Write a law firm policy for using generative AI on client work

Draft a generative AI use policy for my law firm. Firm size and practice areas: [DETAILS] AI tools in use or under consideration: [e.g. "legal research tool with AI, general chatbot, AI in our document management system"] How the vendors handle our data: [e.g. "no training on inputs, enterprise agreement" - or "unknown"] Client restrictions we know of: [e.g. "two clients prohibit AI use in their guidelines"] States where our lawyers are licensed: [STATES] Use ABA Formal Opinion 512 (2024) and the duties of competence, confidentiality, communication, supervision, candor to the tribunal, and reasonable fees as the framework, noting that state bars may add requirements. Cover: 1. Approved tools, and a process to vet new tools (data retention, training on inputs, access controls, location, vendor confidentiality terms). 2. What may never be entered into unapproved tools: client confidential information, privileged material, personal data. 3. When client informed consent is needed before using AI on their matter, and how to honor client guidelines that restrict AI. 4. Verification: every citation, quotation, and statement of law must be checked against the original source before use; AI output is a draft and the signing lawyer is responsible. 5. Court rules: checking for standing orders that require disclosure or certification of AI use. 6. Billing: bill for actual time spent, not time saved; how to handle AI tool costs; no charging for learning the tool. 7. Supervision of associates, paralegals, and staff, plus training requirements. 8. Incident reporting if confidential data is exposed or a filing contains an AI error. Return: the policy with numbered sections, a one-page do-and-don't summary for staff, and a list of items to confirm with my state bar guidance. This is a draft for firm leadership and ethics counsel to review.