Florida Bar Generative AI Guidance and the Practical Compliance Steps

Florida Bar Generative AI Guidance and the Practical Compliance Steps

The Florida Bar's Board of Governors approved Proposed Advisory Opinion 24-1 in January 2024, and it landed with more specificity than most state bar AI guidance we have seen so far. Where other bars have issued vague warnings about "exercising caution," Florida actually tried to map generative AI use onto existing Rules of Professional Conduct and spell out what lawyers need to do. The result is worth reading carefully, even if you practice outside Florida, because it is likely a template for what other bars will adopt.

What the Opinion Actually Says

The opinion addresses generative AI tools broadly, not just ChatGPT, and anchors its analysis in several existing Florida Bar rules: Rule 4-1.1 (competence), Rule 4-1.4 (communication), Rule 4-1.6 (confidentiality), Rule 4-5.1 and 4-5.3 (supervisory responsibilities), and Rule 4-7.13 (deceptive or misleading advertising). The Bar did not create new rules. It interpreted existing ones in the context of AI use, which is the approach most bars are taking right now.

A few things stand out. First, the competence requirement under Rule 4-1.1 now explicitly encompasses understanding the limitations of AI tools. The opinion states that lawyers must have sufficient understanding of the technology to recognize when it produces inaccurate, incomplete, or fabricated output. This is not aspirational language. It is a competence obligation, and failure to meet it is a disciplinable offense under the existing framework.

Second, and this is where it gets operationally interesting, the opinion addresses the duty to review all AI-generated work product. The Bar is clear: a lawyer cannot submit AI-generated content to a court or rely on it in client representation without independent verification. We all remember Mata v. Avianca from the Southern District of New York, where attorneys were sanctioned for submitting ChatGPT-fabricated case citations. Florida's opinion is essentially trying to prevent that scenario at the ethics level, before it becomes a sanctions issue.

The Consent Language Requirement

The most operationally significant piece of the opinion involves client consent under Rules 4-1.4 and 4-1.6. The Bar takes the position that lawyers should inform clients about their use of generative AI, particularly when confidential information might be entered into an AI system. This implicates the confidentiality rule directly.

Here is what matters for compliance teams: the opinion suggests that informed consent should be obtained before inputting client confidential information into any generative AI tool. The Bar references the existing framework of Rule 4-1.6(a), which requires client consent for disclosure of confidential information unless an exception applies. Entering client data into a third-party AI system, especially one that may use inputs for model training, constitutes disclosure under this framework.

Practically, this means firms need to update their engagement letters and potentially their existing client agreements. The consent language should cover:

• Whether the firm uses generative AI tools in the course of representation
• What types of client information may be processed by AI systems
• What safeguards the firm has in place to protect confidentiality
• Whether the AI provider retains, stores, or uses input data for training purposes

Some firms are handling this with a blanket disclosure in their standard engagement letter. Others are implementing matter-specific consent protocols for cases where AI use is more intensive. Either approach can work, but the key point is that silence is not an option. If you are using generative AI on client matters and you have not disclosed that to the client, you have a potential ethics issue under Florida's interpretation.

Worth noting: the opinion does not prescribe specific consent language. It leaves that to the lawyer's judgment, which means firms have flexibility but also bear the risk of getting it wrong.

Supervisory Expectations

Rules 4-5.1 and 4-5.3 impose supervisory obligations on partners and managing lawyers over other lawyers and nonlawyer assistants, respectively. The Florida Bar opinion extends these obligations to cover AI use by anyone in the firm.

This has real structural implications. A partner is responsible for ensuring that associates and paralegals using AI tools are doing so competently and ethically. The opinion contemplates that firms should establish internal policies governing AI use, including:

• Approved AI tools and platforms
• Prohibited uses, such as entering sensitive client data into consumer-grade AI tools
• Review and verification requirements for AI-generated work product
• Training requirements for anyone using AI in the course of their work

The supervisory framework here mirrors what we see in other regulated industries. Think of it as analogous to the CISO's responsibility for shadow IT, but applied to legal practice. If a junior associate is using an unapproved AI tool and it leads to a confidentiality breach or a fabricated citation, the supervising partner has exposure under Rules 4-5.1 and 4-5.3.

One detail that compliance officers should flag: the opinion does not limit supervisory obligations to direct reports. The language tracks the rules themselves, which impose obligations on any lawyer with "managerial authority" in the firm. For larger firms, this means the AI governance policy needs to come from firm leadership and be enforced systematically, not left to individual practice groups.

What This Means for Non-Florida Firms

Even if your firm is not Florida-based, this opinion matters. Several other state bars, including California, New York, and New Jersey, are developing their own AI guidance, and Florida's approach is substantive enough to serve as a reference point. The ABA's Formal Opinion 512, issued in July 2024, covers similar ground at the national level but with less operational specificity than Florida's treatment of consent and supervision.

If you represent clients in Florida or have attorneys admitted to the Florida Bar, this opinion applies to those attorneys regardless of where they physically sit. Multi-jurisdictional firms need to reconcile Florida's requirements with whatever other state bars have issued, and in most cases Florida's guidance will be among the more demanding.

The Practical Checklist

For general counsel and compliance officers at law firms or legal departments looking to align with Florida's guidance, the immediate action items are relatively clear:

• Audit current AI tool usage across the firm, including unofficial or personal use by staff
• Draft or update engagement letter language to include AI disclosure and consent provisions
• Establish a firm-wide AI acceptable use policy with approved tools, prohibited practices, and review requirements
• Implement training on AI competence obligations, with documentation that the training occurred
• Assign supervisory responsibility for AI compliance to specific individuals, not just "everyone"
• Evaluate AI vendors for data handling practices, particularly whether inputs are used for model training or stored beyond the session

None of this is revolutionary, but the gap between knowing what to do and actually having it documented and enforced is where ethics complaints tend to originate.

How FirmAdapt Addresses This

FirmAdapt's architecture is built around the kind of compliance controls that Florida's advisory opinion contemplates. The platform maintains audit trails for AI-generated outputs, enforces role-based access controls that map to supervisory structures, and processes data within environments designed to prevent confidential information from leaking into model training pipelines. For firms that need to demonstrate compliance with consent and confidentiality obligations, these controls provide documented, verifiable evidence of responsible AI use.

On the supervisory side, FirmAdapt supports policy enforcement at the platform level rather than relying on individual attorneys to self-police. Approved use parameters, output review workflows, and usage logging are built into the system. This makes it significantly easier for managing partners and compliance teams to meet their obligations under Rules 4-5.1 and 4-5.3 without creating an entirely separate governance apparatus from scratch.