Use AI in your U.S. law firm without exposing client details

A law firm AI policy gets tested at the paste. Intake notes, a deposition summary, draft answers to interrogatories or an immigration file with the client’s A-Number all carry the client’s SSN, date of birth and driver’s license number, plus account numbers, the employer’s EIN and the case number. When intake calls for a copy of the client’s ID, ask for a watermarked passport copy that names the matter and the month, or, from a permanent resident, a watermarked Green Card copy. If the client sends a driver’s license, it can carry the same kind of line: watermark the license copy for the matter.

Nobody uploads the whole file, only the piece that needs work, such as the facts section of a complaint or a demand letter to redraft. The policy can say, correctly, that client confidences stay out of public AI tools. But a policy lives on the intranet, and the associate finishing a draft at 11 p.m. lives at a keyboard. What the paste does and does not settle for privilege is laid out in our guide on redaction and privilege.

In a firm of one to twenty attorneys, the policy is usually the managing partner’s to write and to enforce, with no CISO down the hall to do it for them. In a large firm it goes to the general counsel or the director of risk, often because a corporate client asked. Either way, the person who signs the policy is rarely the one pasting.

This is AI for law firms with the client left out: the attorney highlights the passage, presses one key, and ChatGPT, Claude or Copilot gets placeholders where the names and numbers were.

The swap happens on that Mac or PC before the prompt goes out, and when the draft comes back Nonimo fills the real names and numbers in again. Whether the version with placeholders still protects privilege is a separate question, taken one duty at a time in our guide to redacting before AI.

Nothing is hidden from you: every redacted detail is highlighted on screen, and one click brings it back. More on our security page.

The national reference point for law firm AI policies is ABA Formal Opinion 512 of July 29, 2024, and it asks for two things: the client’s informed consent and real diligence on the tool.

On consent the opinion is direct. For a self-learning tool whose output could disclose that information, “a client’s informed consent is required prior to inputting information relating to the representation into such a GAI tool,” and “merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient.” Consent needs its own engagement letter paragraph. The same page says consent is not required when the lawyer will not be inputting information relating to the representation, as with idea generation. On diligence, the baseline is that lawyers “should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use.” Consent stays the firm’s call, and Nonimo shrinks what you would be asking the client to consent to.

State bars add their own detail. In California, COPRAC wrote its 2026 guidance at the request of the California Supreme Court, replacing the 2023 version, and hangs the confidentiality duty on three rules: Business and Professions Code §6068(e), Rule 1.6 and Rule 1.8.2. It never uses the words redact or de-identify. On diligence the committee is blunt: reasonable efforts “require more than reliance on generalized marketing assurances.”

The Florida Bar, in Opinion 24-1 of January 19, 2024, says consent is not required where a generative AI program involves no disclosure of confidential information to a third party. Nonimo keeps the client’s identifiers out of what the vendor receives, and your ethics counsel decides how far that takes you. Clauses you can adapt are in our AI policy template. Courts are a separate layer: whether you have to disclose AI use in a filing depends on the court and the judge, and a few ask you to confirm that nothing confidential went in.

As law firm AI software goes, Nonimo is a small install: one per attorney, on Windows or on a Mac.

The installers for Mac and Windows sit in the header above, and each attorney who uses it installs it on their own machine.

Your policy can name the step the app takes: it redacts on the attorney’s machine, before the prompt goes out. On every desk at once, IT deploys the browser extension by policy, which redacts text automatically in the AI tools, without a keypress, before the text is sent.