The American Bar Association counted 11% of the profession using AI in 2023. A year later it was 30%. Clio's 2026 report on solo and small practices now has three quarters of them using it, with 55% running no AI-use policy at all. If you write a small law firm AI policy this year, you are writing it about something your people already do.
The decision already happened
Picture the Tuesday. An associate has a forty-page commercial lease to summarise before a nine o'clock call, the partner who assigned it is in a deposition, and the firm has never said anything about AI in either direction. So she opens the same assistant opposing counsel is using, pastes in the lease, and has a clean summary in four minutes.
She is being efficient. The lease also carries the client's name on every other page and the guarantor's Social Security number in the schedule, all of it now inside a consumer product never built for client data. Clio found this is the normal case: small practices reach for consumer assistants rather than legal tooling, because that is the one already open in a tab. Adoption at that size never shows up as a decision. It shows up as a deadline.
The work got faster. The invoice did not.
60% of large firms told Clio that AI is growing their revenue. Fewer than a third of solo and small practices said the same. Same tools, same year, opposite result.
A large firm pays somebody to approve a tool and reprice the work it changes. You have nobody doing that, so a job that took three hours takes one and gets billed as one. The client keeps the saving. The risk stays in the building. You gave away the margin and kept the exposure.
The receipt gap
So you fix the obvious part. You write the two-page policy, people read it, and it goes on the shared drive.
Then the number from the North Carolina Bar Association's survey round-up. Across the profession, 9% of firms have a written AI policy that is genuinely enforced. Written ones are far more common than that, and the difference is almost never bad faith. It is that once the memo has gone round, nobody at the firm can see what anybody does.
Call that the receipt gap: the distance between the rule you wrote and anything that would prove it was followed. Your firm has the rule. Now suppose an associate pasted a client's medical records into a chatbot last Tuesday. By what mechanism would you find out? At most firms this size, you find out when the client does. It stops being theoretical the first time a client's outside-counsel guidelines carry a generative-AI question, or an insurer adds one at renewal.
Prohibition is the instinct here, and it loses. A rule against a tool that saves two hours on a lease summary does not stop the tool, it stops the reporting, and the associate still has her call at nine. What survives contact with a deadline is the rule that is also the quickest way through. Make the protected route faster than the unprotected one, and compliance stops depending on anybody's self-discipline.
What that looks like on a real file
A lawyer holds a file, not a paragraph, and nearly every tool offering to strip personal data wants a string of text. promptShield takes the document as it stands. Fifteen formats go into the Library, covering PDF, Word, Excel, PowerPoint, plain text and images, and on the desktop an Upload folder button scans a folder one level deep. Scanned pages are read automatically on opening, with no recognition step to run first.
Detection runs in four layers, all four in one pass. Patterns takes the values with a shape: Social Security numbers, account numbers. Entity recognition takes the ones without one: names, employers, addresses. Expressions takes the vocabulary no general model has heard of, a deal code name or a subsidiary. Deep Analysis is optional and handles edge cases.
Then a person signs off. By default the file cannot be downloaded until somebody has verified the findings, and pressing Download first shows what is outstanding and a route into the review. That gate can be turned off in Settings, and it is the one setting worth leaving alone. The software proposed. A named person confirmed. The confirmation was recorded. That sequence survives a professional-negligence conversation.
Two things you can do to a value. Redact removes the text permanently, which is what you want for anything leaving the firm. Encode swaps it for a short code and keeps the mapping in a registry on your own machine, unencrypted, because you already hold the original on the same disk.
Encode is the one that makes the round trip work. Inside a folder, each value gets one code and keeps it, so an encoded matter still reads as one matter rather than as alphabet soup and the model can follow that the tenant in the lease is the tenant in the correspondence. Two unrelated matters never share a namespace, and the registry forces their codes apart. To make one code hold firm-wide, you pin it by hand. Why a value has to keep its code is a longer argument than it sounds.
So she encodes the lease, drops the protected copy into whichever assistant the firm uses, and gets a summary back full of codes. That goes into the Decode surface, as a file or as pasted text, and the real names come back locally. At no point did the client's name reach the model.
Where the receipts come from
All of that makes the work safe. None of it makes the work provable, which is the half most firms are missing. In the browser dashboard you assign a licence to an email address and tag licences by team or matter type, so an export reconciles against the way the firm bills. Revoke one and the entitlement ends at that desktop's next online check. A paid plan gives each person two device slots; a trial gets one.
The Compliance Monitor then lists every seat with what that person did in a window you choose: documents exported, pages processed, values detected, encoded and redacted, and when they were last active. It totals seats as compliant or as policy gaps against a threshold you set, so a seat quiet for thirty days rises to your attention, and exports the lot as a compliance report. A licence holder cannot open it, or the audit log, because both belong to the account owner. Your associates get an application that protects documents, not a console for looking at each other.
And the limit, which is our own disclaimer rather than an objection somebody else raised. The Compliance Monitor reflects activity that went through promptShield, and it cannot see a document somebody handled outside the tool. A seat activated offline is flagged for that reason, because its activity cannot be verified. If a partner forwards a contract to a personal address and pastes it into a browser at home, nothing here will tell you.
So what you have is a record rather than supervision, and any vendor promising certainty here is selling something they do not have. "We have an AI policy" is an assertion. "Here is a report showing nine of ten seats protecting documents every week, and here is the tenth, which I followed up on in March" is a record, and it reads differently to an insurer.
Common questions
Does a small law firm need a written AI policy?
If anybody at the firm uses AI on client work, yes, and the pressure is more commercial than regulatory. State bar rules on competence and confidentiality already reach AI without a clause that names it. What has changed is who asks: clients and insurers both now do. Writing the policy answers them halfway. Showing what people did answers the rest.
What should a law firm AI policy actually contain?
One page. Which tools are approved and which are not. What has to come out of a document first: client names, identifiers, anything privileged. The procedure for taking it out, written as steps rather than as a principle, so there is nothing to interpret at nine in the evening. Who to ask when a case is not covered. Then the clause almost every policy omits: how the firm sees whether any of it happened.
Do our documents leave the office?
Not in the configuration it ships in. Detection, text recognition and redaction all run on the machine the file is already on. What reaches our servers is licence validation and the counts behind the compliance report: pages processed, values found, timestamps. Never document content, and that carries no conditions. The qualifier belongs on Deep Analysis, which uses a local model by default but can be pointed at a third-party endpoint, and in that mode it does send page text. You would have to turn that on yourself. What "safe" means for a document going to a model is its own question.
Would banning AI at the firm be simpler?
Simpler to write, harder to live with. A ban is a rule about something already in use, with no procedure under it and no record behind it, which makes it the receipt gap in its purest form. It does not remove the associate with a nine o'clock call. It removes your sight of what she did about it.
Which plan does a ten-person firm need?
Basic is the desktop application: detection, Redact and Encode, the local registry, Decode. For one person working alone that is enough. The licence manager, the audit log and the Compliance Monitor belong to Pro. Both plans protect a document equally well; Pro is the one that lets you demonstrate it afterwards. A practice facing client procurement and an insurance renewal needs that, and only the owner needs the seat.
Start with the week you are in
You do not need a framework. Pick the one job that keeps pulling people toward a chat window, the lease summary or a first draft, and define the protected way to do it. Make sure that way is quicker. Write the page. Then look at what the record shows after a month, because the gap between the rule and the practice is the part you cannot guess at.
We got this wrong ourselves. Pressing Download on an unverified file used to do nothing at all in our own app, and we called that a safe default. It was a dead end, and it taught people to work around us rather than through us. The button explains itself now. A control that people route around is worse than no control, in software and in a policy.
Every lawyer reading this has had the conversation where a client hands over something they are frightened of and trusts you with it because there is nowhere else to put it. That trust is the product. Everything else is billing.
The firms that come through this well will not be the ones with the strictest rule. They will be the ones who can answer the question when it arrives: show me. A small law firm AI policy is not a document you file. It is a route people take, and a record that they took it.