AI for small law firms: automating document prep without losing control of client files

Every matter starts the same way. The client's documents arrive: medical records, bank statements, pay stubs, evidence for a petition. Someone on your team reads them and turns them into something an attorney can use: a chronology, a financial statement, an exhibit index, a summary before a hearing. Then they chase whatever is still missing before the deadline.

That reading and chasing is where an automated workflow can help a small firm most. It's also where client files get copied into places. This guide covers both. It isn't legal advice: the rules below are pointers, and each firm checks them with its own ethics counsel.

1. What to automate first

Pick one task that repeats for every matter and that a person can check quickly:

• Records into a chronology: diagnoses, treatment and limitations in date order, each entry linked to the page it came from (injury and disability practices).
• Statements into a financial statement: income, expenses, assets and debts drafted from what the client sent, each figure linked to its source (family law).
• Evidence into an exhibit index: each document named, dated and matched to the point it supports (immigration).
• The missing list: for each matter, what's still outstanding, with the request drafted for your team to send.

Leave out the judgement: what to argue, what to file, what to tell the client. The workflow drafts, and a person decides.

If one task is all you need, a product may already do it: chronology tools built for injury and disability firms exist, and some come inside case-management software. A workflow earns its place where the work runs between your systems (intake, requests, deadlines, the summary) or where you want the files to stay on your side.

2. Where the client file goes: three setups

Every AI workflow sends documents to a model somewhere. There are three common answers:

None of these is wrong in itself. What matters is that you choose knowingly and can tell a client, or a bar investigator, which one their file went to.

3. What the rules already ask of you

These rules apply to your firm whether or not you use AI. Ask your own ethics counsel how they apply.

• Confidentiality, ABA Model Rule 1.6(c): "reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation".
• Competence, Rule 1.1, comment 8: a lawyer "should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology". Knowing where a tool sends a file is part of knowing its risks.
• ABA Formal Opinion 512 (July 29, 2024), on generative AI tools:
  • Before client information goes into a tool, lawyers must evaluate the risk "that the information will be disclosed to or accessed by others outside the firm", and inside it.
  • A tool that learns from what it's given can surface one client's information in another's work, "even if the tool is used exclusively by lawyers at the same firm". For those tools, the client's informed consent is required first, and "merely adding general, boiler-plate provisions to engagement letters … is not sufficient".
  • "As a baseline, all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use."
  • Managing lawyers should set clear firm policies on AI and train their staff (Rules 5.1 and 5.3), and check outside providers as they would any vendor.
• California, the State Bar's Practical Guidance for the Use of Generative AI in the Practice of Law (2026 revision): written partly for agentic systems, the kind that act on their own across a firm's files:
  • "a lawyer must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent".
  • "Reasonable efforts require more than reliance on generalized marketing assurances."
  • "The degree of lawyer diligence and supervision must correspond to the level of system access and autonomy."
  • Agentic systems with access to email, documents or client files: "Lawyers must carefully evaluate and limit the scope of such access", because poorly configured ones "may unintentionally disclose confidential information (including across different matters)".
  • "A lawyer must not deploy an agentic AI system in a manner that permits autonomous external transmission of client information … without appropriate safeguards and human review."
• Your own state: Florida (Ethics Opinion 24-1) and Pennsylvania with Philadelphia (Joint Formal Opinion 2024-200) have issued guidance too, and others are following. Check your bar's.
• Where deadlines bite: the rules of your practice area are what make the missing list worth automating. For Social Security hearings, evidence is due five business days before the hearing (20 CFR 404.935).

Put simply: a workflow that doesn't learn from your files, runs where you decide, keeps each matter apart and lets a person approve anything that leaves the firm answers most of what these rules worry about. Whether you still need a client's consent for a given tool is a question for your ethics counsel, not a vendor.

4. Keep each matter separate, and keep a record

Three things make an AI workflow safe to run across a caseload:

1. One matter at a time. The workflow reads only the matter it's working on, and nothing from one client's file ends up in another's draft.
2. A record of what it did. For each run: which matter, what it read, what it drafted, who approved it. If a client, a court or the bar asks, you can show them.
3. Nothing leaves without a person. Requests, letters and filings are drafted, never sent on their own. Access ends when the matter closes.

5. How to tell if it's working

Measure the task you picked before you start: hours per matter on the chronology or statement, and how many requests are still open at the deadline. Measure again after a month or two. If neither moved, the workflow isn't doing that task.

6. Questions to ask any vendor or agency

1. Where do my clients' files go, and are they kept after the task is done?
2. Is anything we put in used to train a model, for us or anyone else?
3. Can one matter's documents ever reach another matter's work?
4. What record do we get of what the workflow read, drafted, and who approved it?
5. Can it run on our own hardware, or in a tenant we control?
6. Does anything leave the firm without a person approving it?
7. Will you sign a confidentiality agreement that matches Rule 1.6 and Opinion 512?

---

If you run an accounting or bookkeeping firm instead, the same questions apply to the monthly close: see AI for accounting firms.

Oye Collective builds automated workflows for small firms. Our own products run their models on the user's device: Actvt finds personal information in what it records without it leaving the Mac, and Chouette translates pages with the model running entirely in the browser. If you'd like to map one task in your case prep, book a call.