Rule 5.3 and generative AI: what supervision means now

Most lawyers think of Rule 5.3 as the paralegal rule. If your legal assistant misses a deadline or mails something to the wrong person, 5.3 is where the bar looks to see whether you were supervising. Nobody wrote it with software in mind.

That changed in July 2024. In Formal Opinion 512, the ABA's ethics committee said lawyers' supervisory duties apply when the work is done by a generative AI tool, or by the lawyers and staff using one. If your firm uses AI, Rule 5.3 already applies to it. The question is what "supervision" looks like when the assistant is a piece of software.

What the rule actually says

Model Rule 5.3 has three parts, and each one lands on a different person:

• Partners and managers must make reasonable efforts to make sure the firm has "measures giving reasonable assurance" that nonlawyers' conduct fits the lawyer's professional obligations. That's a firm-level duty: policies, systems, training.
• The lawyer directly supervising the work must make reasonable efforts to make sure the person's conduct fits those obligations. That's a matter-level duty.
• Any lawyer is responsible for a nonlawyer's misconduct if they ordered or ratified it, or if they're a manager or supervisor who knew about it in time to fix it and didn't.

The comments matter here. They make clear the rule reaches nonlawyers outside the firm, and the examples include using an internet-based service to store client information. Once you accept that a cloud storage provider is covered, an AI vendor is a short step.

Rule 5.1 works the same way for lawyers. Your associates are using AI too, and partners have the same duty to put measures in place for them.

What Opinion 512 adds

The opinion takes up supervision directly. Three points stand out:

• Managers have to set clear policies on how the firm may use generative AI. "We haven't decided yet" is still a decision, and probably not a good one, because your people are already using these tools.
• Supervisors have to make sure people are trained, both in how to use the tools and in the ethical risks. The opinion suggests covering the basics of the technology, what the tools can and can't do, and secure handling of client data.
• Vendors get the same diligence as any outside service. The opinion points back to the cloud computing and outsourcing guidance: check the vendor's security and confidentiality terms, find out whether it keeps or claims rights to your data, and make sure you'll be told about a breach or a subpoena.

What supervision looks like in practice

Here's how I'd translate that into things a firm or legal department actually does.

1. Write down which tools are allowed, and for what

This is the core of the "measures" Rule 5.3(a) asks for. A short approved-tools list does more than a long policy nobody reads. For each tool, record whether client information can go into it and what the limits are. The free version and the enterprise version of the same product should be separate entries, because their data terms usually differ.

2. Put one person in charge of it

If everyone owns the AI question, nobody does. Name a partner or senior lawyer who approves tools, keeps the list current, and fields questions. They can lean on IT or an outside expert for the technical review, but a lawyer should make the call.

3. Read the vendor terms before client data goes in

The questions that matter: does the vendor use your inputs to train its models, how long does it keep your data, who can see it, and what happens when it gets a subpoena. If nobody at the firm can answer those for a tool, client information shouldn't be going into it yet.

4. Review the output before it leaves the building

Supervising AI is mostly supervising the output. Citations get checked against the source, every time. For other work, the opinion allows review that fits the task. If you're summarizing a stack of contracts, you can test the tool against a sample you've reviewed yourself rather than re-reading everything. Whatever level of review you choose, the lawyer still owns the result.

5. Train the people using it, including staff

Paralegals and assistants are often the heaviest AI users in a firm. They need to know what not to paste into a chatbot as much as the associates do. One practical suggestion from the opinion: mark AI-generated material when it's saved to a client file, so whoever picks it up later knows to check it.

6. Have a way to fix problems quickly

Rule 5.3(c) is about what happens after something goes wrong. A manager or supervisor who learns of a problem while its consequences can still be avoided or mitigated has to act. That only works if people feel safe reporting mistakes. Give them a clear person to tell, and don't punish good-faith reports.

What it doesn't require

Supervision doesn't mean you have to become an engineer. The opinion says lawyers need a reasonable understanding of the tools they use, not technical expertise, and that you can rely on someone who has that expertise. It doesn't mean every document gets reviewed by hand. And it doesn't mean banning AI. A ban with no tools offered tends to push people toward free consumer apps on their phones, which is the worst outcome for confidentiality.

Check your own state's rule

Everything above uses the ABA Model Rules. Your state's version may differ in wording or comments, and some state bars have issued their own AI guidance. Utah, for example, titles its rule "Responsibilities Regarding Nonlawyer Assistants." Before you rely on any of this, read your state's rule and check for local guidance.

Sources: ABA Model Rules of Professional Conduct, Rules 5.1 and 5.3 and comments; ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024).

Last reviewed October 2026. This article is general education, not legal advice.