📢 Library of Congress Recognizes The Tech-Savvy Lawyer Podcasting Guide—and the Conversation Continues at The Tech-Savvy Lawyer.Page 🎙️

Excited and honored to share that the library of congress has accepted “The Tech-Savvy Lawyer, Lawyer’s guide to podcasting” into its collection!

I am pleased to announce that the Library of Congress has accepted The Tech-Savvy Lawyer: Lawyer’s Podcasting Guide for inclusion in its collection. I am honored for this recognition. It is a meaningful milestone for the guide, for The Tech-Savvy Lawyer, and for the growing community of lawyers who use podcasting to educate, connect, and contribute to the public conversation about law and technology. 📚

Library of Congress Control Number: 2026395311.

For years, The Tech-Savvy Lawyer has focused on practical technology issues that affect real law practices. The goal has never been technology for its own sake. It has been to help lawyers make sound decisions about tools that influence client service, confidentiality, competence, communication, efficiency, and professional judgment.

The Library of Congress acceptance of the Lawyer’s Podcasting Guide recognizes that lawyer-created educational content can have lasting value. A legal podcast may begin as a conversation, an interview, or a short practical lesson. Yet it can become something more durable: a resource for lawyers, clients, students, researchers, and members of the public who want to understand how the profession responds to changing technology.

That work continues at The Tech-Savvy Lawyer.Page. 💻

The site is designed as a practical home for lawyers who want clear guidance on legal technology, AI, cybersecurity, digital communications, ethics, and law-practice management. It is written for solo practitioners, small-firm attorneys, and legal professionals who do not need another abstract discussion of innovation. They need practical analysis that respects both their intelligence and their professional obligations.

Recent coverage has examined the growing risks of autonomous and agentic AI systems in legal practice. In “MTC: Claude Can Answer Your Emails. Why Lawyers Should Not Let AI Just Send Them Unreviewed”, I addressed the danger of allowing an AI system to send substantive communications without lawyer review. The issue is not merely whether a draft is grammatically polished. It is whether the message is accurate, confidential, authorized, and appropriate for the client’s matter.

The related challenge becomes even more serious when AI tools can act through connected systems. As discussed in the recent Tech-Savvy Lawyer analysis of AI agents, these systems may browse the web, access connected accounts, retrieve information, interact with software, and take multistep actions. That potential can improve a workflow, but it also expands the lawyer’s responsibility for access controls, supervision, confidentiality, and final review. 🔒

That is why the Lawyer’s Podcasting Guide is about more than microphones, recording software, and publishing platforms. It is about professional communication. It helps lawyers think through the decisions that make a podcast sustainable and trustworthy:

The library of congress has recognized, “The Tech-Savvy Lawyer, Lawyer’s guide to podcasting” , as a national resource - get your copy today!

• Who is the intended audience?

• What subject can the lawyer address with genuine experience and consistency?

• What format serves listeners without consuming an unreasonable amount of practice time?

• How can a lawyer promote educational content without creating unjustified expectations?

• What safeguards protect client-related information during recording, transcription, editing, hosting, and promotion?

• How should AI-assisted production tools be evaluated before they touch confidential or sensitive material?

Those are legal-technology questions. They are also ethics questions.

ABA Model Rule 1.1 requires competent representation. Comment provides that lawyers should keep abreast of the benefits and risks associated with relevant technology. A lawyer who uses a remote-recording service, transcription platform, cloud-hosting provider, AI-generated show-notes tool, or social-media distribution service should understand enough to make responsible decisions about that tool. The lawyer does not need to be an audio engineer or software developer. The lawyer does need to understand how the technology may affect the practice. ⚖️

ABA Model Rule 1.6 is equally important. It generally prohibits revealing information relating to representation without informed consent, implied authorization, or another applicable exception. It also requires reasonable efforts to prevent unauthorized disclosure or access. That duty does not disappear because a lawyer describes a matter as an “anonymous example” on a podcast. The combination of facts, timing, location, and context may reveal more than the lawyer intended.

The best legal podcasts recognize that responsibility. They do not use client matters as raw material. They use informed analysis, carefully selected hypotheticals, public sources, interviews, and professional experience to help listeners understand an issue.

The Library of Congress recognition also arrives at an important moment for legal podcasting. Lawyers are using audio and video formats to explain developing legal issues, discuss technology, spotlight access-to-justice efforts, and connect with colleagues across practice areas and jurisdictions. The medium is accessible. A lawyer can begin with a focused topic, basic equipment, a repeatable workflow, and a commitment to quality. 🎧

But starting is not the same as sustaining.

That is why I am especially excited to connect this announcement to the Lawyer’s Podcasting Conference. The conference will bring together lawyers, legal-technology professionals, podcasters, and communications leaders to discuss how attorneys can create ethical, effective, and enduring podcasts. Participants will explore strategy, content planning, recording, interviewing, editing, publishing, promotion, accessibility, AI-assisted workflows, and the professional-responsibility issues that shape every stage of the process.

The conference is intended to be practical. It will help lawyers move from “I have been thinking about starting a podcast” to “I have a responsible plan for launching one.” It will also help established podcasters improve their process, sharpen their audience focus, and evaluate emerging technology without sacrificing lawyer oversight. 🤝

For lawyers who are AI-curious, the discussion will be particularly timely. AI can assist with transcripts, summaries, episode outlines, clip selection, metadata, and workflow organization. It cannot replace the lawyer’s duty to verify accuracy, protect confidential information, supervise the work, or exercise professional judgment. The lawyer remains accountable for what is published and how client-related information is handled.

Find “The Tech-Savvy Lawyer, Lawyer’s guide to podcasting” in congress or get your own copy today!!!

The acceptance of the Lawyer’s Podcasting Guide by the Library of Congress is an honor. More importantly, it is an invitation to keep building. The legal profession needs more thoughtful voices. It needs clearer explanations of difficult subjects. It needs lawyers who can use technology with competence, care, and a commitment to public service.

Visit The Tech-Savvy Lawyer.Page to follow the latest analysis, learn more about the Lawyer’s Podcasting Conference, and maybe buy your copy of the Lawyer's Podcasting Guide today to get a head of the conference attendees! I hope you will join the conversation!!!

MTC: When AI Lawyers’ Assistants Start Acting as an Agent: Why Autonomous Agents Cannot Be Given the Keys to Your Law Practice ⚖️

AI Agents in Law Firms Need Boundaries Before They Receive Access to Client Data. ⚖️🔐

Artificial intelligence is moving beyond the chat window. The next generation of tools does not merely draft an email, summarize a document, or answer a question. It can browse the web, search connected systems, open files, follow links, use software tools, upload information, submit forms, and take multi-step action toward an assigned objective.

For lawyers, that development deserves more than curiosity. It demands caution.

In my earlier post, “MTC: Claude Can Answer Your Emails. Why Lawyers Should Not Let AI Just Send Them Unreviewed,” I addressed the danger of allowing AI to send a substantive email without a lawyer’s review. That remains a serious concern. An AI-generated message can contain a factual error, disclose client information, make an unintended concession, or create a record that harms the client.

But email is only the beginning.

The larger issue is what happens when an AI system becomes an agent—a system authorized to use tools, access accounts, navigate websites, retrieve information, and act through the lawyer’s digital environment. These systems are often marketed as “agentic,” “autonomous,” “proactive,” or “hands-free.” Those labels may sound like productivity features. In a law practice, they should also sound like professional-responsibility warnings. 🚨

The legal question is no longer only, “Did the AI draft something accurate?”

It is, “What can this AI do in my name, with my credentials, using my clients’ information—and who is responsible if it does the wrong thing?”

The answer is not the vendor. It is not the algorithm. It is the lawyer and, where applicable, the law firm that authorized the system, connected the accounts, granted the permissions, and failed to impose adequate safeguards.

From AI Assistant to AI Agent

It helps to distinguish between ordinary generative AI and an AI agent.

A conventional generative-AI tool generally waits for a user prompt. It produces text, analysis, a summary, or a draft. The lawyer then decides what to do with that output. The tool may be imperfect, but it is usually operating within a relatively contained workflow.

An AI agent is different. It may be able to plan and perform a sequence of tasks. It can interact with browsers, software applications, application programming interfaces, email, shared drives, calendars, cloud services, and other connected tools. It may take the next step without waiting for a fresh instruction at each point.

That distinction matters because an AI agent can inherit the power of the person or organization that deploys it.

If an agent is connected to a lawyer’s email, document-management system, cloud storage, password manager, practice-management platform, legal research account, calendar, client portal, or browser session, it may have access to far more than the task requires. It may also have the capacity to do far more than the lawyer intended.

The agent does not need malicious intent to create damage. It may misunderstand an instruction. It may draw the wrong inference. It may rely on inaccurate information. It may follow a link it should not follow. It may act on content supplied by an adversary. Or it may perform an otherwise lawful task in a way that reveals confidential information, exceeds the scope of authority, or causes a legally consequential result.

This is why a law firm should never evaluate an agentic AI tool as if it were merely a faster chatbot.

When AI Leaves the Sandbox

Every responsible firm should think in terms of two sandboxes.

When an AI Agent Exceeds Its Authority, Lawyers Must Be Ready to Stop It Immediately. 🛑⚖️

The first is a technical sandbox: a restricted environment that limits what software can access, change, or transmit. The second is a professional sandbox: a controlled setting in which lawyers can test AI without exposing live client data, actual accounts, privileged documents, or external systems to avoidable risk.

Problems begin when the AI leaves either one. 🔒

Consider a few plausible instructions:

• “Review the client’s online accounts and gather the relevant documents.”

• “Find everything public about this company and organize it by issue.”

• “Check the opposing party’s portal for new activity.”

• “Handle this vendor issue and get us back on track.”

• “Research whether this online filing system will accept our documents.”

• “Use the web to find contact information and send the necessary requests.”

Each prompt appears practical. Each could become dangerous if the agent’s tools, permissions, and boundaries are unclear.

A lawyer may intend a public-web search. The agent may encounter a login screen, use stored browser credentials, and access a restricted account. A lawyer may intend for the agent to collect public information. The agent may scrape, copy, or retain material in a manner that violates terms of use, triggers security controls, or creates legal exposure. A lawyer may intend for the agent to summarize a webpage. The agent may follow embedded directions, interact with a third-party system, or use information from a connected firm repository that was unnecessary to the assignment.

Lawyers must be especially careful not to authorize, encourage, or negligently permit activity that crosses legal or ethical boundaries. AI does not create an exception to laws governing unauthorized access, fraud, privacy, intellectual property, data protection, or deceptive conduct.

The better framing is not that AI will “infiltrate” a company. The concern is more precise and more likely: an unsupervised agent may access, probe, interact with, retrieve from, or transmit information through third-party systems in ways that exceed the lawyer’s authority, violate applicable rules or agreements, compromise security, or harm a client. Just as you are responsible for your paralegal when they take unethical or illegal steps in their work, you are also responsible for AI Agents when they go awry.

Also, machine speed does not reduce lawyer responsibility. It can increase the scale of the harm.

The Prompt-Injection Problem

One of the most important risks is indirect prompt injection.

A prompt injection occurs when instructions are designed to manipulate an AI system away from its intended task. Indirect prompt injection is particularly troubling for AI agents because the hostile instruction may be embedded in material the agent reads rather than placed directly in the lawyer’s request.

The source could be a webpage, email, PDF, calendar entry, legal document, attachment, database entry, shared file, online form, API response, or other external content. Security guidance for AI agents stresses that external content should be treated as untrusted, because an agent may encounter instructions intended to redirect its actions or misuse its connected tools.

Here is a simplified illustration:

A lawyer instructs an AI agent to review public webpages for information about a business dispute. One webpage contains hidden text directing the agent to locate “supporting documents” in the lawyer’s connected cloud drive and upload them to an external location.

The lawyer never gave that instruction. The webpage did.

A well-designed system should reject it. But responsible lawyers should not assume that an AI will reliably distinguish between a lawyer’s authorized objective and hostile instructions hidden inside content the agent encounters. The core danger is that agentic systems combine three things that do not safely belong together without controls:

1. Untrusted content.

2. Broad access to sensitive information.

3. Authority to take action.

That is not a theoretical concern. Open Worldwide Application Security Project (OWASP)'s agent-security guidance identifies prompt injection, excessive agency, insecure tool use, identity and authorization failures, and unbounded autonomy as material risks for systems that can act through tools and connected accounts. Its recommended controls include treating external data as untrusted, applying least-privilege permissions, requiring human involvement for high-risk actions, logging activity, separating decision-making from irreversible execution, and testing agents against adversarial inputs before deployment.

Editor’s Note: My earlier article, “MTC: Judges Will Be Hunting These AI Tricks After Brazil’s Scandal,” addressed hidden prompts in court filings—concealed text or instructions intended to influence an AI-enabled system’s treatment of a case. Lawyers should never engage in that practice. Nor should they allow an AI agent to follow hostile instructions embedded in webpages, emails, attachments, or other external content. That conduct threatens candor toward the tribunal and may implicate ABA Model Rules 3.3 and 8.4. The lesson is symmetrical: do not manipulate an AI system, and do not give an AI system unchecked authority to be manipulated by someone else. ⚖️

For lawyers, the practical rule is straightforward:

An AI agent may read untrusted content, but it must never be allowed to treat that content as authorized instruction.

Confidentiality Is Not a Setting

lawyers must monitor Prompt Injection as it Can Turn a Helpful AI Agent Into a Law-Firm Security Risk. 🚨🔒

ABA Model Rule 1.6 should be at the center of every law firm’s AI-agent policy.

Rule 1.6(a) generally prohibits a lawyer from revealing information relating to the representation of a client without informed consent, implied authorization to carry out the representation, or another applicable exception. Rule 1.6(c) also requires a lawyer to make reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to representation.

An AI agent connected to a law firm’s systems can create both dangers.

First, there is overcollection. The agent may access client information beyond what is reasonably necessary to perform the requested task.

Second, there is overaction. The agent may use, combine, disclose, upload, summarize, transmit, or act upon information beyond the lawyer’s instruction or authority.

This is why the relevant question is not merely whether the AI vendor uses encryption or advertises a secure platform. Those facts matter. They are not enough.

Lawyers must also ask:

• What systems can the agent access?

• What client data might it encounter?

• Can it retrieve information from more than one matter?

• Can it read attachments, shared drives, calendars, contact lists, or historical email?

• Can it use stored sessions or credentials?

• Can it upload, download, send, submit, or share material?

• Can it contact third parties?

• Can it alter records, schedule events, approve transactions, or make commitments?

• Is the agent’s activity logged in a way the firm can review after an incident?

• Can the firm immediately revoke its access?

ABA Formal Opinion 512 explains that lawyers using generative AI must fully consider existing professional obligations, including competence, confidentiality, client communication, supervision, candor, and reasonable fees. The opinion does not create an AI exception to the Rules of Professional Conduct. It applies familiar duties to newer technology.

That principle becomes even more important when the AI is not simply producing words but is acting through connected systems.

Do not give an AI agent your whole digital office merely because it promises to organize the desk.

Competence Means Understanding Authority

ABA Model Rule 1.1 requires competent representation. Comment 8 provides that lawyers should keep abreast of the benefits and risks associated with relevant technology.

That duty does not require every solo practitioner or small-firm lawyer to become an AI security engineer. It does require more than clicking “enable” on a product feature.

For agentic AI, competence means understanding the system’s practical authority:

• Whether it can browse the open web.

• Whether it can access authenticated websites through saved sessions.

• Whether it can use a firm’s email or cloud storage accounts.

• Whether it can invoke software tools or APIs.

• Whether it can create, modify, upload, delete, send, or submit information.

• Whether it can act repeatedly without asking for approval.

• Whether permissions can be limited by task, user, matter, data source, and destination.

• Whether the firm can reconstruct the agent’s actions after a security or ethics incident.

The National Institute of Standards and Technology (NIST)’s AI Agent Standards Initiative recognizes that secure agent use requires work on identity and authentication infrastructure for interactions in which agents act on behalf of users. That is an important reminder for law firms: an agent should not simply be treated as an invisible extension of a lawyer’s identity. Its access, authority, and activity need governance.[nist]

Marketing language matters here. When a vendor describes an AI system as autonomous, proactive, browser-enabled, hands-free, or able to “get things done,” the lawyer should translate those claims into risk questions:

• What can it do?

• What can it access?

• What can it send?

• What can it change?

• What happens when it encounters conflicting instructions?

• What happens when it is wrong?

Those are competence questions, not technology-department questions.

Supervision Does Not Disappear

everyone in the law firm, lawyers, paralegal, secretaries, staff, etc., must learn that Responsible Legal AI Starts With Least-Privilege Access and Human-Led Governance. ✅⚖️

AI is not a lawyer. It is not a paralegal. It is not a law clerk. It is not an independent source of professional judgment.

But if it performs work in connection with client representation, it must be subject to appropriate oversight.

ABA Model Rules 5.1 and 5.3 require lawyers with managerial and supervisory responsibilities to make reasonable efforts to ensure that lawyers and nonlawyer assistance operate consistently with the firm’s professional obligations. The exact categorization of an AI system may be unsettled in some contexts. The governing principle should not be: a lawyer cannot escape responsibility by assigning professional work to a software product.

A disciplinary authority will not be satisfied with this explanation:

“The system accessed the account, found the information, contacted the third party, or took the action on its own.”

The next question will be obvious:

“Why did the lawyer give the system the power to do that?”

That question should be answered before the tool is used—not after an incident.

Lack of oversight is not a defense to a bar complaint. It may be the central allegation.

The same is true in a malpractice dispute. If an agent missed a material deadline, sent privileged information to the wrong recipient, accepted an unfavorable term, followed malicious instructions, accessed a restricted system, or failed to alert the lawyer to a critical issue, the firm will need to explain its safeguards. A vague assertion that “the AI made the decision” does not reduce the lawyer’s duty to the client.

Where AI Agents May Help

None of this means lawyers should reject AI agents categorically. They may offer real value when narrowly deployed, properly tested, and meaningfully supervised.

Appropriate uses may include:

• Sorting inbound messages by matter, urgency, sender, and subject.

• Identifying potential deadlines or tasks for lawyer review.

• Preparing internal summaries of selected correspondence.

• Locating documents within a defined, matter-specific repository.

• Creating preliminary chronologies from reviewed materials.

• Comparing a draft against a firm-approved checklist.

• Preparing an internal first draft of a non-substantive task list.

• Flagging missing attachments, inconsistent dates, or unanswered questions.

• Gathering information from a specified set of approved public sources.

The critical limits are clear:

• The agent should have only the access it needs.

• It should operate only within a defined task and approved data set.

• It should not use unrestricted browser sessions or broad credentials.

• It should not make substantive legal judgments.

• It should not communicate externally without lawyer review.

• It should not upload, submit, delete, purchase, disclose, or alter information without affirmative human approval.

The fact that a tool is capable of acting does not mean the law firm should let it act.

A Practical Law-Firm Policy

For solo and small-to-medium firms, a useful starting policy is this:

No AI agent may access live client-data systems, authenticated third-party accounts, or firm-wide repositories unless the firm has documented the business purpose, evaluated the risks, restricted access, and established human approval for consequential actions.

That policy should include the following controls:

• Use least-privilege access. Give an agent only the minimum permissions needed for a defined task.

• Do not provide master credentials, password-manager access, unrestricted administrative rights, or blanket cloud-drive access.

• Create separate accounts for testing and limited workflows when possible.

• Prohibit autonomous external communications, uploads, form submissions, record changes, financial activity, and data transfers without affirmative human approval.

• Limit agent access by client matter, practice group, data category, source, and destination.

• Treat webpages, emails, attachments, documents, and external tool results as untrusted input.

• Disable or restrict browsing when browsing is unnecessary to the approved task.

• Require logging of actions, tools used, information accessed, approvals obtained, and external destinations.

• Establish a “kill switch” that permits the firm to revoke permissions, disconnect integrations, and terminate active sessions promptly.

• Test the system against prompt injection, harmful tool calls, excessive permissions, and anomalous behavior before using it in live client work.

• Review vendor terms for confidentiality, retention, training, access, subprocessors, security, auditability, and breach notification.

• Train lawyers and staff to recognize that an AI summary is not a substitute for reviewing the underlying record. 🧠

These are not bureaucratic obstacles to innovation. They are the governance mechanisms that make responsible innovation possible.

The Lawyer Still Owns the Result

Lawyers Must Act as the First, Last, and Continuous Line of Defense for AI Agents. ⚖️🔒

The central lesson is simple.

An AI agent can be a useful assistant. It may help a law firm reduce repetitive work, organize information, identify issues, and prepare preliminary work product. Those benefits are real.

But an AI agent is not a colleague with legal judgment. It is not a licensed professional. It cannot hold client confidences in the ethical sense. It cannot explain its actions to disciplinary counsel. It cannot defend a malpractice claim. It cannot be sanctioned in the way a lawyer or law firm can.

It is a tool acting with the authority its human users give it.

When a lawyer authorizes an AI to operate beyond the sandbox—to browse, access accounts, use connected software, retrieve information, or take action—the lawyer has not delegated accountability. The lawyer has expanded the range of conduct for which accountability may be demanded.

Let AI assist. Let it organize. Let it draft. Let it identify questions for review.

But before granting it access to your firm’s digital office, your client information, or the internet under your identity, ask the question that will matter most if something goes wrong:

What exactly can this system do in my name? ⚖️

🚨 BREAKING NEWS! Microsoft Outlook Outage: What Lawyers Need to Do When Microsoft 365 Email Fails ⚠️

lawyers are you prepared if your e-mail server goes down?!

The Microsoft Outlook and Exchange Online outage reported on August 31 is a timely warning for every law practice that relies on Microsoft 365 for email, calendars, document access, and client communication. This was not simply an inconvenience. For lawyers, a cloud-service disruption can become a deadline, confidentiality, supervision, and client-service problem within hours. ⚖️

Thousands of users reported Outlook problems beginning shortly before noon Eastern Time on August 31. Reports peaked at nearly 6,000 shortly after 12:24 p.m. ET. The most common complaint involved receiving email. Users also reported login and app-access problems. Microsoft initially confirmed degraded functionality in Exchange Online, its cloud-hosted email platform.

The situation later appeared broader than Outlook alone. Reporting on Microsoft’s service updates indicated that the incident affected Exchange Online and could affect Microsoft 365 services including OneDrive for Business, SharePoint Online, Teams, Purview, and Defender XDR. Microsoft attributed the incident to a core authentication-configuration issue. By early September 1, mailbox connectivity had reportedly been restored, although Microsoft was still addressing search functionality and the clearing of backlogged mail queues.

For a law firm, that combination matters. An outage can interrupt email. A related Microsoft 365 disruption can also interfere with matter files, calendar access, Teams meetings, e-discovery workflows, secure sharing, retention tools, and even the ability to authenticate into the firm’s normal systems.

The lesson is not that lawyers should abandon cloud technology. Microsoft 365 remains an important platform for many legal organizations. The lesson is that every firm needs a practical, tested continuity plan for the days when a trusted vendor’s systems are unavailable. 🔐

Why This Is a Legal-Practice Issue

Lawyers often treat email as an everyday administrative tool. Clients do not. To a client, email is often the firm’s front door, the place where urgent instructions arrive, and the record of whether counsel responded when it mattered.

When Outlook or Exchange Online stops working, several risks arise at once:

• A client may send time-sensitive instructions that do not reach the firm promptly.

• Opposing counsel may serve a filing, discovery response, settlement demand, or meet-and-confer request by email.

• A court may issue a notice, hearing link, electronic filing notice, or order through a system that the lawyer normally monitors through Outlook.

• Firm staff may be unable to locate calendar invitations or Teams links for hearings, mediations, depositions, and client meetings.

• Messages sent during the outage may be delayed. They may arrive later in a batch, which can create confusion about when the message was actually sent or received.

• Lawyers may resort to personal email, text messages, or improvised file-sharing tools without considering confidentiality, security, and retention obligations.

That is why a service outage is not merely an IT ticket. It is a business-continuity event. A solo lawyer can face the same core risk as a large firm, although a solo lawyer may have fewer people available to spot the problem and activate a fallback process.

The ABA Model Rules provide the framework. ABA Model Rule 1.1 requires competent representation. Comment 8 explains that competence includes keeping abreast of the benefits and risks associated with relevant technology. A lawyer who depends on cloud email does not need to become a Microsoft systems engineer. The lawyer does need to understand the operational risks of that dependency and make reasonable preparations for an outage.

That obligation is especially practical in 2026. Technology competence includes knowing where the firm will look for alerts, who decides that an outage is material, how the firm will communicate with clients, and how the firm will protect confidential information when normal workflows fail.

🚨The Ethics During an Outage ⚖️

lawyers need a firm-wide policy whnen their e-mail server goes down.

An outage does not suspend professional duties. It changes the way a lawyer must satisfy them.

Competence: ABA Model Rule 1.1

Model Rule 1.1 calls for the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation. Comment 8 adds the technology dimension. A firm should have a basic plan for interrupted email and cloud access. That is preparation, not overengineering.

A reasonable plan may include:

• A designated person to monitor the Microsoft 365 Service Health Dashboard and vendor-status notices.

• A current list of urgent matters, upcoming deadlines, hearings, and client contacts.

• An alternative communication channel approved by the firm.

• Instructions for capturing and documenting communications received through a fallback channel.

• A process for reconciling delayed or queued email after service is restored.

• A clear escalation path for lawyers and staff when an outage affects a deadline-sensitive matter.

The plan should match the firm’s size, practice areas, client base, and risk profile. A litigation practice with frequent electronic filing deadlines has different needs from a transactional practice, although neither can assume that email will always work.

Confidentiality: ABA Model Rule 1.6

Model Rule 1.6 requires lawyers to "make reasonable efforts" to protect information relating to client representation. Paragraph (c) specifically requires reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, that information.

That duty is particularly important when normal systems are down. An Outlook outage creates pressure. Pressure can lead someone to forward client documents to a personal Gmail account, upload a file to an unsanctioned consumer platform, or conduct substantive client business by unprotected text message.

Those choices may create more risk than the outage itself.

The better approach is to decide now which alternatives the firm permits. For example, the firm might maintain an approved secondary secure email platform, a secure client portal, or an encrypted communication tool. It should also decide how those communications will be preserved in the client file once Microsoft 365 services return.

Do not let individual lawyers invent their own workaround in the middle of a disruption. That is not a criticism of ingenuity. It is a recognition that confidentiality, security, and recordkeeping require a coordinated response. 🔒

Diligence and Communication: ABA Model Rules 1.3 and 1.4

Model Rule 1.3 requires diligence. Model Rule 1.4 requires reasonable communication with clients. An outage can affect both.

If a client’s matter has a filing deadline, hearing, closing, or urgent negotiation, the firm should actively determine whether a disruption is affecting communications or access to essential documents. A lawyer should not assume that the absence of incoming email means that no message has been sent.

Likewise, if an outage materially affects the firm’s ability to receive or send client communications, a short client notice can be appropriate:

“We are experiencing a temporary interruption affecting our primary email service. If your matter is urgent or deadline-sensitive, please contact our office by telephone at [number] or use our secure client portal at [link]. We will respond as soon as possible.”

— Potential Message for Your Law Firm When E-mail is Down...

That message is concise, useful, and professional. It informs the client without disclosing unnecessary details about the firm’s systems or creating undue alarm.

Supervision: ABA Model Rules 5.1 and 5.3

Partners and lawyers with managerial authority must make reasonable efforts to ensure that the firm has measures giving reasonable assurance that all lawyers conform to professional obligations. Lawyers who supervise nonlawyer staff have a related duty. An email-outage protocol is one of those measures.  See generally Rules 5.1 and 5.3.

Staff members need to know:

• Which matters require immediate escalation.

• Which phone numbers, portals, or backup channels are authorized.

• Whether they may use personal devices or personal accounts for firm communications.

• How to record calls, messages, and documents received outside normal systems.

• Who is authorized to communicate externally about the incident.

A simple one-page playbook can prevent a great deal of uncertainty. 📋

What To Do Today

don’t be caught unprepared if your e-mail server goes down!

The August 31 Microsoft 365 incident should prompt a short, focused review. You do not need a 75-page disaster-recovery manual before taking useful action.

1. Confirm the Scope Before You Improvise

When Outlook appears to fail, first determine whether the problem is local or broader:

• Check Microsoft 365 Service Health through the Microsoft 365 admin center.

• Check whether Outlook on the web works if the desktop application does not.

• Test access from a different network or device.

• Confirm whether the problem is limited to one user, one office, the firm’s domain, or a larger Microsoft service event.

• Check reputable outage reporting only as a supplemental source. Crowdsourced reports can signal a problem, but they do not replace the vendor’s tenant-specific status information.

During the August 31 disruption, Microsoft identified effects that included email delays or failures, mailbox-search issues, authentication errors, and trouble with Exchange administration and mailbox operations.

That distinction matters. A lawyer may be able to open Outlook but still experience delayed mail flow or incomplete search results. “It seems to be working again” is not the same as “all messages and matter records are available and current.”

2. Protect Deadlines First

Create a brief list of matters with time-sensitive events in the next 24 to 72 hours:

• Court filing deadlines.

• Administrative filing deadlines.

• Statutes of limitation or notice deadlines.

• Depositions, mediations, arbitrations, and hearings.

• Closings and settlement deadlines.

• Client commitments requiring same-day action.

Then verify communications through an approved backup method. If electronic filing is involved, review the court’s rules, emergency procedures, and clerk’s office notices. A Microsoft outage does not automatically extend a filing deadline. The relevant court rule, filing system status, and the particular judge’s procedures control.

Document what happened. Note the date, time, service involved, affected matter, communications attempted, and action taken. That contemporaneous record can be essential if a deadline issue later needs explanation.

3. Use Approved Backup Channels

A good backup channel is secure, accessible, documented, and familiar to the client and the firm. It might include:

• A secure client portal.

• A firm-approved encrypted email solution.

• The firm’s phone system and a documented telephone-call protocol.

• A secure collaboration system that remains available.

• A secondary, firm-controlled domain or mailbox that has been vetted in advance.

The right answer is not necessarily “use text messages.” Texting may be useful for a limited logistical notice, such as asking a client to call the office. It may be unsuitable for substantive communications or transmission of client documents unless the firm has assessed the platform, the client’s consent, security controls, retention, and applicable state ethics guidance.

4. Reconcile Email After Recovery

Once Microsoft reports recovery, do not assume the episode is over. Microsoft warned that mail queues might take time to clear and that search could remain affected.

The firm should:

• Review incoming and outgoing email around the outage window.

• Confirm receipt of all time-sensitive communications.

• Check Sent Items, drafts, outbox folders, and message-tracking tools where available.

• Re-run critical mailbox searches when search functionality is confirmed restored.

• Ask clients or opposing counsel to resend urgent communications if delivery status remains uncertain.

• Save an internal incident note for affected matters.

This is particularly important for e-filing notices, service emails, and client instructions. A delayed message can cause a lawyer to act on incomplete information.

5. Preserve the Lesson

After the immediate problem ends, conduct a short post-incident review. Keep it practical:

• What did not work?

• Which staff members knew how to respond?

• Were clients able to reach the firm?

• Did the firm have access to critical contact information?

• Did anyone use an unapproved tool because no approved alternative was clear?

• How long would the firm have remained operational if the outage had lasted another day?

The goal is not to assign blame. The goal is to reduce the risk of disruption next time. 💡

AI Tools Need Continuity Too

lawyers, meet your ethical compliance, be prepared for the unexpected, and come out the superstar to your clients!

The August 31 event also included reported disruption to ChatGPT. USA TODAY reported that ChatGPT functionality was restored while Outlook issues remained ongoing. For AI-curious lawyers, that overlap underscores a broader point: no cloud-based tool should become a single point of failure in a legal workflow.

Generative AI can assist with drafting, issue-spotting, summarization, and internal knowledge work. It should not be the only route to a critical work product. Keep source documents accessible. Preserve the lawyer’s independent judgment. Maintain a non-AI process for urgent drafting and legal research.

That approach aligns with the central lesson from our profession’s ongoing technology-competence discussion: the appropriate question is not whether a tool is innovative. The better question is whether the firm understands its benefits, limitations, confidentiality implications, and continuity risks. Rule 1.1 Comment 8 expressly frames technological competence in terms of both benefits and risks.

A practical rule of thumb: if the platform is unavailable for four hours, can your firm still identify the deadline, reach the client, access the critical document, and make a defensible decision? If the answer is no, that workflow needs attention.

The Bottom Line

Microsoft’s Outlook and Microsoft 365 disruption is a useful reminder that professional responsibility does not depend on whether a vendor’s status page is green. Lawyers need reliable systems, but they also need workable alternatives when reliable systems fail.

The best response is not panic. It is preparation. Maintain approved backup channels. Train staff. Protect confidential information. Monitor time-sensitive matters. Reconcile communications after recovery. Document what occurred.

For solo and small-firm lawyers, this can be accomplished without enterprise-level complexity. A current contact list, a secure fallback channel, a deadline triage checklist, and a 15-minute staff drill can materially improve the firm’s ability to serve clients when technology takes an unexpected day off. 📧⚖️

🚨 BOLO: Chrome Security Update: Law Firms Should Patch Before Browsing Again 🚨

lawyers keep your work secure, update your softwarE - update your google chrome browser now!

Solo practitioners and small firms should make updating Google Chrome a same-day task. Malwarebytes reports that Chrome’s current desktop update includes 327 security fixes, including 10 critical vulnerabilities, and that certain flaws can be triggered simply by visiting a malicious website. For a law practice handling confidential client communications, privileged work product, and sensitive financial data, that is a risk worth addressing immediately.

Chrome’s stable release has been updated to version 152.0.7977.64/.65 for Windows and Mac, and 152.0.7977.64 for Linux. The update addresses, among other issues, a critical flaw in ANGLE, Chrome’s graphics translation component, identified as CVE-2026-79282. Malwarebytes says a remote attacker could exploit that flaw through a crafted web page to execute arbitrary code outside Chrome’s browser sandbox.

That phrase—“outside the sandbox”—matters. Browser sandboxing is designed to contain web content so that a malicious site cannot easily reach the rest of the computer. A flaw that permits code execution beyond that boundary can give an attacker a path from a single web visit to the underlying operating system. That is precisely the sort of exposure lawyers should avoid when working in a browser alongside client portals, email, cloud document systems, court filing platforms, banking tools, and AI services. ⚖️

The update also remediates CVE-2026-78899, a use-after-free vulnerability in Chrome’s V8 JavaScript engine. It has a reported CVSS score of 8.8 out of 10. Even though successful exploitation occurs inside the browser sandbox, it should not be dismissed. Attackers frequently combine vulnerabilities in a chain, using one weakness to gain an initial foothold and another to widen access.

Why this is a legal-ethics issue!

its a team effort - remind your fellow lawyers to update their chrome browser today!

Technology hygiene is no longer separate from professional responsibility. ABA Model Rule 1.1 requires competent representation, and Comment 8 specifically calls on lawyers to keep abreast of “the benefits and risks associated with relevant technology.” A lawyer does not need to become a cybersecurity engineer. But maintaining a reasonably secure browser—the primary doorway to modern legal work—is a basic and manageable safeguard.

Model Rule 1.6(c) is equally relevant. It requires lawyers to make reasonable efforts to prevent unauthorized access to, or inadvertent disclosure of, client information. An unpatched browser can become an avoidable weak point in that effort. A compromised browser session could expose client documents, credentials, confidential messages, cloud-storage access, or data entered into web forms. 🔐

For firms, this update is also a reminder to think beyond the individual lawyer’s device. Rule 5.1 requires partners and managers to make reasonable efforts to ensure that firm-wide practices conform to professional obligations. Rule 5.3 similarly requires appropriate oversight of nonlawyer assistants. In practical terms, that means someone should own the checklist: browser updates, operating-system patches, password-manager deployment, multifactor authentication, and employee awareness.

Update Chrome now

On a Windows or Mac computer:

1. Open Chrome.

2. Select the three-dot More menu in the upper-right corner.

3. Choose Settings.

4. Select About Chrome.

5. Allow Chrome to download any available update.

6. Restart the browser to complete installation. 🔄

Chrome typically updates itself, but automatic updates can lag when the browser remains open for days, a restart is postponed, or an extension interferes with the update process. Malwarebytes specifically notes that manually checking can ensure the update is applied rather than merely downloaded.

This is a two-minute task with a potentially significant payoff. Before opening that unfamiliar link, reviewing a shared file, or logging into a client-facing platform, take a moment to confirm that Chrome is current. Security is not a one-time purchase or a single policy document. It is a set of small, repeatable habits that protect the practice and the people who trust it.

Bottom line: update Chrome, restart it, and encourage everyone in your firm to do the same today. ✅

HOW TO: How Lawyers Can Run a Private Local LLM on a Smartphone: A Practical, Ethical Guide 📱🔒

Lawyers can use local llms ON their smartphones if done right!

A local large language model, or LLM, lets you run generative AI can be run directly on your smartphone rather than sending prompts to a cloud-based service. For lawyers, that can create a useful extra layer of control over sensitive work product, client information, and drafts—provided you understand what “local” does and does not protect.

The attraction is obvious. You can use a capable AI assistant while traveling, in a courthouse hallway, or without reliable internet. More importantly, properly configured local AI can process prompts on the phone itself, rather than transmitting them to OpenAI, Google, Anthropic, or another remote provider. That is not a substitute for professional judgment, cybersecurity, or ethical compliance. It is, however, an option worth understanding. ⚖️

Why a Local Phone LLM Matters

Most familiar AI chat tools are cloud services. You type a prompt, the prompt is sent over the internet, the provider’s systems generate an answer, and the result returns to your device. The privacy terms, retention settings, training policies, account controls, and security practices of that provider matter enormously.

A local LLM changes the processing location. The model is downloaded to the phone, and it generates responses using the phone’s processor and memory. Lifehacker’s recent practical overview identifies two cross-platform options—PocketPal AI and Atomic Chat—and notes that local models can work offline and avoid sending ordinary prompts to conventional AI-cloud providers. The trade-off is that phone-based models are usually smaller, slower, and less capable than leading cloud systems. They also can consume noticeable battery power.

For legal professionals, local AI can be useful for lower-risk tasks such as:

• Brainstorming headings for a motion or client alert 🧠

• Rewriting your own nonconfidential prose for clarity

• Producing a checklist from a sanitized fact pattern

• Creating questions for a witness-preparation outline

• Turning a public regulation or opinion into a plain-language summary

• Developing podcast, blog, or presentation ideas while offline

• Building prompts and workflows before using an approved firm system

The same warning applies here as it does to every generative-AI tool: an LLM is not a legal-research service, does not independently verify authorities, and can invent facts, quotations, or citations. Use it to accelerate thinking and drafting—not to replace validation. 🔍

What You Need Before You Start

You do not need a computer-science background, but you do need a reasonably current phone and realistic expectations.

Lifehacker reports that phones released within the last few years should generally be able to run smaller local models, and identifies RAM, rather than raw processor speed alone, as a particularly important practical limitation: 6 GB may be workable, while 8 GB or more is preferable. It also suggests smaller 1–2-billion-parameter models for phones with less memory. Larger models may take several gigabytes of storages

Before installation, confirm these basics:

• Your phone uses a current version of iOS or Android.

• You have at least several gigabytes of free storage.

• Your phone is secured with a strong passcode, not a simple four-digit code.

• Face ID, Touch ID, fingerprint unlock, or another biometric lock is enabled where available.

• Your operating system and security updates are current.

• Your firm's written technology, security, and AI policies permit the planned use.

• You know whether your mobile-device-management system restricts unapproved apps or local file storage.

A practical starting point is a small, text-only model. "B," in labels such as "2B" or "7B," generally means billions of parameters. A smaller model usually responds faster and places less strain on the phone. A larger one may produce more nuanced output but can be slow, drain the battery, or fail to load.

Do not begin by downloading random models from unfamiliar sources. Treat model files like software: use reputable repositories, confirm the publisher, and avoid unofficial "enhanced," "uncensored," or repackaged downloads whose provenance you cannot assess. 🛡️

Step-by-Step🦶: Install a Local LLM

The exact screens will differ by phone and app version, but the workflow is straightforward. PocketPal AI and Atomic Chat are examples, not endorsements. Your firm may prefer a different approved tool.

lawyers must research llms beyond the media hype to ensure they are using them in compliance with their legal ethics!

1. Decide on an appropriate use case

Start with a task that does not require client-identifying information. For example:

"Create a checklist of issues to consider when reviewing a public-sector employee's proposed disciplinary notice. Do not provide legal advice or cite cases."

This lets you test the quality, speed, and limitations of the model without creating a confidentiality issue.

2. Download from the official app store

On iPhone, use Apple's App Store. On Android, use Google Play or another firm-approved, trusted distribution channel.

Search for either PocketPal AI or Atomic Chat, then verify the developer name, app description, and privacy disclosures before installing. 🚨 Do not install an app from a link in a social-media post, an unknown website, or an unsolicited message. 🚨

Atomic Chat represents that all inference runs on the device, that no conversation data is ever transmitted anywhere, and that it collects no chat history, prompts, or AI-generated outputs. It also states it operates without a backend server for chat data and requires no account. Its Google Play data-safety disclosure, however, notes the app may collect app activity, app-performance information, and device identifiers as anonymous analytics. These are vendor representations, not a legal guarantee; lawyers should still perform appropriate diligence.

PocketPal similarly represents that models run directly on the phone, that no data leaves the device, and that the app is open source so users can independently verify the absence of data-collection mechanisms. Its Google Play listing, though, discloses that the app "may collect" and "may share" personal information with third parties —a disclosure that appears to sit in tension with the "zero data transmission" marketing claim and underscores why a lawyer should read the actual store disclosure, not just the app description.

3. Review permissions and privacy disclosures

Before opening the app, check what permissions it requests. A basic text-only local LLM should not need unfettered access to contacts, location, microphone, camera, or every file on your phone merely to answer typed prompts.

Some permissions may be reasonable for optional features. For example, camera access could be necessary if you intentionally ask the app to analyze an image. The key is to grant permissions deliberately, not reflexively.

Review these questions:

• Does the app require an account or sign-in?

• Does it state that prompts, chats, and uploaded files remain on-device?

• Does it describe analytics, crash reporting, telemetry, or advertising identifiers?

• Does it use cloud backup, synchronization, external search, or third-party APIs?

• Does the privacy policy reserve the right to collect or share content?

• Can you delete chat histories and locally stored files?

• Can the app connect to external "agents," plug-ins, or web-search tools?

"Local" may describe the core text-generation function while other features still send data elsewhere. If you enable web search, cloud backup, voice transcription, document synchronization, or third-party integrations, your analysis must change accordingly. ⚠️

4. Download a small model

When you open the app, look for Models, Model Library, or a similar option.

PocketPal's project documentation describes selecting Models, choosing a listed model for download, or adding a compatible GGUF-format model from a recognized source. It also cautions users to choose a size and quantization compatible with the phone's memory and storage.

For a first test, choose a model that is:

• Small enough for your device

• Clearly identified by a reputable publisher

• Designed for general text generation

• Recently maintained

• Downloaded from the application's built-in catalog or an official project page

Google's Gemma family, Meta's Llama family, and Microsoft's Phi models include smaller variants intended for constrained hardware. A smaller model can be suitable for brainstorming, summarization of text you provide, basic editing, and structured checklists. It should not be treated as a reliable source for current law, jurisdiction-specific rules, or legal citations.

5. Keep the first test confidentially clean

Begin with public material or invented facts. Ask the model to summarize a public court opinion, revise a paragraph you wrote for a blog post, or develop questions for an educational presentation.

Test it with a prompt such as:

"Edit the following public-facing paragraph for clarity and professionalism. Preserve the legal meaning. Identify any claim that needs a source."

Then review the result line by line. Check every substantive legal proposition yourself.

6. Secure the local data

Local processing is only part of the security analysis. If the phone is stolen, unlocked, compromised, backed up insecurely, or shared with another person, locally stored chats and documents may be exposed.

At a minimum:

• Use a strong device passcode and biometric lock 🔐

• Enable device encryption, which current iPhones and many current Android devices provide when properly secured

• Set a short automatic-lock interval

• Avoid saving client documents in the app unless the risk assessment supports it

• Disable lock-screen previews that could reveal sensitive notifications

• Review cloud-backup settings for app data and chat history

• Use remote-wipe or "find my device" capability

• Delete test chats and downloaded material you do not need

• Do not leave a matter open on screen in court, at an airport, or in a shared workspace

The Overlooked Risk: Models "Learning" From Attorney Input

your firm needs to train its employees/lawyers about the proper use of ai in their work!

One security question deserves special attention because it is easy to overlook: could the model itself absorb, retain, or later reproduce a client's Social Security number, date of birth, or other personal identifying information that an attorney types into it? 🚨 For a genuinely on-device, inference-only app—one that loads a fixed, pre-trained model and does not perform continuous training on your conversations—the answer should generally be no. This is often the appeal of a self-hosted LLM. The downloaded model's parameters are typically frozen; a properly built local LLM app answers using that fixed model and does not retrain itself on each new prompt. That distinguishes it from cloud services that may use submitted conversations to improve or fine-tune their systems unless a user opts out.

That reassurance, however, is only as good as the app's actual architecture and the accuracy of its disclosures, and lawyers should not accept marketing language at face value. Independent reporting on local-AI apps has documented real gaps between privacy claims and practice, including apps marketed as "private" or "local-first" that were found to have no meaningful security protecting stored conversations. Google Play's own data-safety disclosures for both PocketPal AI and Atomic Chat list categories of information the apps "may collect," including personal information for PocketPal and device or app-activity data for Atomic Chat—details that are easy to miss if a lawyer relies solely on the app-store description or promotional copy. Security researchers have also noted that on-device models and their associated data stores are not immune from device-level compromise: models and cached data stored in plaintext on a phone can potentially be extracted through malware, physical access, or forensic tools if the device itself is not adequately secured.

For a lawyer, the practical lesson is threefold:

1. Confirm from the developer's actual privacy policy (not just app-store marketing) whether the app performs any training, fine-tuning, or cloud-connected analytics on your inputs;

2. Never type a client's Social Security number, date of birth, account numbers, or comparable identifiers into any AI tool—local or cloud—unless that specific handling has been vetted; and

3. Treat the phone's own security (encryption, passcode, biometric lock, remote wipe) as the last line of defense protecting whatever the app does store locally.

The Legal Ethics Analysis

self-hosted llms on your smartphone ARE GREAT WHEN YOU ARE ON THE ROAD, HAVE NO ACCESS TO THE INTERNET, OR ARE even in court!

The ABA's Formal Opinion 512 is the central national guidance point. Issued on July 29, 2024, it explains that lawyers using generative AI must fully consider their existing obligations under the Model Rules. Its principal topics include competence, confidentiality, client communication, candor, supervisory duties, and fees.

Model Rule 1.1: Competence

Model Rule 1.1 requires competent representation. Comment 8 directs lawyers to keep abreast of "the benefits and risks associated with relevant technology."

That does not require every attorney to become an AI engineer. It does require enough understanding to make informed choices. For a local phone LLM, that means knowing:

• Whether the app truly processes prompts locally

• Whether it trains, fine-tunes, or logs your inputs for any purpose

• Whether a feature transmits data to another service

• Where chat histories and documents are stored

• Whether local files are included in a cloud backup

• How the model's limitations affect the reliability of its output

• Whether your phone and firm policies provide adequate security

Competence also means knowing when a task requires traditional legal research, human analysis, and source verification. A local model with no web access may be helpful for drafting, but it cannot tell you whether a case was overruled yesterday. 📚

Model Rule 1.6: Confidentiality

Model Rule 1.6 protects information relating to representation, regardless of its source. A lawyer generally may not disclose that information without informed consent, implied authorization, or another applicable exception. The ABA specifically identifies confidentiality as a core concern in generative-AI use.

A local LLM can reduce one type of disclosure risk because the prompt may stay on the phone rather than move to a cloud AI provider. But it does not eliminate confidentiality risk. The phone, app, model repository, cloud backup, external integrations, and the possibility that a client's Social Security number or date of birth could be typed into a tool without full understanding of its data-handling practices all matter.

For higher-risk client information, conduct a documented, matter-specific assessment. In some circumstances, informed client consent may be prudent or required. The answer depends on the sensitivity of the information, the tool's terms and safeguards, your jurisdiction's rules and guidance, the client's instructions, and your firm policy.

Model Rules 5.1 and 5.3: Supervision

If your firm permits staff, contract professionals, or lawyers to use local LLM apps, adopt clear controls. Model Rules 5.1 and 5.3 require appropriate supervisory efforts concerning lawyers and nonlawyer assistance.

A sensible policy can specify:

• Approved apps and approved model sources

• Prohibited uses and types of client data—expressly including Social Security numbers, dates of birth, and other identifying information

• Required device-security controls

• Procedures for verifying AI-generated legal citations

• Review and approval requirements before any client-facing or court-filed use

• Incident-reporting steps if a phone is lost or data may have been exposed

Model Rules 3.1 and 3.3: Candor and Accuracy

No lawyer should file AI-generated authorities, quotations, or factual assertions without verification. Courts have already made clear that invented citations can lead to sanctions and reputational damage. Local operation does not make a hallucinated case real. 🧾

Treat every AI-generated authority as unverified until you locate it in a reliable legal-research system or official source. The lawyer—not the model—signs the pleading, advises the client, and bears responsibility for the work.
See generally 3.1 and 3.3.

The Bottom Line

llms have their place in legal work if done right!

A local LLM can be a useful addition to a lawyer's technology toolkit. It can support offline brainstorming, editing, plain-language explanation, and internal workflow development while reducing routine reliance on cloud AI processing.

But privacy is not a marketing label. It is a system of facts: the app, the model, permissions, integrations, phone security, backups, firm policy, and the way you use the tool—including a clear-eyed understanding of whether your inputs are ever used to train or fine-tune anything. Start with sanitized information. Verify vendor claims against the actual privacy policy and app-store data-safety disclosures, not just the marketing copy. Secure the device. Validate every legal proposition. Then let the technology help you work more efficiently—without compromising the professional duties that define the practice of law. ⚖️📱

MTC: When Your Phone's "Self-Destruct" Button Becomes a Federal Crime: Duress Passwords, Spoliation & the Duty to Preserve ⚖️📱

lawyers should know the interplay among Duress Passcodes, Border Searches, and Smartphone Evidence Destruction

The Justice Department just indicted an Atlanta man for handing border agents a "duress passcode" that wiped his phone during a secondary inspection. It's believed to be the first prosecution of its kind — and it should put every lawyer (and every client with a smartphone) on notice. 🔔

"Duress passwords" — sometimes called "panic codes" or "coercion PINs" — are a real feature in iOS, Android, and third-party privacy apps. Enter one code and the device unlocks normally. Enter the duress code and the phone quietly obliterates its encryption keys, rendering the data unrecoverable. For journalists, activists, and anyone crossing borders with sensitive material, they're a shield. For prosecutors, they look like a loaded gun pointed at the evidence locker. 🔫💾

Here's where the professional-responsibility rubber meets the road. ABA Model Rule 3.4(a) makes it professional misconduct to "unlawfully obstruct another party's access to evidence or unlawfully alter, destroy or conceal a document or other material having potential evidentiary value." Comment 2 to Rule 3.4 clarifies that the duty attaches when a lawyer knows or reasonably should know that litigation is pending or reasonably foreseeable. A border inspection of a device you know contains responsive data? That's reasonably foreseeable. 📋

lawyers need to know the ABA Ethics Rules for Lawyers Protecting Digital Client Data!

But Rule 1.15 (Safekeeping Property) and Rule 1.6 (Confidentiality) also impose affirmative duties to protect client data. A lawyer who carries privileged communications across a border has a genuine tension: the duty to preserve vs. the duty to safeguard. The duress password sits exactly on that fault line. If you trigger it before a preservation obligation attaches — say, because your phone is stolen — it's property protection. If you trigger it after a subpoena, a litigation hold, or a border detention you knew was coming, it's spoliation. 🧨

The line isn't always bright. Good-faith accident — dropping your phone in coffee, a toddler factory-resetting your iPad — is not a crime. But intent is inferred from circumstances: Did you enable the duress feature after learning of the investigation? Did you select the code specifically for the border crossing? Did you fail to issue a litigation hold to yourself? Courts draw adverse inferences from all three. 📉

Practical takeaways for your practice:

1.      Audit your own devices now. If you use a duress feature, document why and when you enabled it — before any matter makes it suspect. 📝

2.     Issue written preservation notices to yourself the moment litigation is reasonably foreseeable.

3.     Advise clients in writing about duress features before they travel. A client who wipes a phone at the border because you never mentioned the risk creates a Rule 1.1 (Competence) and Rule 1.4 (Communication) problem for you. ✉️

4.     Use encrypted cloud backups with immutable retention (“WORM” [Write Once, Read Many] storage) so a local wipe doesn't equal total loss. That's preservation and property protection. ☁️🔒

what are the four takeaways lawyers should know when it comes to protecting client data at the boarder!

The Atlanta case will test whether providing a duress code to law enforcement is "destruction" under 18 U.S.C. § 1519 or the Federal Rules' spoliation doctrine. But you don't need the verdict to know your ethical north star: preservation obligations attach when you know — or should know — the data matters. The duress code doesn't suspend that duty; it just makes the violation faster and harder to detect. ⚡

Stay tech-savvy. Stay ethical. And maybe keep a spare phone in the carry-on or use a different phone specifically for travel. 🧳📱

MTC*

* Please remember this is an editorial not legal advice nor create an attorney-client relationship. You should contact an attorney for legal advice about your situation should the need arise.

🚨 BOLO: Apple's Emergency Mac Patch Closes a Screen Sharing Backdoor — Lawyers Update Now!

your apple computer may need an update right now!

Here's a security bug that has nothing to do with your caseload and everything to do with your law license. On August 6, 2026, Apple pushed an unusual, single-purpose emergency patch after security researchers discovered that Screen Sharing on the Mac could be tricked into granting full desktop access without a valid password. If you use a Mac to store client files, draft privileged communications, or manage your practice, this is a “Be On the Look Out” moment, and I mean that literally.

What Actually Happened

update your mac and windows os today and keep an eye out for new updates - they are more frequent than you think!!!

Apple's advisory describes the flaw in characteristically understated terms: "An attacker on the network may be able to authenticate to Screen Sharing without valid credentials". Translated out of engineer-speak, a bug in how macOS tracked login attempts meant the system could be fooled into treating an unauthenticated session as verified. Security firm Huntress went further, explaining that the bug exploited the Screen Sharing service's implementation of Secure Remote Password, which "ultimately allows pre-authenticated remote code execution on all supported macOS versions". In plain English: someone on your network, whether that's your building's shared Wi-Fi, a co-working space router, or a compromised office LAN, could potentially run code on your Mac without ever knowing your password. That's not a nuisance bug. That's the kind of hole that keeps ethics counsel up at night.

The flaw has an official tracking number, CVE-2026-65400, which is just a standardized ID security researchers use to reference a specific vulnerability across advisories and news coverage — think of it like a case citation for bugs 📋. It reaches across three generations of macOS: Tahoe, Sequoia, and Sonoma. Apple fixed it with macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 all released the same day, an unusual move that signals Apple treated this as serious enough to skip its normal beta-testing cycle.

Why This Matters for Your Practice

your ethical duty of technological competence doesn't pause because a vulnerability sounds technical!

I've said it before on here and on the podcast, and I'll say it again: your ethical duty of technological competence doesn't pause because a vulnerability sounds technical. ABA Model Rule 1.1, Comment 8, requires lawyers to "keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology" 📚. A screen-sharing bypass that hands an attacker the same control as someone physically at your keyboard is exactly the kind of risk that comment contemplates.

Model Rule 1.6 compounds the stakes. If Screen Sharing was enabled on a Mac holding client files, an attacker exploiting this flaw before the patch could have accessed privileged communications, case strategy, or financial data without leaving an obvious trace 🔐. That's a confidentiality problem regardless of whether you can prove exploitation occurred. And if you're a firm supervising associates or staff under Rule 5.1 or 5.3, this is also a moment to confirm every managed device across your practice, not just your own laptop, has been patched.

The silver lining: Apple has stated there's no evidence this bug was exploited in the wild before the fix shipped, and Screen Sharing is off by default on most Macs. But "off by default" isn't the same as "off on your machine," especially if you or an IT vendor ever turned it on for remote support.

How to Check and Patch Your Mac

This is a five-minute task, and it should not wait until end of day. ⏱️

1. Click the Apple menu → System Settings

2. Select General → Software Update

3. Install whichever applies: macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9

If your firm manages devices through IT and you can't update immediately, disable the feature entirely: Apple menu → System Settings → General → Sharing, then toggle Screen Sharing off. Note that Huntress specifically warns this is a pre-authentication bug, so the usual hardening tricks (removing user accounts, disabling legacy VNC passwords) won't protect you; only the patch or fully disabling the feature will.

The Bigger Pattern Worth Watching

A good rule of thumb is to keep your software os and programs up to date!

This isn't the first time Apple has issued an emergency patch outside its normal cadence, and it won't be the last. Solo and small firms need a patching routine, not just reactive fixes.

The takeaway is simple, even if the underlying vulnerability wasn’t: Almost always, keep your software up to date!  Update your Mac today, verify Screen Sharing's status even if you don't think you use it, and treat this as a reminder that competence under Rule 1.1 is an ongoing obligation, not a box you check once. 🛡️

Follow The Tech-Savvy Lawyer.Page for updates and alerts!

MTC: Judges Will Be Hunting These AI Tricks After Brazil’s Scandal

it is hard to believe that judges will be happy if lawyer insert “code” into their online filings!

Recently, Brazilian court officials uncovered something that should make every tech‑savvy lawyer sit up straight. In a labor court, staff discovered a filing that looked ordinary to the human eye—until they examined it more closely. Hidden in the document was text written in white font on a white background, invisible to anyone casually reading the PDF but fully legible to the court’s AI system.

That invisible text was not a typo. It was an instruction—what technologists call a “prompt injection”—telling the court’s AI software to review the case only superficially and not to challenge the evidence submitted. In other words, the filing was designed to trick the judiciary’s own AI tools into rubber‑stamping a favorable outcome by smuggling in commands that humans would never see.

Fortunately, court staff caught the scheme before it affected the proceedings. But Brazilian authorities immediately recognized the incident as a new species of digital fraud and began discussing safeguards: automatic detection of invisible text, formatting checks before AI processing, and stronger human oversight at every stage. They also raised the prospect of stricter ethics rules and sanctions for lawyers who try to manipulate court AI systems.

For our purposes, the Brazil case does three important things:

1. It confirms that AI now sits inside judicial workflows—not just law firm workflows.

2. It shows that some lawyers will try to game those systems if they think they can get away with it.

3. It gives us a concrete example of what not to do and what to watch for as courts in the U.S. and elsewhere adopt similar tools.

From an ABA perspective, a “white‑text prompt injection” is not clever lawyering—it’s a direct collision with Model Rule 3.3 (candor toward the tribunal) and Model Rule 8.4(c)’s prohibition on conduct involving dishonesty, fraud, deceit, or misrepresentation. And because the Brazil incident exploits the very AI tools that the judiciary is using, it also implicates Model Rule 1.1 and Comment 8: the duty of technology competence now includes understanding how these systems can be abused.

So let’s unpack what we should learn from Brazil—starting with what not to do.

What Not To Do: Hidden Instructions and “Clever” Hacks

The Brazil case is a textbook on the wrong way to think about AI in litigation.

• Do not embed hidden commands in filings (through white‑on‑white text, metadata, or other tricks) with the intent to influence how a court’s AI tools process your case.

• Do not treat court‑side AI as just another system to be “SEO‑optimized” or hacked. Unlike a marketing algorithm, this is part of the machinery of justice; trying to tilt it in your favor crosses a bright ethical line.

• Do not assume that “if the judge doesn’t see it, it doesn’t count.” Malicious prompts aimed at judicial AI are still part of your submission to the tribunal, and they reflect directly on your candor and honesty under Model Rules 3.3 and 8.4.

In short: if you would never say it to the judge in plain black‑and‑white text, you should not whisper it to the court’s AI in invisible text.

What To Watch For: How to Recognize This Behavior

lawyers need to be prepared to vet opposing counsel’s filings for ai injection!

The harder question is how you, as a solo or small‑firm lawyer, can spot similar tactics when others use them—especially when you don’t control the court’s systems.

Here are practical signals and questions:

• Suspicious formatting in PDFs or Word files. Odd spacing, unexpected blank pages, or inconsistent fonts can sometimes signal hidden layers of text. While you won’t always spot white‑on‑white content, unusual formatting should prompt closer inspection.

• Metadata anomalies. If you routinely examine document properties, look for multiple authors, unusual editing histories, or automation tags that do not match the face of the document. These can indicate heavy automated processing or embedded instructions.

• Patterns in AI‑mediated decisions. If certain filings—often from the same party—seem to sail through automated queues or receive unusually favorable, boilerplate orders, you may be seeing the downstream effect of prompt manipulation or aggressive “AI‑targeted” drafting.

Because you usually won’t have direct access to the court’s internal AI, you may need to raise these concerns procedurally: requesting clarification on how filings are screened, asking whether AI systems were involved in certain steps, or moving for relief if you believe your client’s matter was prejudiced by automated processing.

How To Protect Yourself and Your Clients:

Brazil’s experience is a warning shot—not just about bad actors, but about what a healthy response should look like.

Here’s how to translate that into a practical “do this, not that” playbook for your own practice:

1. Assume courts will adopt AI—and plan for it:

Brazil’s judiciary uses AI to prioritize cases, draft reports, and propose decisions in response to massive backlogs. U.S. courts are already experimenting with similar tools, even if not as publicly. Competence under Model Rule 1.1 now includes staying informed about these trends and understanding their implications.

2.     Build “AI integrity” into your litigation strategy.

• Treat any automated system that touches your filings—court e‑filing portals, online forms, AI‑assisted triage tools—as part of the tribunal.

• Resolve that you will never include hidden instructions, misleading metadata, or manipulative formatting in documents submitted to those systems.

3.     Advocate for transparent safeguards.

• In Brazil, authorities responded by exploring automatic detection of invisible text and stronger human oversight.

• When U.S. courts announce AI pilots or tools, comment on proposed rules, advocate for clear notice when AI is used, and request mechanisms for lawyers to challenge AI‑influenced outcomes.

4.     Document your own good‑faith use of AI.

it may be deemed a “fruad upon the court” if a lawyer injects ai into their electronic filings.

• If you rely on AI to format or generate parts of your filings, keep internal records of prompts, outputs, and human review.

• This documentation will help if a court or disciplinary body later asks how you ensured candor and accuracy, especially in a world where Brazil‑style abuses are making judges more skeptical.

Final Thoughts

AI isn’t just something we use; it’s now part of the institutional environment—just like e‑filing, CM/ECF, or digital signatures. The line between legitimate technology use and unethical manipulation is not about whether you use AI, but how you use it and whether you’re honest about it.

MTC

MTC: ChatGPT, Work Product, and Waiver: New Lessons from Tate Group Automotive ⚖️🤖

Tech‑savvy lawyerS need to be able to defend ChatGPT work product before Texas Business Court.

On June 3, 2026, the Business Court of Texas issued a minute entry in Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC that every tech‑curious lawyer should know about. As of today, this is one of the first reported decisions to tackle whether a non‑lawyer’s ChatGPT conversations are protected attorney work product and, if so, whether using a public AI tool waives that protection.

The court’s answer is nuanced but important: generative AI does not automatically destroy work‑product protection, at least where the disclosure is not made to an adversary under Texas Rule of Civil Procedure 192.5(a)(1). For solos and small firms experimenting with AI tools, this is both reassuring and sobering.

What Happened in Tate Group Automotive?

The case arises from a dispute in the Texas Business Court’s Eleventh Division, in which Tate Group Automotive sued Legacy Automotive Capital, The Reynolds and Reynolds Company, and individual defendants. During discovery, the plaintiff withheld “Kris Tate–ChatGPT conversations” on the basis of attorney work‑product protection and submitted them to the court for in camera review.

Defendants challenged that claim. They argued that attorney work‑product protection does not extend to a non‑lawyer’s chats with an AI tool, or alternatively, that any protection was waived when Kris Tate used ChatGPT. They also asked the court to order the plaintiff to identify all discovery materials Mr. Tate or Tate Group had shared with ChatGPT.

Judge Grant Dorfman acknowledged that the issue was “novel,” noting that all case law cited by the parties dated from 2026 and that at least one opinion called the question “a first impression nationwide.” Against that backdrop, he evaluated the ChatGPT conversations under Texas Rule of Civil Procedure 192.5(a)(1), which defines work product and addresses waiver.

The key takeaway from the minute entry—based on the Minerva summary—is that the court concluded a non‑lawyer’s chats with ChatGPT did not automatically waive work‑product protection because the disclosure was not made to an adversary. That is a narrow holding, but it marks a significant moment in the emerging law of AI and privilege.

Why This Ruling Matters for Lawyers Using AI

At first glance, Tate Group may look like a niche discovery dispute. In reality, it answers a question many lawyers have quietly asked: “If my client uses ChatGPT, have we blown work product?”

The court’s answer is “not necessarily.” By focusing on whether the disclosure was made to an adversary, Judge Dorfman signaled that the waiver analysis for AI platforms should track the familiar contours of work‑product doctrine, at least in Texas. That gives practitioners a framework instead of a panic button.

At the same time, this is a minute entry in a specific context—not a blanket blessing for all AI use. The court still treated the issue as novel, still conducted in camera review, and still scrutinized how the AI tool was used. For lawyers, that means AI usage is now part of the discovery and privilege landscape, and courts will expect thoughtful, documented positions—not hand‑waving about “just using a tool.”

From an ABA perspective, this aligns with Model Rule 1.1 and Comment 8: competence now includes understanding the “benefits and risks associated with relevant technology,” including how generative AI intersects with privilege and work product. Model Rule 1.6 (confidentiality) and Rules 5.1/5.3 (supervision of lawyers and non‑lawyers) also come into play when clients or staff use tools like ChatGPT in ways that touch litigation strategy.

Lesson 1: Treat Client AI Use as Discoverable Reality, Not a Side Note

One of the most striking aspects of Tate Group is procedural: the court required in camera review of the ChatGPT conversations and entertained requests that plaintiff identify all discovery materials shared with ChatGPT. That tells us courts are prepared to treat AI interactions as real, reviewable artifacts in discovery.

If your clients or internal teams use AI to draft, summarize, or analyze case materials, those interactions can become part of the discovery conversation, just as drafts, notes, and emails have always been. Under Model Rules 1.1 and 1.6, you cannot stay competent or protect confidentiality if you do not know whether and how AI is being used on your matters.

Practically, that means:

• Ask clients early whether they have used tools like ChatGPT or other AI services to “get help” on their case.

• Document the scope and purpose of any AI use, especially if it involves draft pleadings, strategy, or privileged communications.

• Be prepared to defend or adjust your privilege and work‑product positions in light of those uses, as plaintiff did in Tate Group by asserting work‑product and submitting chats for in camera review.

Lesson 2: Public AI Platforms Are Not Automatic Waiver Machines

Solo attorneys need to protect their privileged work product from risky AI tools.

Defendants in Tate Group argued that a non‑lawyer’s chats with an AI tool either are not work product at all or, at minimum, effect a waiver. The court rejected the idea that simply using ChatGPT automatically destroys protection under Texas Rule 192.5(a)(1) when there is no disclosure to an adversary.

That matters, because there has been a real fear—sometimes stoked by vendors—that “if anyone touches ChatGPT, all privilege is gone.” This ruling shows courts can adopt a more nuanced view, at least under a work‑product framework.

For ABA‑Model‑Rules lawyers, this should not be read as a free pass. Model Rule 1.6 still requires reasonable efforts to prevent unauthorized disclosure of client information, and using a public AI platform can create confidentiality risk even if work product is technically preserved. But Tate Group suggests that waiver analysis will still look to core principles like whether disclosure reached an adversary.

In practice:

• You should not assume that any AI use destroys work product, but you should be ready to explain why your use did not involve disclosure to an adversary or the public.

• Engagement letters and internal policies should clarify whether and how you will use AI tools and what safeguards you apply, consistent with Model Rules 1.1, 1.4, and 1.6.

Lesson 3: In Camera Review Will Become Common for AI Disputes

The court’s process—ordering in camera review of the ChatGPT conversations before ruling—signals a likely pattern for AI‑related privilege disputes. Judges will want to see how AI was used, not just hear generalities, before deciding whether protection applies or has been waived.

That has three implications for practicing lawyers:

• You should assume that AI‑related materials can be reviewed by courts under appropriate safeguards.

• You need internal workflows to collect and present those materials when necessary without scrambling through chat histories.

• You should approach AI use with the expectation that a judge, someday, may read the raw prompts and outputs and ask whether your supervision met the standards of Model Rules 5.1 and 5.3.

This is a shift from treating AI as a “black box” helper to treating it as a discoverable component of your litigation process.

Lesson 4: Non‑Lawyers and AI Need Clear Supervision

In Tate Group, the conversations at issue were between Kris Tate—a non‑lawyer—and ChatGPT, yet they were withheld under an attorney work‑product theory. The court’s willingness to consider work‑product protection in that context underscores a point many of us have made: non‑lawyers can participate in the creation of protected material if they are acting at the direction of counsel.

But it also heightens the importance of supervision. Model Rule 5.3 requires lawyers to ensure that non‑lawyer assistants’ conduct is compatible with the lawyer’s professional obligations. When non‑lawyers use AI tools on client matters, they are effectively acting as an extension of the legal team.

Practical steps include:

• Training non‑lawyers on what they may and may not share with AI platforms.

• Setting clear rules about which tools are approved, for what purposes, and under whose supervision.

• Reviewing AI outputs and underlying prompts when they feed into litigation strategy, to ensure accuracy and compliance with Model Rules 3.3 and 4.1.

As we have discussed in episodes of The Tech‑Savvy Lawyer podcast, AI is not just a “lawyer tool”; it is often a staff and client tool. Your ethical obligations follow it wherever it goes. 💼🤖

Lesson 5: This Is Only the Beginning—But You Can Prepare

Texas judges along with others will be weighing ChatGPT privilege and waiver in generative AI era.

Judge Dorfman noted that all the case law cited by the parties dated from 2026 and that one authority called its ruling a “question of first impression nationwide.” That means we are at the very start of AI‑and‑privilege jurisprudence, not the end.

Every new decision—whether from Texas Business Courts or elsewhere—will refine the analysis. Some may take a stricter view of waiver for public AI tools; others may distinguish between work product and attorney‑client privilege. Regardless, Model Rule 1.1’s technology‑competence requirement demands that we follow these developments and integrate them into our practice.

You do not need to become an AI engineer, but you do need a plan:

• Inventory where AI is used in your matters (by you, your staff, your clients).

• Align that usage with your duties of competence, confidentiality, and supervision.

• Be prepared for in camera review of AI‑related materials, as in Tate Group.

• Update your engagement letters and internal policies to reflect reality, not wishful thinking.

If you approach AI as you approached email, e‑filing, and cloud storage when they were “new,” you will be ahead of many peers—and aligned with the spirit of both the ABA Model Rules and emerging case law.

MTC

MTC: Law School, Laptops, and AI: Why Banning Computers Misses the Point!

Law schools are throwing out the baby with the bathwater by banning laptops from the classroom as an effort to combat improper ai use.

On July 10, 2026, the conversation around artificial intelligence in legal education reached a new level. Reports of universities banning both AI tools and laptops in classrooms reflect a growing anxiety: how do we preserve critical thinking in an age of automation? ⚖️

It is a fair question. It is also the wrong solution.

Let me be clear at the outset. A first-year ban on AI tools makes sense. A blanket ban on laptops does not.

The Case for Limiting AI—At First

Legal education has always been about building judgment. That means learning how to analyze facts, synthesize doctrine, and construct arguments from scratch. AI short-circuits that process if used too early.

Under ABA Model Rule 1.1 (Competence), lawyers must provide knowledgeable and skilled representation. That competence begins in law school. If students rely on AI before they understand the law themselves, they risk becoming operators instead of thinkers.

As I have noted in prior discussions on legal technology, AI should augment—not replace—legal reasoning.

So yes, a structured limitation on AI during the first year is defensible. It creates a foundation. It forces students to wrestle with ambiguity. It builds intellectual muscle. 💡

But Banning Laptops? That Is an Overreach

This is where the policy breaks down.

When I entered law school then graduated in 2002, laptops were just beginning to appear in classrooms. They were not universal. They were not always welcome.

For me, the laptop was not a distraction. It was essential.

My handwriting was and sadly still is poor. My ability to type, organize notes, and revise quickly made the difference between struggling and succeeding. My laptop was not a shortcut. It was an accessibility tool before we used that term widely.

Fast forward to today. Students are typing far more than they write. Many have never learned cursive. Their academic workflows are digital from the start.

To remove laptops is not to level the playing field. It is to shift it—often unfairly.

The Practical Reality of Modern Learning

Legal education does not exist in a vacuum. Law practice is digital.

Law students who learned on laptops will be disadvantaged if classrooms suddenly ban them.

Under ABA Model Rule 1.1, Comment 8, lawyers must understand the benefits and risks of technology. That obligation does not begin after graduation. It begins in law school.

Students today must learn:

• How to organize digital research

• How to draft and revise efficiently

• How to manage documents and workflows

• How to integrate technology into legal reasoning

You cannot teach modern legal competence while removing the primary tools of modern legal work. 🖥️

A laptop is not the problem. Misuse is.

The Enforcement Problem No One Is Talking About

There is also a practical issue. Banning AI is difficult to enforce. Banning laptops is easy.

That does not make it the right policy.

If anything, banning laptops is a workaround for the harder problem of AI enforcement. It is a policy by convenience.

And it raises a deeper concern under ABA Model Rule 5.3 (Responsibilities Regarding Nonlawyer Assistance), which increasingly applies to AI tools. Lawyers—and future lawyers—must learn to supervise and evaluate AI outputs.

You cannot teach supervision by eliminating exposure.

A Better Approach: Controlled Access, Not Prohibition

Law schools should be experimenting with smarter controls instead of blunt bans.

Some possibilities include:

• Disabling Wi-Fi and cellular signals in certain classrooms 📶

• Using locked-down exam or classroom software environments

• Creating AI-permitted and AI-prohibited assignments with clear boundaries

• Requiring disclosure of AI use in coursework

• Teaching prompt engineering and AI verification as part of the curriculum

This approach aligns with ABA Model Rule 1.6 (Confidentiality) as well. Students must learn what data can and cannot be shared with AI systems.

Exposure with guardrails is more effective than prohibition. That principle applies directly to how law schools should approach AI.

Critical Thinking and Technology Are Not Opposites

There is a persistent myth underlying these bans: that technology erodes thinking.

That is not inherently true.

Technology can weaken thinking if it replaces effort. It can strengthen thinking if it supports it.

A student who uses a laptop to organize case law, annotate notes, and refine arguments is not thinking less. They are thinking differently—and often more effectively.

The same will eventually be true of AI.

The goal is not to create lawyers who avoid technology or who think less by using AI. It is to create lawyers who use it wisely. ⚖️

What Law Schools Should Be Teaching Instead

If I were designing a first-year curriculum today, I would include:

THE MODERN LAWYER NEEDS TO KNOW HOW TO BALANCE JUDGMENT WITH AI USE IN THEIR WORK!

• A temporary restriction on AI-generated work

• Mandatory instruction on how AI tools function

• Exercises in verifying AI outputs against primary sources

• Training on ethical risks, including hallucinations and confidentiality

• Continued use of laptops as standard tools

This approach respects both sides of the equation: foundational thinking and technological competence.

Final Thought: Do Not Solve the Wrong Problem

Law schools are right to be concerned. AI is reshaping the profession at a rapid pace.

But banning laptops is not a solution. It is a signal of discomfort.

The better path is harder. It requires nuance. It requires experimentation. It requires trust in students, guided by structure.

Most importantly, it requires recognizing that the future lawyer will not choose between thinking and technology.

They will need both.

And law school is exactly where they should learn how to do that. 🚀