Kaufman Ops

AI settings for a small law firm in North Carolina

Checked against the source documents on October 26, 2026

North Carolina's 2024 Formal Ethics Opinion 1 asks whether an AI program will keep and later use what you put into it, and tells lawyers to keep client facts out of public tools. The settings that answer that are on the main checklist. This page says which ones North Carolina points at, and why.

What North Carolina has said

North Carolina State Bar Ethics Committee (adopted by State Bar Council): 2024 Formal Ethics Opinion 1, Use of Artificial Intelligence in a Law Practice, 2024-11-01.

  1. Confidentiality. Rule 1.6(c) reasonable efforts; inputting client data into third-party AI permitted only if the lawyer is satisfied the program is sufficiently secure (Opinion #2); in-house hosting does not change the duty (Opinion #3).
  2. Competence. Rule 1.1 Comment 8; lawyer must educate herself on the tool's benefits and risks and its impact on the case (Opinion #1).
  3. Supervision. Rule 5.3 applies to in-firm staff and outside third-party software companies; reasonable care in vendor selection continues throughout use (Opinions #1 and #2).
  4. Fees. May not bill 3 hours for 1 hour of AI-assisted work; flat fees allowed if not clearly excessive and client consents; AI expenses and general technology admin fees chargeable if accurate, not excessive and consented to, preferably in writing (Opinion #6).
  5. Disclosure. Client disclosure depends on tool, product and reliance (Opinion #5); court disclosure not addressed; signing pleadings carries full Rule 3.1 and Rule 11 responsibility (Opinion #4).
  6. Verification. AI output can be inaccurate despite appearing reliable; lawyer is individually responsible for reviewing and relying on it (Editor's note, Opinion #1); no specific citation-check protocol.

The line about the tool itself. Lists vendor factors from 2011 FEO 6: reputation and stability, terms of service on handling and security of client data, retrieval or destruction on termination; adds whether provider retains data or asserts proprietary rights; focus on whether the program retains and uses inputs; avoid client-specific data in public AI tools (Opinion #2). (2024 FEO 1, Opinion #2, final two paragraphs)

One line from it: "lawyers should avoid inputting client-specific information into publicly available AI resources" (2024 FEO 1, Opinion #2, last sentence).

The settings that answer it

  1. Use the business plan, not a personal one. On Claude Pro, Claude Max and ChatGPT Plus, training on chats is each user's own setting. On Claude Team, ChatGPT Business and Microsoft 365 Copilot with a work sign-in, business data is not used for training by default. On the checklist
  2. Turn off the training and feedback exceptions an admin can still turn off (Claude feedback, ChatGPT personal accounts that are still in use). On the checklist
  3. Set retention on purpose instead of taking the default. On the checklist
  4. Turn on single sign-on so a lawyer who leaves loses access the same day. On the checklist
  5. Decide on connectors, apps and agents before staff add them. On the checklist
  6. Pick a rule on memory, and teach temporary or incognito chats for one-off matter questions. On the checklist
  7. Put the vendor's written terms on training, retention, subprocessors and breach notice in the file. On the checklist
  8. Write the one-page staff instruction and a note for each new hire. On the checklist
  9. Keep a verification step before anything is filed. That is a procedure, not a setting, and no vendor sells it. On the checklist
  10. Decide what the engagement letter says about AI use and billing. That is yours to write; I only flag that the opinion raises it. On the checklist

Rules around it

Technology competence: Yes. North Carolina Rule of Professional Conduct 1.1, Comment [8] (benefits and risks associated with the technology relevant to the lawyer's practice), approved.

Technology CLE: At least 1 hour of technology training per reporting period (currently 24 hours per two-year period, 27 NCAC 1D .1518(b)(2)); (rule)

What this page is not

This is a tech settings page, not legal advice. The state document above is the ethics half and it is yours to read and decide on. I am not a lawyer. I link the source so you can check me.

Send me one screenshot

Crop out client names, send me a screenshot of your Claude, ChatGPT or Microsoft 365 admin settings page, and I'll write back what I'd change. Free. I never need a login.

If you want this kept current for your firm, that is the monthly desk: I watch these settings as the vendors change them and as your state changes its guidance, answer staff questions in writing, usually within one business day, and write up setup notes for each new hire. $500 a month, cancel any month.

Email nick@kaufmanops.com

Who wrote this

Nick Kaufman

I'm Nick Kaufman. I've spent six years in customer-facing technical support for SaaS, payments and CRM software, including three years at Tier 2 on a CRM built for financial advisors, whose firms work under SEC and FINRA rules. I'm not a lawyer and I don't give legal advice. I set up software so it does what the people responsible for it decided it should do.

Other states: the full list.