Citations that look real and are not.
AI can invent cases, quotations and holdings, and it formats them exactly like the real citations around them. A lawyer who files one has made a false statement to the court, whoever typed it.
AI GOVERNANCE FOR LAW FIRMS
Your lawyers already use AI. You answer for how they use it.
Every law firm needs an AI governance program. NIRAP gives you the standards, tools, and verification to roll out an AI governance program in as little as one week.
The Legal Bundle
Toolkit + plus Training + plus Verification
- Your own people
- Self-paced sessions
- No consultants
From a standards body with no stake in the AI tools it assesses. Built on NIST AI RMF, ISO/IEC 42001, and ABA Formal Opinion 512.
Built for firms that license AI tools, not companies that build them.
01ToolkitNine guided sessions
02TrainingAI Governance 101
03VerificationRAICB trust badge
WHY THIS MATTERS NOW
Why every law firm needs an AI governance program
Most firms are already partway through AI adoption. Here is how that journey tends to go when there are no rules, and where a governance program changes the ending.
The promise and the new riskAI can be great. It also introduces new risk.
AI tools draft briefs, summarize discovery and answer client email in minutes. That speed is real, and so are the risks that come with it. None of these risks need a new AI law to reach your firm, because the rules of professional conduct already apply to AI-assisted work.
Client information sent where it should not go.
Client facts pasted into a consumer AI tool can end up on a vendor’s servers, under terms that may let the vendor keep or use them. The duty of confidentiality does not pause because the tool was convenient.
A tool that agrees with whoever is asking.
AI tends to tell people what they want to hear. A lawyer who asks it to support a reading of a clause or the strength of a claim gets agreement, not a second opinion, and may then advise a client with confidence it has not earned.
Contracts written to protect the vendor.
AI vendor terms typically disclaim responsibility for accuracy and cap the vendor’s liability at what you paid. Some also claim the right to use what you type to improve their products. When the tool is wrong, the terms put the risk back on the firm.
Where the risk hidesWhere the risk hides in your firm.
The risk rarely comes from one bad decision. It comes from gaps that nobody owns.
Who sets the standard
The standard already exists, and it was written for lawyers.
ABA Formal Opinion 512 applies the duties your lawyers already owe, from competence and confidentiality to candor and supervision, to generative AI. State bars have added their own guidance, including Texas Opinion 705, and California has now written rules into statute. Corporate clients add another layer through the AI terms in their outside counsel guidelines. After an incident, a court, a disciplinary authority or a client could reasonably treat these as the measure of what the firm should have done. A firm that has not addressed them is exposed.
Shadow AI
Lawyers and staff use personal accounts, free apps, and AI features that switched on inside research and practice software the firm already pays for. You cannot supervise tools you do not know about.
What fixes it
AI Tool Inventory
Lawyers acting without rules
Without a written policy, each lawyer decides alone what AI may draft, what client information it may see, and whether anyone checks the result before it is filed.
What fixes it
Firm AI PolicyWork Review Standard
No training on risk and liability
Most lawyers and staff learned AI by trying it. Few know how it fails, or that the firm answers for what they file and send.
What fixes it
AI Governance 101AI Training Record
Vendor terms nobody read
Someone clicked “I agree.” Nobody checked who owns the output, where client data goes, or who pays when the tool is wrong.
What fixes it
AI Tool Checklist
Client rules nobody tracked
A client’s outside counsel guidelines restrict AI on its matters, and the associate staffed on the matter has never read them.
What fixes it
Client AI Restrictions RegisterClient rule sheets
Billing nobody decided
Nobody has decided how to bill for time a tool saved, or whether the client pays for the tool itself. Each lawyer answers the question differently on each invoice.
What fixes it
AI Billing Policy
The duty you already haveThe most compelling reason is the duty you already have.
The case for a governance program does not rest on a future lawsuit. It rests on duties your lawyers owe today. Model Rules 5.1 and 5.3 require partners and supervising lawyers to make reasonable efforts to ensure that the lawyers and staff they supervise follow the rules. AI does not create an exception to those duties, and it does not move them to the software vendor.
What the ABA and the state bars have said
ABA Formal Opinion 512 applies the rules lawyers already follow to generative AI. When an AI tool gets something wrong, responsibility rests with the lawyer and the firm, not the technology provider.
- Opinion 512 works through the duties of competence, confidentiality, client communication, reasonable fees, candor to the court, and supervision.
- State bars have issued their own guidance, including Texas Opinion 705. California’s Senate Bill 574, in force January 1, 2027, requires the responsible lawyer to personally verify every citation filed in a California court.
- “The AI wrote it” is not a defense. A lawyer who signs a filing answers for every word in it.
One AI-assisted filing is enough.
You do not need a malpractice suit for this to matter. A single AI-assisted brief or client memo can lead to a show cause order, a grievance or a lost client when it does any of these three things.
A
Cites authority that does not exist
Invented cases, fabricated quotations, or pinpoint cites to pages that say something else.
B
Misstates what a court held
A real case, described as deciding something the court never decided.
C
Exposes client confidences
Client facts pasted into a public tool whose terms let the vendor keep them.
When that happens, the court, the bar and the client ask one question: What system did the firm have in place to prevent this?
A firm with a program
can point to a written AI policy, a required citation check, and documented training. That is evidence the supervision duty was taken seriously.
A firm without one
has nothing on paper, and looks like a firm that failed a supervision duty it already owed.
Why the pressure is growing
- Courts are writing their own rules. Many federal districts and individual judges now have standing orders on AI-assisted filings, and the rules differ from court to court.
- Clients are asking. Corporate clients increasingly put AI questions in outside counsel guidelines and panel questionnaires, and a firm without written answers starts behind.
- States are legislating. California’s SB 574 is a first-of-its-kind statute on lawyers’ use of generative AI, and each new rule makes “we did not know AI was being used that way” a weaker answer.
You already have a duty to supervise. AI is a new way for lawyers and staff to create old problems, such as false statements to a court and breaches of confidence, and the ABA has already said the lawyer is still responsible. A governance program is how you show you took that duty seriously before something goes wrong.
When something goes wrongWhen something goes wrong, can you respond?
Sooner or later, an AI mistake gets out. Opposing counsel flags a citation, or a client calls. What happens next depends on what you put in place before that day.
Without a programWith a program
Who finds out
The associate fixes it quietly, if anyone notices at all. You hear about it from opposing counsel or the court.
Lawyers and staff know to report an AI error, and they know who to report it to.
What you can show
There is no record of the tool, what it was given, or what it produced.
A dated incident log, and the originals your retention schedule told you to keep.
Who decides next
Whether to tell the client, the court or the malpractice carrier is decided on the spot, under pressure.
A written escalation card names who decides, and who tells the client, the court and the carrier.
The three questions you will be asked
- Did your firm have a rule for using AI?
- Did a lawyer check the work before it was filed or sent?
- What did the firm do when it found out?
A court, a disciplinary authority or a client will ask all three. Without documents, you have only your word.
What it costsWhat it costs.
The consequences land on the lawyer and the firm, not on the software vendor.
A filing error becomes a discipline question.
Courts that find AI-fabricated citations often refer the lawyers to their state bar. A referral turns one bad brief into a question about the lawyer’s fitness and the firm’s supervision.
The claim you assumed was covered may not be.
Some liability policies now exclude claims that arise from generative AI. Check your own professional liability policy before you need it.
A sanctions order is public.
Sanctions opinions are published, reported in the legal press, and found by every client and recruit who searches the firm’s name.
What courts have already done
$5,000Sanction on two lawyers and their firm in Mata v. Avianca, with letters ordered to each judge falsely named as an author
RemovedThree lawyers in Johnson v. Dunn were publicly reprimanded, removed from the case, and referred to the state bar
Not the firmThe same court did not sanction the firm, finding it had acted reasonably, with written AI rules that required approval and verification
A governance program changes how this story ends. Your people can have every document written in one week.
See the nine sessions
HOW TO IMPLEMENT YOURS
Nine sessions. One week. Then you roll it out.
The toolkit breaks the work into nine sessions. Each session is a guided tool your people complete inside the app, and each one ends with finished documents for your firm, so nobody is left holding homework. At the end of the week your program is written and ready to roll out to your lawyers and staff.
1
SESSION 1
Your organization
Describe the firm: its size, practice areas, where its lawyers are licensed and file, and who must approve the policy. Your answers decide which documents the firm needs.
Sets up every session that follows
2
SESSION 2
Build your AI tool inventory
List the AI tools the firm uses, check each vendor’s security and contract terms, and record the tools your clients use.
AI Tool InventoryAI Tool ChecklistAI Tools Clients Use
3
SESSION 3
Write your AI policy
Decide what AI may be used for, by which roles, and with what client information, including the personal AI tools people bring to work.
Firm AI PolicyLawyer and Staff PackAI Tools We AllowPersonal AI Tool Risk RegisterAI Policy Acknowledgment
4
SESSION 4
Set your client rules
Decide when the firm asks a client for consent, and record each client’s own AI restrictions from its outside counsel guidelines.
Engagement Letter AI ClauseClient Consent RecordClient AI Restrictions RegisterClient rule sheets
5
SESSION 5
Set your billing rules
Decide how the firm bills for time a tool saved, and whether it charges clients for the tool itself.
AI Billing Policy
6
SESSION 6
Set your review requirements
Define how a lawyer checks AI-assisted work before it is signed, filed, or sent to a client as advice.
Work Review StandardReviewer PackReview LogCourt Filing Check
7
SESSION 7
Set how long you keep records
Decide which AI records you keep and for how long, how you preserve them for a litigation hold, and who decides when something goes wrong.
Retention ScheduleEscalation CardAI Records Hold ProcedureIncident Log
8
SESSION 8
Roll out your plan
Plan training, sign-offs, and a recurring audit of AI use, so the program is used and not just filed.
AI Rollout PlanAI Oversight CalendarAI Oversight DelegationAI Training Record
9
SESSION 9
Request verification
Gather your documents into one package and send it to NIRAP. A person reviews it against the V-AGE standard.
Verification package
The toolkit produces up to 26 documents. Some are produced only when they apply to your firm: the Court Filing Check for firms that litigate, the client restriction documents for firms with institutional clients, AI Oversight Delegation for firms with more than one lawyer, and the Personal AI Tool Acknowledgment for firms that allow personal AI tools.
WRITTEN FOR HOW A LAW FIRM WORKS
Clients set their own rules.The toolkit compares each client’s AI rules with the firm policy and prints a rule sheet for every client whose rules are stricter.
Billing gets its own policy.Rule 1.5 and Opinion 512 address billing for time a tool saved. Session 5 turns the firm’s answer into a written policy.
Litigators get a filing check.Firms that file in court get a check that every cited source was opened and read before the filing went in.
Solo practitioners are included.One lawyer can hold every role, and the toolkit adjusts the review rule for a lawyer who has no second reviewer.
No consultants. No site visits.The guidance is built into the sessions, so you do not pay someone to explain it.
Your own people do the work.An administrator can run the sessions, and the lawyer who owns the policy approves the result. The app’s AI assistant drafts anything you are missing.
Go at your pace.Write the program in one week, or run one session a week and take nine.
THE LEGAL BUNDLE
Everything your firm needs, in one bundle.
Part 1 of 3
The Responsible AI Toolkit, Law Firm Edition
Nine working sessions. Up to 26 documents, written on the ABA Model Rules and Opinion 512, with Texas and California rules added where your lawyers practice.
A step-by-step guided tool walks your people through each decision.
The AI assistant drafts whatever the firm is missing.
Each session ends with finished documents.
Part 2 of 3
AI Governance 101, Legal Edition: one course for the whole firm.
Send the link. Everyone who uses AI takes it, and the firm gets a named record for its AI Training Record.
~1 hourof on-demand video, watched at each person’s own pace
Everyonepartners, associates, paralegals, assistants and contract lawyers
1 recorda named acknowledgment for each person, kept in the firm’s training record
In production. The Legal Edition is being made now and is included in the bundle when it is released. Until then, a firm may use its own AI training by sending NIRAP an outline.
Legal Edition · In production
Part 3 of 3
Verification and the RAICB™ badge
The badge means someone checked.
- 1The firm uploads the documents its toolkit produced.
- 2A NIRAP reviewer, a person and not software, checks them against the V-AGE standard.
- 3The firm earns a two-year badge it can show on its website, in client pitches, and in its answers to client AI questionnaires.
RAICB™ certification is a point-in-time attestation, not a guarantee of legal, ethical or regulatory compliance.
BUNDLE FEE
One fee, priced on how your firm is built.
Two things set the fee. The first is how many AI policies the firm needs. The toolkit produces one policy with its supporting documents, and a firm needs one for each state where it has an office, because the rules of professional conduct differ from state to state. A practice group that needs its own rules also takes its own policy. The second is how many lawyers the firm has, because every lawyer signs and sends work under the firm’s name. Paralegals and staff are not counted, because the lawyers are responsible for supervising them, and they take the training at no extra charge.
YOUR BUNDLE FEE
Starting at
$2,995
Fill in the fee calculator to see your firm’s exact price, with a line-by-line breakdown.
$0
Included in the bundle
- Toolkit. The Responsible AI Toolkit, Law Firm Edition, nine guided work sessions and up to 26 documents, for each policy your firm needs
- Training. AI Governance 101, Legal Edition, about an hour of video, for every lawyer and staff member who uses AI tools, when it is released
- Verification. RAICB verification for the firm, reviewed by a NIRAP assessor, and the trust badge for two years
ABOUT NIRAP
A standards body for firms that use AI, not firms that build it.
NIRAP, the National Institute for Responsible AI Practice, is a standards and certification body. We focus on professional services firms and individual professionals who license AI tools rather than build them. Most law firms fit that description.
Enterprise AI frameworks assume you have an engineering team. A law firm has partners, associates, paralegals, and staff. So we took the recognized frameworks and right-sized them for a firm like yours.
DRAWN FROM
NIST AI RMF
AI Risk Management Framework
ISO/IEC 42001
AI management systems
ABA Formal Opinion 512
Generative AI and the Model Rules
THE V-AGE STANDARD
Versatile Adaptive Governance Engine
More than 100 control practices, each rewritten for a firm that deploys AI tools. The app selects only the controls that apply to your firm’s actual uses of AI.
YOUR FIRM GETS
A program sized to your firm.
Not a 200-page enterprise binder.
OUR PHILOSOPHY
Governance, not brakes.
Most AI policies are written to say no. Ours are written so your lawyers can say yes safely. Adoption and governance should run side by side. You should not have to stop using AI to get it under control, and you should not have to accept unmanaged risk to keep using it.
The ABA has shown you what to do. NIRAP verifies you have done it.