The Illinois Attorney Registration and Disciplinary Commission issues ethics guidelines on artificial intelligence in the practice of law.

The guide advises attorneys who use generative AI tools to be mindful that they require the transmittal and processing of information, which could include confidential or sensitive client data. It also cautions that lawyers know “what privacy and security safeguards are in place” prior to using AI. The guide explains that when an attorney or law firm uses AI tools that are managed by third parties, any data that is transmitted becomes within the direct control of the third party. While such tools have things in common with cloud-based systems that lawyers may already be using, the guide clarifies that they are not functionally equivalent. AI tools include novel data processing techniques and may “present unique risks above and beyond those associated with traditional cloud systems.”

The guide also notes that some AI companies offer “public” or free versions and “business-class” versions, all of which provide various levels of security and access to information. The guide explains that business-aligned tools should require multifactor authentication and that enterprise-aligned tools may offer more sophisticated account-management capabilities, such as single sign-on.

Information Tiers:

The guide uses a tiered approach to describe types of information according to its level of sensitivity, from general information to confidential information protected from disclosure by the Illinois Rules of Professional Conduct (IRPC):

• General information is unrelated to any professional matter. Examples include the generation of forms and checklists or the drafting of marketing content.
• Deidentified information relates to the representation of a client, but there is “no reasonable likelihood that it could be used to ascertain the identity of the client or matter.”
• Confidential information includes information that is protected by IRPC 1.6. It also includes information otherwise subject to confidentiality obligations such as information that could “reasonably be used” to identify the client or the situation involved, even if direct identifiers are omitted.
• Sensitive personal information includes information specifically listed in the Illinois Personal Information Protection Act and information such as Social Security numbers and tax returns, medical information, and credit or debit card numbers.

The guide reiterates that AI technology is evolving rapidly and that there is no expectation that lawyers must be AI experts. But while there is no expectation that lawyers become experts, they are expected to use informed judgment when determining whether to use AI tools and to “provide clients with appropriate information when their data may be processed using such tools.”

The ARDC’s new AI guidance is available at law.isba.org/47WyE63. The Illinois Supreme Court’s AI policy is available at law.isba.org/4h7Biqq.