may be required when AI use is material to the representation, affects the basis or reasonableness of fees, implicates confidentiality consent, changes staffing or delivery assumptions, or is required by the client’s own guidelines.
This is another point where state guidance matters. The 35-plus state opinions summarized in the ethics guide vary in how they approach disclosure, consent, and confidentiality safeguards.[2] A national firm cannot treat the most permissive jurisdiction as its default. An in-house team cannot assume outside counsel’s AI use is covered by ordinary technology language if the company has stricter confidentiality, data-residency, or vendor-approval requirements.
In a contract-analysis workflow, the communication decision should be made at intake and revisited if the use changes. A limited internal extraction tool may raise different issues than an AI-assisted first-pass review of a large contract set, and both differ from using a public model to summarize a sensitive negotiation draft. The client communication record should identify what was disclosed, what the client authorized if authorization was needed, and any limits placed on the workflow.
Billing Entries Need to Separate Learning From Matter Work
Fee issues are where an elegant AI story can become a bad time entry. ABA Formal Opinion 512 states that lawyers may not bill clients for time spent learning to use a general AI tool. It also recognizes that time spent on the matter—such as prompting, reviewing, and verifying AI-generated work—may be compensable if the fee is otherwise reasonable.[1]
The distinction matters. “Research AI tool and test prompts” is not the same entry as “review AI-generated clause extraction against source agreements and revise risk flags.” The first may be internal overhead or professional development. The second may be matter work, depending on the engagement terms, jurisdiction, and reasonableness of the time charged.
State variation makes a universal billing rule unsafe. The state-bar synthesis reports differing approaches to AI-related fee treatment, including whether AI-assisted review time is billable and what level of human verification is required before charging the client.[2] The practical response is to make time entries describe the lawyer work actually performed: reviewing, verifying, revising, escalating, and communicating. Do not hide AI learning time inside vague contract-review language.
Efficiency creates a second issue. If AI reduces the time needed for a contract review, a lawyer charging hourly time cannot bill for time not actually spent. Alternative fee arrangements raise different questions, but the lawyer still has to satisfy reasonableness and communication duties. For related fee and business-model issues, see Legal AI: Time Saved, Profits Unchanged?.
Candor Is Narrower, but It Cannot Be Ignored
Candor duties do not arise every time a lawyer uses AI to review a contract. They become more serious when AI-assisted output is used in a representation context where a court, agency, opposing party, client, auditor, or other recipient may rely on the lawyer’s statement. If an AI-generated contract summary is incorporated into a filing, a diligence certificate, a negotiation position, or a client-facing advice memo, the lawyer must be able to stand behind it.
The verification record matters here because candor failures often look less like “the AI made a mistake” and more like “the lawyer transmitted an unchecked statement.” If the output misstated a contract term, omitted a carveout, or invented support for a conclusion, the lawyer’s duty is measured by the professional obligation attached to the use of that statement, not by the software’s role in generating it.
Jurisdictional Review Is Part of the Workflow
ABA Formal Opinion 512 is the national anchor, but it is not the final word for every lawyer using AI in contract analysis. The state opinions issued by early 2026 create a patchwork. Some jurisdictions have detailed guidance. Others have little or none. California, New York, and Florida are frequently discussed because they have more developed AI ethics materials, but the relevant answer still depends on the lawyer’s licensing, the matter, the client, and the specific use.[2]
That review should not happen after the tool is already embedded in the contract process. At intake, the matter team should identify the governing professional-responsibility sources for the lawyers involved, any client or court restrictions, and whether the planned workflow triggers consent, disclosure, confidentiality, supervision, or billing requirements beyond the ABA baseline. For a broader cross-jurisdiction overview, see What the ABA and State Bars Require of Lawyers Using AI.
This article is informational and workflow-oriented. It is not legal advice, and it should not be used as a substitute for checking the rules, opinions, client terms, and court requirements that govern a specific representation.
A Defensible Contract-Analysis Procedure
A professional-responsibility procedure for AI contract analysis does not have to be elaborate. It has to be tied to the work. The file should show that a competent lawyer selected an appropriate tool for a defined task, protected client information before upload, used an approved playbook or prompt structure, treated AI output as draft analysis, verified material results, communicated with the client when required or prudent, billed only for compensable work, and preserved enough supervision records to reconstruct the process.
The active disciplinary risk is not that every AI-assisted contract review is suspect. The risk is that adoption reaches the matter team before competence, confidentiality, fee, candor, supervision, and communication duties have been assigned to actual workflow steps. A lawyer who can show those steps is in a much better position than one who can only say the firm had an AI policy.
References
- ABA Formal Opinion 512 — americanbar.org, July 2024.
- AI & Legal Ethics 2026: Bar Rules Every Lawyer Must Know — thelegalprompts.com.
- 90 AI Statistics in the Legal Field for 2026 — azumo.com.
- 2026 Legal Industry Report — legal-industry adoption and governance data.
- LegalOn 2026 Contract Review Benchmark — legalontech.com.
Comments
Join the discussion with an anonymous comment.