ABA Model Rule 1.6 in the Age of AI: What "Reasonable Efforts" Means for Legal Tech

Quick Answer: ABA Model Rule 1.6(c) requires attorneys to make "reasonable efforts" to protect client confidentiality. For AI billing tools, this means understanding where data is transmitted, who can access it, and whether third-party processing creates privilege waiver risk—not simply relying on vendor security certifications.

Introduction

ABA Model Rule 1.6(c) requires attorneys to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

For decades, this meant locking file cabinets and shredding documents.

Today, it means understanding exactly where your AI tools send client data—and whether that transmission creates privilege risk.

The Technology Competence Mandate

In 2012, the ABA added Comment 8 to Model Rule 1.1, requiring attorneys to maintain competence in "the benefits and risks associated with relevant technology."

This isn't optional guidance. It's a professional obligation.

When you use AI billing software that processes client emails on third-party servers, Comment 8 requires you to understand:

• Where that data goes
• Who can access it
• How long it's retained
• Whether it creates privilege waiver risk

"I didn't know" is not a defense.

What Counts as "Reasonable Efforts"?

ABA Formal Opinion 477R (2017) provides guidance on what "reasonable efforts" look like in the context of technology:

Factor 1: Sensitivity of the Information

Family law matters involving custody, criminal defense communications, M&A deal terms—these require heightened protection.

If you're handling sensitive matters and using AI tools that transmit data to third-party clouds, you need to document why that's a reasonable choice.

Factor 2: Likelihood of Disclosure

Cloud-based AI tools create multiple potential disclosure points:
- The vendor's servers
- The AI provider's infrastructure (OpenAI, Azure, Anthropic)
- Backup and disaster recovery systems
- Subpoena exposure in litigation

Each service introduces data-handling questions; evaluate its actual safeguards, permissions, and contractual terms.

Factor 3: Cost of Safeguards vs. Adverse Consequences

Assess the cost and operational burden of safeguards alongside the sensitivity of the information and the consequences of unauthorized disclosure. Local processing still requires device security, maintenance, and workflow review.

Document the tradeoffs for the actual tool and matter.

Factor 4: Difficulty of Implementation

Evaluate setup and maintenance requirements before approving the workflow. A marketing claim about easy installation is not evidence that a tool is operationally ready.

Pilot availability, September 19, 2026: IntelliBill is available by request for a guided readiness review. The existing concierge Mac build uses Legacy Outlook automation and separately configured local PostgreSQL/pgvector and Ollama; it is not a self-service app with bundled runtimes. Microsoft Graph support is in development and has not been released. Microsoft says Legacy Outlook for Mac will stop connecting to Exchange Online starting in October 2026. Microsoft 365 pilot activation is pending a validated supported replacement connector and clean-machine release checks. No working mailbox should be connected before those gates are complete. Request a readiness review or try the fictional-data product tour.

The Third-Party Disclosure Problem

Here's where most attorneys get tripped up:

Rule 1.6 protects against unauthorized disclosure. But what if you authorize a vendor to process your data?

Review the actual data flow and contractual terms with firm counsel. Local processing alone does not establish consent, privilege, or disclosure compliance, and cloud use alone does not establish waiver. The ABA's guidance accompanying Formal Opinion 512 addresses competence, confidentiality, communication, and fees; it is not a blanket approval or prohibition of a deployment model.

A Practical Due-Diligence Checklist

Based on current ethics guidance and developing case law, here's what reasonable efforts should include:

1. Vendor Due Diligence

Before adopting any AI tool, review:
- Terms of Service (not the marketing page)
- Privacy Policy (especially data retention and third-party sharing)
- Data Processing Agreement (if available)
- Security certifications (SOC 2, ISO 27001—but understand their limits)

2. Data Flow Mapping

Know exactly where client data goes. Ask vendors:
- Where are servers located?
- Do you use third-party AI providers (OpenAI, Azure, Anthropic)?
- What data is retained after processing?
- Can you respond to subpoenas for client data?

3. Client Disclosure

Consider adding technology disclosures to engagement letters:

"Our firm uses technology tools to enhance efficiency, including artificial intelligence software. We select vendors with strong security practices. By signing this engagement letter, you acknowledge this disclosure."

4. Local Processing Alternatives

Local processing can reduce transfers to an external AI service, but evaluate the entire workflow: email storage, device security, backups, logs, support access, retention, and permissions. It does not eliminate third-party involvement or the need to determine applicable professional duties.

The IntelliBill Approach

IntelliBill's existing concierge build uses guided setup on an Apple silicon Mac running macOS 26 or later. Local PostgreSQL/pgvector and Ollama must be configured separately; this is not a bundled self-service runtime. Runtime settings use the Mac Keychain.

Local analysis. The existing workflow is designed to perform classification, matching, and narrative drafting locally without a cloud language-model fallback. Verify the full device, email-provider, backup, and support setup before use.

Connector and release validation. The existing build uses Legacy Outlook automation. A Microsoft Graph implementation is in development and is not released. Microsoft 365 pilot activation requires a validated supported replacement connector and clean-machine release checks, as explained above.

Human review before export. Proposed entries must be reviewed before CSV export. The firm's CSV mapping and reconciliation workflow must be agreed and tested; there is no direct billing-system write in this pilot.

Action Steps

1. Audit your current AI tools. Where does data go? Read the ToS.

2. Document your reasoning. If you use cloud AI, document why you believe it satisfies "reasonable efforts."

3. Review client communication. Determine applicable disclosure and consent duties with firm counsel.

4. Consider local alternatives. Assess where local processing reduces data transfers and which risks remain in the complete workflow.

Conclusion

"Reasonable efforts" isn't a fixed standard—it evolves with technology and client expectations.

A useful review includes understanding that "SOC 2 certified" and "encrypted in transit" don't address privilege waiver. It means asking vendors hard questions about data flows. And for sensitive matters, it may mean choosing tools that keep data under your direct control.

Document the review and revisit it when the tool, vendor terms, connector, or applicable guidance changes.

This article is for informational purposes only and does not constitute legal advice. Consult your state bar ethics hotline for jurisdiction-specific guidance.

ATTORNEY ADVERTISING

Comments

No comments yet. Be the first to comment!

Check whether IntelliBill fits your billing workflow.

The planned Mac pilot covers email-to-draft review and a reviewed CSV handoff. Access is by request; activation depends on a supported mailbox connector and completed release testing. Read the current availability and setup guide before arranging working-data access.

The hosted Product Tour uses fictional browser-local data and creates no working-data workspace.