Production Set 14 // Ethics + Confidentiality

The ethics of AI and GenAI in eDiscovery, ABA 512 and the state bars.

VERIFIED 21 APR 2026 // ABA CITATIONS VERIFIED // NOT LEGAL ADVICE

ABA Formal Opinion 512 (July 2024) confirmed what state bars had been saying for 18 months: the existing Model Rules apply to GenAI, and AI does not create new duties so much as it heightens the existing ones. In eDiscovery specifically, the relevant duties are competence, confidentiality, supervision, and candor. This page applies each to the eDiscovery context specifically.

ABA Model Rule 1.1 requires that an attorney ‘provide competent representation to a client’ including the ‘legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.’ Comment 8 adds that a lawyer must keep abreast of ‘changes in the law and its practice, including the benefits and risks associated with relevant technology.’

Applied to eDiscovery: the supervising attorney must understand how the AI review tool works at a level sufficient to evaluate its outputs. This does not require technical expertise in LLM architecture, but it does require understanding: what issue prompt was used, what the validation sampling showed, what the recall estimate is, and what the failure modes of the AI are for the document types in this matter. An attorney who signs a production certification under FRCP 26(g) without reviewing the AI validation results has not met the Rule 1.1 competence standard under Opinion 512.

Rule 1.6 requires attorneys to ‘make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.’ Sending client documents to a GenAI vendor for processing is a disclosure of client confidential information.

ABA 512 confirms that Rule 1.6 requires attorneys to conduct reasonable due diligence on GenAI vendors before sending client information. The required due diligence includes: verifying zero-retention terms (the vendor does not retain prompts or document content beyond the immediate transaction), confirming tenant isolation (client data does not mix with other clients' data), reviewing the vendor's data processing agreement (DPA), and confirming that the vendor does not use client data to train its foundation model.

For GDPR implications: if the eDiscovery involves EU personal data, the vendor must also execute a GDPR Article 28 processor agreement and must be able to demonstrate compliance with the EU-US Data Privacy Framework or an equivalent transfer mechanism. Processing EU personal data through an AI vendor without a valid Article 28 agreement is a GDPR violation regardless of any other contractual arrangement.

Rule 3.3 prohibits making false statements of law or fact to a tribunal and requires disclosure of controlling adverse authority. In the GenAI eDiscovery context, Rule 3.3 applies to: AI-generated case citations (hallucinated citations must be verified before being filed, not a new standard, but one that AI hallucination makes more relevant); AI-assisted summaries of documents submitted to the court or opposing party; and certifications about the review methodology where AI was used.

DC Bar Opinion 388 (April 2024) specifically addressed AI-generated work product and the duty of candor, recommending that attorneys review all AI outputs before submission to a court or opposing party. The Mata v. Avianca (S.D.N.Y. 2023) sanctions case, where an attorney submitted AI-hallucinated case citations, is the cautionary precedent that most ethics opinions cite.

Rule 5.3 requires attorneys to make reasonable efforts to ensure that non-lawyer assistants' conduct is compatible with the attorney's professional obligations. ABA 512 confirms that AI tools are non-lawyer assistance for Rule 5.3 purposes. This means the supervising attorney is responsible for the AI's outputs in the same way they are responsible for a paralegal's work. The attorney cannot disclaim responsibility for an incorrect AI relevance determination on the grounds that the AI made the decision; the attorney supervising the AI-assisted review is responsible for validating the result.

State bar guidance is evolving rapidly. Verify with the issuing bar before relying on this summary.

• ✓Zero-retention clause: contractually prohibits vendor from retaining prompts, documents, or outputs beyond the API transaction.
• ✓Tenant isolation: client data processed in a logically or physically separate environment.
• ✓No-training commitment: vendor does not use client data to train or fine-tune its models.
• ✓SOC 2 Type II certification: current, within 12 months.
• ✓GDPR Article 28 DPA: required for EU personal data.
• ✓HIPAA Business Associate Agreement: required for protected health information.
• ✓Subprocessor list: who does the vendor use to provide the AI service?
• ✓Incident notification: how quickly and in what form does the vendor notify of data security incidents?