Top Lawyers — toplawyers.io

# SOP: AI and Automation Tool Vetting

**Purpose:** Protect client confidentiality and professional judgment before adopting any new tool.
**Owner:** The responsible attorney. **Review cycle:** Every six months.

## Step 1: Define the use
- What task will the tool perform?
- Will client or confidential information be involved? (yes/no)

## Step 2: Ask these questions
1. Does the vendor state how it stores and uses the data you enter?
2. Is your data used to train its models? Can you opt out?
3. Where is data stored, and who can access it?
4. Does the vendor offer a data processing or confidentiality agreement?
5. Can you delete your data on request?
6. Does it support two-factor authentication?
7. Does your state bar offer guidance on this kind of technology?

## Step 3: Rate the risk
- **Low:** No client information involved (for example, drafting marketing ideas).
- **Medium:** Limited client information, strong vendor terms.
- **High:** Sensitive information or unclear terms. Do not use until resolved.

## Step 4: Pilot with fake data
Run the tool using invented information for two weeks. Note errors, time saved, and surprises.

## Step 5: Verify outputs
A lawyer reviews every output before it reaches a client or court.

## Step 6: Record
| Tool | Date | Use | Risk | Decision | Next review |
|---|---|---|---|---|---|

## Step 7: Disclosure
Consider whether your engagement letter should describe your use of technology.