Kaufman Ops

AI settings for a small law firm in Oregon

Checked against the source documents on October 26, 2026

Oregon Formal Opinion 2025-205 says to review an AI provider's terms the way you'd review any cloud vendor, including how data is stored, encrypted and destroyed. The settings that answer that are on the main checklist. This page says which ones Oregon points at, and why.

What Oregon has said

Oregon State Bar Board of Governors (drafted by OSB Legal Ethics Committee): Formal Opinion No. 2025-205, Artificial Intelligence Tools, 2025-02.

  1. Confidentiality. Open models learn from inputs, so using client information in one needs informed consent; otherwise anonymize or redact; closed models still require vendor contract review (p. 5).
  2. Competence. Ongoing duty to understand benefits and risks of the specific AI tool; do due diligence on tools and vendors; get training (pp. 1-2).
  3. Supervision. Managers must set firm AI policies and training; supervisors must ensure subordinates and nonlawyers grasp the risks; oversee AI vendors (pp. 6-7).
  4. Fees. Bill only actual work; no duplicate charges from AI time savings; learning time billable only if client agrees in advance; AI costs passed through must be disclosed, preferably in writing, or treated as overhead (pp. 4-5).
  5. Disclosure. Client disclosure is case by case, required when AI use materially deviates from client expectations; engagement letter can cover it; check court rules that bar or require disclosure of AI (pp. 2-3, 7).
  6. Verification. Lawyers must review AI output on facts, citations, quotes and conclusions; correct inadvertent false statements without revealing confidences (pp. 7-8).

The line about the tool itself. Approach contract negotiations with AI providers carefully; review terms and conditions as with any cloud vendor; contracts must address how data is handled, encrypted, stored and destroyed (p. 5). Does not address specific tool settings. (Formal Opinion 2025-205, Confidentiality section, p. 5)

One line from it: "Lawyers must verify any work done by or with the assistance" (Formal Opinion 2025-205, p. 8 (truncated from the sentence ending 'of any third-).

The settings that answer it

  1. Use the business plan, not a personal one. On Claude Pro, Claude Max and ChatGPT Plus, training on chats is each user's own setting. On Claude Team, ChatGPT Business and Microsoft 365 Copilot with a work sign-in, business data is not used for training by default. On the checklist
  2. Turn off the training and feedback exceptions an admin can still turn off (Claude feedback, ChatGPT personal accounts that are still in use). On the checklist
  3. Set retention on purpose instead of taking the default. On the checklist
  4. Turn on single sign-on so a lawyer who leaves loses access the same day. On the checklist
  5. Decide on connectors, apps and agents before staff add them. On the checklist
  6. Put the vendor's written terms on training, retention, subprocessors and breach notice in the file. On the checklist
  7. Write the one-page staff instruction and a note for each new hire. On the checklist
  8. Keep a verification step before anything is filed. That is a procedure, not a setting, and no vendor sells it. On the checklist
  9. Decide what the engagement letter says about AI use and billing. That is yours to write; I only flag that the opinion raises it. On the checklist

Rules around it

Technology competence: Partial. Oregon RPC 1.1 has no official comments, so Comment 8 is not adopted as such; Formal Opinion 2025-205 (pp.

In motion: Oregon Supreme Court issued its first AI-related sanction orders (Aldridge v. Tussing S072780, Witkin v. McGreevy S072692); case specific, no rule change or task force announced 2026-06-05 source

What this page is not

This is a tech settings page, not legal advice. The state document above is the ethics half and it is yours to read and decide on. I am not a lawyer. I link the source so you can check me.

Send me one screenshot

Crop out client names, send me a screenshot of your Claude, ChatGPT or Microsoft 365 admin settings page, and I'll write back what I'd change. Free. I never need a login.

If you want this kept current for your firm, that is the monthly desk: I watch these settings as the vendors change them and as your state changes its guidance, answer staff questions in writing, usually within one business day, and write up setup notes for each new hire. $500 a month, cancel any month.

Email nick@kaufmanops.com

Who wrote this

Nick Kaufman

I'm Nick Kaufman. I've spent six years in customer-facing technical support for SaaS, payments and CRM software, including three years at Tier 2 on a CRM built for financial advisors, whose firms work under SEC and FINRA rules. I'm not a lawyer and I don't give legal advice. I set up software so it does what the people responsible for it decided it should do.

Other states: the full list.