Approved, Flagged, Rejected: Inside One Law Firm's ABA Formal Opinion 512 Due Diligence Checklist

The Setup: A Firm Evaluates Its First Generative AI Subscription

Picture a 14-lawyer practice with cross-border immigration and corporate clients in Toronto and London. Associates are drowning in first-draft work, and every legal AI vendor pitch sounds the same — faster research, faster drafts, fewer billable hours lost to grunt work. The managing partner is interested. But before signing anything, she asks the one question most firms skip: "If we use this tool on a client matter, what exactly are we agreeing to?"

That single question is the difference between a smooth AI rollout and a malpractice exposure nobody saw coming. And as of mid-2024, there's a formal framework to answer it with.

What ABA Formal Opinion 512 Actually Changed

On July 29, 2024, the American Bar Association's Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 512 on Generative Artificial Intelligence Tools — its first formal ethics opinion focused specifically on generative AI in legal practice, confirmed in the ABA's own news release.

The opinion doesn't create new rules. It maps generative AI use onto the existing Model Rules of Professional Conduct — competence, confidentiality, communication, supervision, candor to the court, and fees — and says lawyers must "fully consider their applicable ethical obligations" before adopting these tools. Several state bars, including California, Florida, New Jersey, New York, and Pennsylvania, have since issued related guidance of their own, as outlined in this Business Law Today analysis — which is part of why Formal Opinion 512 has quickly become the reference framework the rest of the legal profession builds on.

For the Toronto-London firm, that meant one thing: instead of evaluating AI vendors on speed and price alone, they needed a generative AI due diligence checklist built directly from these six obligations.

The Stress Test: A Six-Point Generative AI Due Diligence Checklist

The firm's general counsel (every firm this size should have one, formally or informally) sat down with the managing partner and turned each Model Rule into a plain-language question a vendor had to answer in writing before any contract was signed.

Competence comes first (Model Rule 1.1)

Formal Opinion 512 treats competence as an ongoing duty, not a one-time checkbox. Lawyers must understand what a tool can and can't reliably do — including its tendency toward "hallucinations," confident-sounding but false outputs — and keep that understanding current as the underlying models change.

Checklist question: Does the vendor explain, in plain language, the tool's known limitations — and do they update that guidance as the model changes?

Confidentiality is the make-or-break question (Model Rule 1.6)

This is where most firms get nervous, and for good reason. Self-learning tools that absorb prompts into future training data create a real risk that information from one client's matter could resurface elsewhere — even inside the same firm, across different matters.

Checklist question: Will anything we input be used to train the model, retained after the session ends, or accessible to the vendor's own staff?

"Boilerplate" consent doesn't cut it (Model Rule 1.4)

One of the more practical findings in Formal Opinion 512 is that generic engagement-letter language authorizing "use of technology" generally isn't enough to cover generative AI. Depending on how AI is used in a matter, lawyers may need to proactively tell the client — particularly if it affects the fee or the client would reasonably want to know.

Checklist question: Has the firm reviewed its engagement letters specifically for AI disclosure language, not just general technology clauses?

Supervision means a written policy (Model Rules 5.1 and 5.3)

Partners and supervising lawyers are responsible for ensuring associates, paralegals, and contract staff use AI tools appropriately. That requires an actual written policy — approved tools, what data can go in, mandatory review steps — plus training and spot-checks.

Checklist question: Does the firm have a written AI use policy, and does the platform support role-based permissions or audit trails to help enforce it?

Candor toward the tribunal — and the hallucination problem (Model Rule 3.3)

This is the one making headlines. Multiple courts have sanctioned lawyers for filings containing fabricated AI-generated citations, with the 2023 Mata v. Avianca case as the most cited example, referenced in this legal AI due diligence overview. Formal Opinion 512 is direct: every fact and citation submitted to a court remains the lawyer's responsibility, regardless of how it was generated.

Checklist question: Does the tool show verifiable sources for its claims, and does the firm's workflow require human verification before anything goes to court?

Fees must reflect reality (Model Rule 1.5)

If AI cuts research time from four hours to forty minutes, billing the client for four hours raises a Rule 1.5 problem — fees must be reasonable and reflect the actual work performed. Firms need to revisit how AI-assisted time is recorded and billed, hourly or otherwise.

Checklist question: Has the firm updated its billing guidance to reflect how AI changes the time spent on a task?

Quick-Reference: The ABA 512 Due Diligence Checklist at a Glance

Model Rule	Core Obligation	Vendor Due Diligence Question
1.1 — Competence	Understand the tool's capabilities and limits, on an ongoing basis	Are limitations documented and kept current?
1.6 — Confidentiality	Protect client information from improper disclosure or model training	Is input data used for training or retained?
1.4 — Communication	Disclose AI use to clients where it matters	Does the engagement letter address AI specifically?
5.1 / 5.3 — Supervision	Set policy and oversee staff use of AI	Is there a written policy and audit capability?
3.3 — Candor to tribunal	Verify all AI output before filing	Are sources cited and verifiable?
1.5 — Fees	Bill reasonably for actual work performed	Has billing guidance been updated for AI use?

What the Big Legal AI Platforms Are (and Aren't) Showing You

Run this checklist against the major enterprise legal AI platforms and an interesting pattern shows up. Harvey, used by large firms including Allen & Overy, publishes detail on data isolation between client workspaces, encryption standards, and a policy of not training models on customer data — and has partnered with Intapp specifically to bring ethical-wall enforcement into the platform. Legora goes further on paper, holding ISO 27001, ISO 42001 (the newer AI governance standard), SOC 2, and GDPR certifications, alongside a stated policy of never training on customer data and full deletion of data once a contract ends.

That's reassuring for the confidentiality piece (Rule 1.6) and part of the supervision piece (Rules 5.1/5.3). But notice what's largely missing from this kind of marketing: very little on engagement-letter language (Rule 1.4), almost nothing on how billing practices should adapt (Rule 1.5), and very little aimed at the solo and small-firm market where most lawyers actually practice. Enterprise certifications answer "is this vendor secure?" They don't answer "does my firm's AI policy satisfy Formal Opinion 512?" — and that second question is the one bar complaints are actually about.

Where Multi-Jurisdiction Tools Like Ovviously Fit Into the Checklist

This is where the gap between BigLaw-focused platforms and solo or small-firm practice becomes obvious. A two-lawyer immigration practice in Mumbai or a sole practitioner in Sydney isn't negotiating an enterprise security addendum — but the same six rules in Formal Opinion 512 still apply to them.

Ovviously is built around that gap: a legal research and drafting workspace designed for solo and small-firm lawyers across India, the UK, US, Canada, and Australia. Its jurisdiction-specific approach to research and drafting — keeping outputs anchored to the authorities and citation conventions of the relevant jurisdiction rather than a generic global answer — is a practical way a platform can support the Rule 1.1 competence requirement: lawyers spend less time correcting outputs that don't fit their jurisdiction in the first place. When you're evaluating any platform for your firm's generative AI due diligence checklist — Ovviously included — the same six questions from this case study apply. Ask them before you ask about price.

The Verdict: What the Firm Decided

Back to the Toronto-London firm. Of the three vendors they evaluated, one couldn't answer the confidentiality question in writing (Rule 1.6 — disqualified on the spot). One had strong security documentation but no jurisdiction-specific drafting support, which meant associates were still doing heavy manual review (a Rule 1.1 and Rule 1.5 issue in practice). The third answered all six questions directly, and the firm built a one-page internal AI policy around those answers — covering approved tools, engagement-letter language, billing guidance, and a mandatory citation-check step before any filing.

The whole evaluation took about three weeks. The checklist itself took an afternoon.

FAQ: Generative AI, Ethics, and Your Law Firm

What is ABA Formal Opinion 512? It's a formal ethics opinion issued by the ABA's Standing Committee on Ethics and Professional Responsibility on July 29, 2024, explaining how existing Model Rules of Professional Conduct — competence, confidentiality, communication, supervision, candor, and fees — apply when lawyers use generative AI tools.

Does ABA Formal Opinion 512 require lawyers to tell clients they're using AI? Not in every case, but the opinion makes clear that generic technology clauses in engagement letters aren't automatically sufficient. Disclosure becomes more important when AI use affects the fee, the work product, or when a client would reasonably expect to know.

Can a law firm be sanctioned for AI-generated citation errors? Yes. Courts have sanctioned lawyers for filings containing fabricated AI-generated citations, and Formal Opinion 512 confirms that lawyers remain fully responsible for everything submitted to a tribunal, regardless of how it was drafted.

Is using a generative AI tool a breach of client confidentiality? It depends entirely on the tool's data handling. If client information entered into a self-learning tool could be retained, used for training, or surface in other users' outputs, that raises a Rule 1.6 confidentiality issue — which is why checking a vendor's data policy is step one of due diligence, not an afterthought.

What should be on a law firm's generative AI due diligence checklist? At minimum: how the tool handles competence and limitations (Rule 1.1), data confidentiality and training practices (Rule 1.6), engagement-letter disclosure (Rule 1.4), supervision and written policy support (Rules 5.1/5.3), citation verification for court filings (Rule 3.3), and how billing practices need to adapt (Rule 1.5).

Does ABA Formal Opinion 512 apply outside the United States? The opinion interprets the ABA Model Rules, which individual US states adopt in their own form, so it isn't directly binding outside the US. That said, the underlying principles — competence, confidentiality, supervision, and candor — mirror professional conduct rules in most common-law jurisdictions, which is why firms in the UK, Canada, Australia, and India often use it as a practical reference point too.

The Bottom Line

ABA Formal Opinion 512 didn't invent new obligations — it just made the old ones impossible to ignore once AI enters the workflow. The firms getting this right aren't necessarily the ones with the most advanced AI. They're the ones who turned six familiar ethics rules into six simple questions, asked every vendor those questions in writing, and built a short policy around the answers before the first prompt ever touched a client matter.

If your firm hasn't run this exercise yet, start with the checklist table above. It takes less time than reading the full opinion — and it's the difference between adopting AI responsibly and explaining yourself to a bar complaint committee later.