Am I responsible if my paralegal pastes client data into ChatGPT?

If you are a supervising or managerial lawyer, yes, to the extent reasonable measures would have prevented it. Rule 5.3 makes lawyers responsible for nonlawyer conduct incompatible with the rules where they ordered, ratified, or knew and failed to act, and managerial lawyers are responsible for having preventive measures at all. An approved-tools rule, training, and acknowledgment are those measures.

What does it mean to supervise the AI itself?

Florida's Opinion 24-1 and North Carolina's 2024 FEO 1 both analogize generative AI to a nonlawyer assistant: useful, fast, and never the final word. You review its work as you would a junior's draft, verify its citations, and remain the responsible author. Missouri's opinion adds preserving independent professional judgment: the tool informs your judgment; it does not replace it.

Do supervision duties cover outside vendors using AI?

Yes. Rule 5.3 covers nonlawyer assistance retained by the lawyer, which includes vendors running AI on your matters: e-discovery providers, deposition summarizers, contract review services, intake services. Vendor vetting (what AI they use, on what data, under what terms) belongs in the same approved-tools discipline; NYC Bar Opinion 2025-6 applies exactly this to AI transcription vendors.

What counts as reasonable measures for AI supervision?

The instruments converge on four artifacts: a written AI policy with an approved-tools register, training before first use and annually (with acknowledgment, per Arizona's guidance), a verification workflow for outputs, and someone who owns the policy and audits compliance. Arizona, Missouri, Kentucky, New Mexico, and ABA 512 each name some or all of these.

Supervising AI Use in a Law Firm: Rules 5.1 and 5.3 Applied

Rules 5.1 and 5.3 make managerial lawyers responsible for establishing measures that keep everyone's conduct, lawyer and nonlawyer, within the rules, and every AI ethics authority applies those duties to generative AI two ways: supervise the people using AI, and supervise the AI itself like a nonlawyer assistant whose work you own. Florida and North Carolina state the second framing expressly. In practice the duty resolves into an approved-tools list, training, a verification workflow, and a written policy that staff acknowledge.

The duty that turns individual risk into firm risk

Most AI ethics duties run to the lawyer using the tool. Supervision is different: it makes one lawyer’s measures responsible for everyone else’s usage. Rule 5.1 requires partners and managerial lawyers to make reasonable efforts to ensure the firm has measures giving reasonable assurance that all lawyers conform to the rules; Rule 5.3 extends the same architecture to nonlawyer assistance. The moment generative AI tools entered law firms, on approved lists or in staff browsers regardless, those rules started applying to AI use, whether or not anyone wrote anything down.

ABA Formal Opinion 512 makes the application explicit: managerial lawyers must establish clear policies on the firm’s permissible use of generative AI, and supervisory lawyers must make reasonable efforts to ensure compliance by subordinate lawyers and nonlawyers alike. The state instruments then fill in the texture, and two of them reframe the duty in a way worth internalizing.

Supervising the tool: the nonlawyer-assistant analogy

Florida’s Opinion 24-1 and North Carolina’s 2024 FEO 1 both treat generative AI itself as something to be supervised, analogizing it to a nonlawyer assistant. The analogy is precise on three points. A nonlawyer assistant’s work product is reviewed before it leaves the building; so is AI output. A nonlawyer assistant cannot exercise legal judgment or sign filings; neither can the tool, and Missouri’s Informal Opinion 2024-11 frames this as preserving the lawyer’s independent professional judgment. And delegation never transfers responsibility; the lawyer who would answer for a paralegal’s error answers identically for the model’s. West Virginia’s LEO 24-01 compresses the whole idea into one line: AI is at best a secondary source, supplementing rather than replacing the lawyer’s own reasoning, with human oversight and intervention to correct its mistakes.

The analogy also has a sharp edge the instruments flag: unlike a paralegal, the tool is relentlessly confident, never asks clarifying questions, and is available to every staff member at 2 a.m. Which is why the second direction of supervision matters more.

Supervising the people: where firms are actually exposed

The highest-frequency AI risk in a firm is not the partner drafting with an approved tool; it is unsupervised, invisible usage: the assistant summarizing a client letter in a personal chatbot account, the new associate pasting discovery into a free tier, the intake contractor running transcripts through a tool nobody vetted. Rule 5.3 reaches all of it, and a managerial lawyer’s exposure turns on whether reasonable preventive measures existed.

The instruments converge on what those measures are. Arizona’s best-practices guidance is the most specific: written firm AI policies that staff acknowledge. Missouri structures its entire opinion as building that framework: training before adoption, platform vetting, verification, and an ethical infrastructure covering lawyers and nonlawyers. Kentucky directs firms to AI policies and training as interim guidance. New Mexico requires firm policies and training under Rules 5.1 and 5.3 directly. The composite, stated once: a written policy with an approved-tools register, training with acknowledgment, a verification workflow, and a named owner who audits. That is also precisely the table of contents of the free policy template.

Two perimeter extensions complete the duty. Vendors: Rule 5.3’s “nonlawyer assistance” includes retained services running AI on your matters, so vendor vetting (what AI, what data, what terms) is supervision too, applied concretely by NYC Bar Opinion 2025-6 to AI transcription vendors. And departures: the policy has to survive personnel change; an AI governance system living in one power user’s head is a bus-factor problem wearing a compliance costume.

A supervision self-audit

Five questions, answerable with documents rather than assurances. Does a written AI policy exist with an approved-tools register? Has every lawyer and staff member been trained on it, with acknowledgments on file? Does every matter-touching output pass human review, with citations independently verified? Are vendors’ AI practices vetted on the same standard? Does someone own the policy, review it against new instruments quarterly, and audit actual usage? Five yeses is what “reasonable efforts” looks like on paper, and paper is what disciplinary counsel asks for. The tracker and its changelog exist to make the quarterly review a fifteen-minute job.

About the editor: MHSB Solutions, Research desk. MHSB Solutions is not a law firm. Everything on this site is legal information keyed to primary sources, not legal advice.

For licensed attorneys and firm operators. This site is legal information, not legal advice, and no attorney-client relationship is formed by using it. Rules change; verify against the primary sources linked on every page and consult a licensed attorney in your jurisdiction before acting.