As law firms rapidly integrate generative AI into their workflows, the standard "boilerplate" engagement letter is no longer sufficient. For general counsel, the risk is no longer theoretical; it is a matter of data sovereignty, professional negligence, and billing transparency. Relying on a firm's general privacy policy is a mistake, as those policies often grant the firm broad discretion to update terms unilaterally.
To protect the organization, GCs must move from passive acceptance to active requirement. The following framework outlines the specific clauses required to manage the risks of AI-assisted legal work, including negotiation fallbacks for when firms push back.
1. Tool Disclosure and Transparency
You cannot manage risk if you do not know which tools are being used. A blanket statement that the firm "uses technology to improve efficiency" is inadequate. You require a positive obligation for the firm to disclose the specific AI tools being applied to your matters.
What to require
- Specific Tool Listing: A requirement that the firm maintain a list of AI tools used for client work, categorized by function (e.g., legal research, document drafting, due diligence).
- Notification of Change: A clause requiring the firm to notify the client before deploying a new AI tool that processes client-provided data.
Negotiation fallbacks
If the firm resists a full list citing proprietary workflows, agree to a categorical disclosure. Instead of naming the specific software, they must disclose the type of tool (e.g., "Closed-loop LLM for document review") and provide the tool's own data privacy whitepaper upon request.
2. Confidentiality and Data Training
The primary risk with LLMs is "data leakage," where client secrets become part of the model's training set and are subsequently surfaced to other users. You must ensure a hard wall exists between your data and the AI's learning mechanism.
What to require
- No-Training Guarantee: Explicit language stating that no client-provided data, work product, or communications shall be used to train, tune, or improve any AI model—whether proprietary to the firm or provided by a third party.
- Zero-Retention Requirements: For high-sensitivity matters, require that the firm use "zero-retention" APIs where the provider does not store the prompt or output after the session ends.
Negotiation fallbacks
If a firm claims their tool is "enterprise grade" and therefore safe, require them to warrant that they have a signed Data Processing Agreement (DPA) with the AI vendor that explicitly prohibits training on customer data. The warranty should be backed by the firm's professional liability insurance.
3. Human Review and Accountability
AI "hallucinations" can lead to fraudulent citations or incorrect legal conclusions. The engagement letter must codify that AI is a tool for efficiency, not a replacement for professional judgment.
What to require
- Mandatory Human-in-the-Loop: A clause stating that all AI-generated output must be reviewed, verified, and edited by a qualified attorney before being delivered to the client or filed with a court.
- Certification of Review: For high-stakes deliverables, the right to request a certification that the work product was human-verified.
Negotiation fallbacks
Firms may argue this is already covered by the "standard of care." Counter this by specifying that reliance on AI output without verification constitutes a breach of the engagement terms, regardless of whether it meets the general professional standard of care.
4. Billing Treatment for AI-Assisted Work
The "billable hour" is fundamentally at odds with AI efficiency. If a task that previously took ten hours now takes ten minutes, the client should capture that value, not pay for "manual" time that was never spent.
What to require
- Prohibition of "AI-Hours": A rule that the firm cannot bill for the time spent by an AI tool. Only the human attorney's time for prompt engineering and verification is billable.
- Efficiency Adjustments: A requirement that the firm proactively reduce the estimated hours for tasks known to be AI-accelerated (e.g., first-pass document review).
- Transparency in Invoicing: A requirement to flag AI-assisted tasks on the invoice so the GC can track the actual efficiency gains.
Negotiation fallbacks
If the firm insists on charging a "technology fee" to cover the cost of expensive AI licenses, agree to it only if it is a flat, transparent monthly fee rather than a hidden markup on hourly rates.
5. Audit and Termination Rights
Trust but verify. You need a mechanism to ensure the firm is adhering to the AI restrictions agreed upon in the engagement letter.
What to require
- Right to Audit: The right to request a summary of the AI tools used on a specific matter and a confirmation that no data was used for training.
- Immediate Termination for Data Breach: An express right to terminate the engagement immediately, without the usual cure period, if the firm admits or is found to have fed client data into a public AI model.
Negotiation fallbacks
If a full audit is deemed too burdensome, agree to an annual AI compliance attestation signed by the firm's Managing Partner or Chief Technology Officer.
Put it into practice
To implement these changes this week, start by reviewing your current "standard" engagement letter. Identify where the confidentiality section is silent on "automated processing" or "machine learning." Create a one-page "AI Addendum" containing the five pillars above and send it to your primary outside counsel as a required update to your vendor onboarding process.
When negotiating, frame these requirements as a risk management necessity for your internal compliance and insurance obligations, rather than a lack of trust in the firm's competence. This shifts the conversation from "do you trust us?" to "we must satisfy our corporate governance."
Put it into practice
The Engagement-Letter Templates from LawWarden collects the templates and checklists behind this guide in ready-to-use form, so your team can apply the framework without drafting from scratch.