Technology & Vendor Security Module
The operational layer that keeps the other two modules honest
Policies and committees only work if there's a real process behind them. This module is where that happens: how a new AI vendor actually gets vetted and approved, exactly what client data is and isn't allowed near an AI tool, and what your firm does in the first hours after something goes wrong. It's the connective tissue — the Vendor Approval process feeds the tool registry your Acceptable Use Policy references, and the Incident Response Plan is what your firm executes when the Risk Assessment missed something.
Documents in this module
AI Vendor Due Diligence & Approval Procedures
The connective process behind every tool your firm adopts
A five-step process for evaluating, approving, and monitoring AI vendors under Rule 1.6 confidentiality and Rule 5.1 supervision duties. Routes each vendor through documentation review, security assessment, and Ethics Counsel sign-off before Committee approval, with required contractual protections and an Approved Vendor Registry.
- Five-step approval workflow with named role handoffs
- Ethics Counsel review as a separate mandatory gate
- Required DPA, no-training, and data-deletion contract terms
- Approved AI Vendor Registry and annual monitoring cycle
AI Data Protection & Confidentiality Procedures
The bright-line answer to "can I put this in AI?"
Operational procedures governing exactly what client data may go into AI tools, satisfying Rule 1.6 confidentiality duties. Sets a three-tier data classification standard, an anonymization protocol, an absolute prohibited-submission list, and a step-by-step breach response procedure.
- Three-tier data classification (Restricted / Controlled / Permitted)
- Anonymization standard for research and drafting
- Absolute prohibited-submission list (SSNs, biometric data, protective-order material)
- Step-by-step breach response procedure
AI Incident Response Plan
The plan malpractice carriers ask about at renewal
A formal incident response plan for AI compliance failures — hallucinated citations filed with a tribunal, unauthorized data exposure, and unapproved AI use. Three-tier incident categorization, reporting and containment procedures, notification triggers under Rule 1.4, and a mandatory post-incident review.
- Three-tier incident categorization with defined response windows
- Reporting, assessment, and containment procedures
- Client, court, bar, and carrier notification triggers
- Mandatory post-incident review and policy update loop
Other Modules
ETHICS & PROFESSIONAL RESPONSIBILITY MODULE
Ethics & Professional Responsibility Module
The documents every firm using AI needs, regardless of size
AI GOVERNANCE FRAMEWORK MODULE
AI Governance Framework Module
Firm-level authority and structure, for firms with something to govern
TRAINING & COMPETENCY MODULE
Training & Competency Module
Proof your attorneys were trained, not just told
Not sure which documents you need?
The Phase 0™ Assessment scores your firm's AI governance readiness and tells you exactly where to start.