Answer · Legal
What should an engagement letter say about AI?
Enough that the client could have refused. A general acknowledgement that technology is used is not consent to anything in particular.
Whatever the client would need in order to decide. Where confidences go into a tool, name the kind of tool, what it receives, what happens to it, and what the firm cannot control. Generic technology language consents to nothing.
The reason this lands in the engagement letter at all is that a tool receiving information relating to a representation is a disclosure, and disclosure needs the client's informed consent. That standard has a definition and it is about the client's understanding rather than the firm's paperwork: the client has to have been given adequate information about the material risks and the reasonably available alternatives. A sentence saying the firm uses modern technology fails that on every limb, because it tells the client nothing they could weigh.
The American Bar Association's Standing Committee on Ethics and Professional Responsibility made the point explicitly in Formal Opinion 512, issued in 2024: boilerplate consent in an engagement letter is not adequate where client confidences will be put into a generative tool. That is a stronger statement than it first appears, because boilerplate is the form almost every firm reached for, and it means the clause has to be about this firm's actual arrangement rather than about the category.
What makes the disclosure adequate is a small number of specifics. Which categories of matter information may go into a tool. Whether the tool is a hosted service or something running inside the firm. Whether the provider retains inputs, and for how long. Whether inputs are used to improve a model. Who else at the provider can see them. What the firm has contracted for and — the part usually left out — what it has not been able to contract for. A client can act on that. A client cannot act on an assurance that the firm takes confidentiality seriously.
Two other clauses belong in the same conversation and are separate decisions. The first is cost: if the firm intends to pass through a per-use or apportioned charge for an expensive tool, the client has to have agreed to that in advance and in terms specific enough to be an agreement. The second is scope: some clients, particularly institutional ones, have their own restrictions flowing from their own obligations, and the firm's letter has to be capable of being narrower for them without the whole precedent being rewritten.
The practical consequence is that the clause should be structured as a default the client can vary rather than as a term they accept. Firms that drafted it as an absolute permission discovered the awkward version of this conversation, which is a client who says no after the tooling decisions were made. A clause that names a default arrangement, offers an opt-out, and describes what changes if the client takes it, produces a conversation at the start rather than a problem in the middle.
Finally, the letter is not the whole obligation, and treating it as one is the common failure. Consent given at the start of a matter was given against the tools and terms that existed then. A materially different tool, a materially different data arrangement, or a change in what the provider does with inputs is a new fact the client agreed to nothing about, and the firm is the only party in a position to notice.
Consent is measured by what the client understood, which is why a clause nobody reads is evidence of drafting rather than evidence of agreement.
Siddharth Sharma, Context Theory
Related questions
Does every matter need this?
Only where information relating to the representation is going into the tool. A lawyer using a general-purpose model to draft a memo about a legal question, with no client facts in the prompt, has not disclosed anything and has no consent to obtain. The distinction is what the tool receives, not whether it was used, and it is the reason a firm should be able to say which of its uses involve client material at all.
What about a tool the firm hosts itself?
The confidentiality analysis changes but the consent question does not disappear. A self-hosted arrangement removes the third-party recipient, which is the largest single risk the disclosure exists to describe, and it may make consent straightforward rather than unnecessary. What remains is internal: whether lawyers on unrelated matters can retrieve the material, which is a real disclosure risk inside a firm and one clients do sometimes have views about.
METHOD
Every figure below carries its source and the date it was verified. Nothing on this page is asserted.
The numbers on this page.
| What | Value | Specific to |
|---|---|---|
| Attorneys & legal cost per lead | $131.63 | Category-wide |
| Realistic monthly lead-gen software spend | $1,500–$5,000 | Category-wide |
LocaliQ / WordStream Search Advertising Benchmarks 2026 · Google + Microsoft Ads, 20 industries · Apr 2025–Mar 2026 · highest of all tracked industries · verified
2026 real estate operating cost survey · plus $1,000–$8,000 variable · verified
What is specific to this page.
| Kind | Claim | Check it against |
|---|---|---|
| Constraint | Informed consent is assessed by what the client was given to decide with — adequate information about the material risks and the reasonably available alternatives — so a clause describing the firm's general use of technology cannot carry it however clearly it is drafted. | The definition of informed consent in Model Rule 1.0(e), applied to the actual wording of the firm's current engagement precedent. |
| Regulation | Boilerplate consent included in an engagement letter is treated as inadequate where client confidences will be entered into a generative tool, which makes the clause a description of the firm's specific arrangement rather than of the category of technology. | ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512. |
| Procurement | The disclosure that lets a client decide names retention, secondary use for model improvement, who at the provider can access inputs, and what the firm was unable to contract for, with the last of these being the item most often omitted. | Comparing the firm's client-facing clause against the data-processing terms it actually signed with the provider. |
| Workflow | Consent obtained at the start of a matter was given against the tools and terms then in force, so a change of provider, of retention terms, or of secondary use is a fact the client has agreed to nothing about and only the firm is positioned to notice. | Whether the firm has a record of which matters were consented under which version of which tool's terms. |
Each row would be wrong on another industry's page. Where a sourced figure exists it is in the table above instead; these are the constraints that shape the work and do not happen to be numbers.
Start with the measurement.
Reading about a benchmark is not the same as knowing your own number. The audit produces yours, measured rather than estimated.
$497 · delivered in 5 business days · credited against month one