Home / Industries / Law firms
Clients trust you with the things they can’t tell anyone else. The ethics rules expect reasonable technology to protect them, and an understanding of the AI tools you use. You get both, sized for a small firm.
Small firms run on email, a practice management system, document storage and e-filing, often set up by whoever had time. Meanwhile they hold exactly what attackers want: settlement funds moving through trust accounts, deal details, medical records and family matters.
The duty is professional, not just technical. Under the ABA Model Rules, competence includes understanding the benefits and risks of the technology you use, and confidentiality requires reasonable efforts to prevent unauthorized access to client information. ABA ethics opinions spell out what that means for breaches and, more recently, for generative AI.
Michigan has its own version of the rules and its own ethics opinions, so treat the ABA guidance as the baseline and confirm specifics with the State Bar or your ethics counsel. The technology side is where I come in.
These are the ABA versions. Michigan’s rules follow the same structure, and its own opinions control where they differ.
Firms of every size report breaches, and the smallest are the least prepared to respond. Here’s what the ABA’s own survey shows, and what I do about each gap.
Many breaches start with a phishing email, and social engineering plays a big role in schemes to redirect client and settlement payments. An attorney’s mailbox holds years of privileged communication.
What I doMulti-factor sign-in on email and practice software, email filtering, a call-back rule for any change to payment instructions, and training built around the scams that target firms.
Opinion 483 expects you to stop a breach, investigate it and notify affected clients. Without a plan, that happens in a panic while billable work stops.
What I doA short written incident response plan, a call list that includes your insurer and breach counsel, logging that shows what was reached, and a tabletop exercise to test it.
Most small firms have no cyber coverage, and the ones that do answer detailed questions about multi-factor sign-in, backups and training on the application. A wrong answer can put a claim at risk.
What I doControls that let you answer the insurance application honestly and well, documented so you can prove it if you ever file a claim.
Availability isn’t the same as use, and nearly half didn’t report having it at all. A single stolen password can expose every client file the account can reach.
What I doMulti-factor sign-in turned on and enforced for every account, a password manager for the whole firm, and encrypted email for sensitive matters.
Related services: Network security & cybersecurity · Managed IT services · Secure AI · Microsoft 365 & Google Workspace · Staff training
Generative AI is genuinely useful for drafting and summarizing. It has also produced fake citations that ended up in court filings, and it can keep what you paste into it.
Legal work is reading. AI can do a fast, careful first pass on contracts, records and discovery so attorneys spend their time on the analysis.
A first pass over large document sets that pulls out what matters and shows exactly where it came from.
Best forFirms that bill hours, or eat them, reading documents.
New matters sorted and set up the same way every time, with dates pulled out before they can slip.
Best forSmall firms without a dedicated docketing person.
Yes, carefully. Use business-tier tools with contracts that protect your data, get informed consent before client information goes into any self-learning tool, and verify every citation. A short written AI policy keeps everyone in the firm on the same page. Confirm the Michigan-specific rules with the State Bar or your ethics counsel.
It’s hard to call it reasonable. Business accounts on your own domain give you multi-factor sign-in you can enforce, retention controls, a contract covering your data, and the ability to remove access when someone leaves.
Disconnect affected computers without wiping them, call your cyber insurer first if you have one, and get technical help to stop and investigate the incident. Opinion 483 and Michigan law may require notifying clients. A plan written in advance turns this from a panic into a checklist.
Yes. A confidentiality agreement, and a business associate agreement for firms with HIPAA obligations, is in place before I touch any system that holds client information.
Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.
Tell me how your firm runs today. You’ll get a plain-English view of where you stand and the few fixes that matter most.