Kaufman Ops

AI settings for a small law firm in District of Columbia

Checked against the source documents on October 26, 2026

D.C. Bar Opinion 388 tells lawyers to check a provider's privacy and security safeguards, and notes that paid business users can get better terms than free ones. The settings that answer that are on the main checklist. This page says which ones District of Columbia points at, and why.

What District of Columbia has said

District of Columbia Bar Legal Ethics Committee: Ethics Opinion 388, Attorneys' Use of Generative Artificial Intelligence in Client Matters, 2024-04.

  1. Confidentiality. Rule 1.6: before entering client information ask whether the provider or others can see inputs and whether inputs could surface in other users' outputs; anonymizing may not be enough (Section B).
  2. Competence. Reasonable, current understanding of how the tool works, its hallucination and confidentiality risks, limits and cost; test tools on known tasks (Section A).
  3. Supervision. Rules 5.1 and 5.3: managers must make reasonable efforts so lawyers and staff use GAI ethically; firms may approve specific tools and require privacy-policy review (Section C).
  4. Fees. Hourly billing only for time actually spent; no separate charge for perceived GAI value absent agreement; tool cost may be passed through if the engagement permits and is communicated under Rule 1.5(b) (Section E).
  5. Disclosure. No general duty to tell clients; communication duty evaluated case by case (Section D). Court orders requiring certification must be obeyed under Rules 3.3 and 3.4(c) (Section D).
  6. Verification. GAI is not a reliable substitute for cite-checking; verify output against trusted databases; Mata v. Avianca discussed; ordinary-care sanctions possible (Section A, Discussion, n.14).

The line about the tool itself. Section B: check provider privacy and security safeguards; some tools offer a zero data retention policy; paid business or API users may negotiate better terms than free users; consumer privacy policy may not govern business accounts (n.11). (Ethics Opinion 388, Section B (Confidentiality) and footnote 11)

One line from it: "omniscient, eager-to-please intern who sometimes lies to you" (Ethics Opinion 388, Discussion section (quoting Ethan Mollick)).

The settings that answer it

  1. Use the business plan, not a personal one. On Claude Pro, Claude Max and ChatGPT Plus, training on chats is each user's own setting. On Claude Team, ChatGPT Business and Microsoft 365 Copilot with a work sign-in, business data is not used for training by default. On the checklist
  2. Turn off the training and feedback exceptions an admin can still turn off (Claude feedback, ChatGPT personal accounts that are still in use). On the checklist
  3. Set retention on purpose instead of taking the default. On the checklist
  4. Turn on single sign-on so a lawyer who leaves loses access the same day. On the checklist
  5. Decide on connectors, apps and agents before staff add them. On the checklist
  6. Pick a rule on memory, and teach temporary or incognito chats for one-off matter questions. On the checklist
  7. Put the vendor's written terms on training, retention, subprocessors and breach notice in the file. On the checklist
  8. Write the one-page staff instruction and a note for each new hire. On the checklist
  9. Keep a verification step before anything is filed. That is a procedure, not a setting, and no vendor sells it. On the checklist
  10. Decide what the engagement letter says about AI use and billing. That is yours to write; I only flag that the opinion raises it. On the checklist

Rules around it

Technology competence: No. D.C. Rules of Professional Conduct Rule 1.1; no comment equivalent to ABA Model Rule 1.1 cmt. [8] listed (LexisNexis state survey, current to 2023-03-21);

What this page is not

This is a tech settings page, not legal advice. The state document above is the ethics half and it is yours to read and decide on. I am not a lawyer. I link the source so you can check me.

Send me one screenshot

Crop out client names, send me a screenshot of your Claude, ChatGPT or Microsoft 365 admin settings page, and I'll write back what I'd change. Free. I never need a login.

If you want this kept current for your firm, that is the monthly desk: I watch these settings as the vendors change them and as your state changes its guidance, answer staff questions in writing, usually within one business day, and write up setup notes for each new hire. $500 a month, cancel any month.

Email nick@kaufmanops.com

Who wrote this

Nick Kaufman

I'm Nick Kaufman. I've spent six years in customer-facing technical support for SaaS, payments and CRM software, including three years at Tier 2 on a CRM built for financial advisors, whose firms work under SEC and FINRA rules. I'm not a lawyer and I don't give legal advice. I set up software so it does what the people responsible for it decided it should do.

Other states: the full list.