Does Your Law Firm Need an AI Policy? A Guide for South African Firms

Yes. If anyone in your firm uses AI tools, your firm needs an AI policy. A clear AI policy for law firms sets out which tools are approved, what client information can be shared and who checks the output. Without one, you are relying on every attorney, candidate attorney and secretary to make the right call on their own.

This guide explains why South African firms can no longer treat AI as optional to govern, what a good policy covers and how to put one in place.

Why South African law firms need an AI policy now

Your staff are probably already using AI

Tools like ChatGPT, Microsoft Copilot and Google Gemini are free, fast and easy to use. So staff use them to summarise documents, draft letters and research points of law, often without telling anyone. This is known as shadow AI. The firm carries the risk, but has no visibility or control.

The courts have drawn a firm line

South African courts have now dealt with AI-generated fake case law more than once. In Mavundla v MEC (KwaZulu-Natal High Court, 2025), the firm involved was referred to the Legal Practice Council. Later that year, in Northbound Processing v SA Diamond and Precious Metals Regulator, the Gauteng High Court referred the legal team to the LPC as well.

The message is clear. Responsibility stays with the practitioner, whatever tool produced the work. An apology after the fact is unlikely to be enough.

Client confidentiality and POPIA are at stake

When someone pastes client information into a public AI tool, that information may be stored on servers outside South Africa. It may also be used to train future models. That creates real questions under POPIA, which requires firms to keep personal information secure and controls how it moves across borders. It can also put confidentiality and legal professional privilege at risk.

Guidance for the profession is taking shape

Academics at the University of KwaZulu-Natal have drafted ethics guidelines for South African legal practitioners on the use of generative AI, for submission to the Law Society of South Africa. A core principle is that lawyers remain fully responsible for all work, even when AI helps produce it. Firms that put a policy in place now will be ready, whatever the final rules say.

Yet most firms have not acted. According to a 2025 Thomson Reuters report, only around 30% of law firms have a specific AI policy.

What a good AI policy for law firms should cover

A useful policy is short, practical and written for the people who will follow it. It should cover:

• Approved tools. A list of the AI tools staff may use, and the versions or licences that make them safe. For example, a business licence with data protection terms, not a free personal account.
• What data can be shared. Clear rules on what may never be entered into an AI tool, such as client names, identity numbers, privileged material and settlement terms.
• Permitted uses. Where AI can help, such as first drafts, summaries and internal research, and where it must not be used without partner approval.
• Verification. A rule that every case, statute and citation produced with AI is checked against an authoritative source before it is relied on.
• Accountability. Who is responsible for AI-assisted work, and who signs it off.
• Client transparency. When and how the firm tells clients that AI was used on their matter, and how that is reflected in billing.
• Training. What staff need to learn before using AI, and how often that training is refreshed.
• Reporting and review. How staff report mistakes or concerns, and when the policy itself is reviewed.

How to put an AI policy in place: five steps

1. Find out what is already being used. Survey staff and review your systems. Most firms are surprised by how much AI is already in use.
2. Decide on approved tools. Choose secure tools that fit how your firm works, and set them up properly. Staff are far less likely to use risky free tools when good approved ones are available.
3. Write the policy. Keep it to a few pages. Use plain language and real examples from your practice areas.
4. Train your people. A policy only works if people understand it. Short, practical sessions work best.
5. Review it regularly. AI tools and professional guidance are changing quickly. Review the policy at least every six months.

Common mistakes to avoid

• Banning AI outright. Bans rarely work. Staff simply use AI on their phones or personal laptops, where the firm has no control at all.
• Copying a generic template. A policy written for another country or industry will miss South African requirements such as POPIA and LPC obligations.
• Writing it and forgetting it. Without training and regular review, the policy quickly falls out of step with how people actually work.

Frequently asked questions

Is it legal for South African attorneys to use ChatGPT?

Yes, but responsibility stays with the practitioner. Attorneys must check AI output, protect client confidentiality and comply with POPIA. An AI policy makes those duties clear for everyone in the firm.

Does a small firm really need an AI policy?

Yes. Small firms often have no IT team to spot risky AI use, so a short, clear policy matters even more. It does not need to be long to be effective.

What is the biggest AI risk for a law firm?

The two biggest risks are confidential client information leaving the firm through public AI tools, and unchecked AI output, such as fake case citations, reaching a client or a court.

How long does it take to put an AI policy in place?

For most small and mid-sized firms, a few weeks. That covers reviewing current AI use, choosing approved tools, writing the policy and training staff.

Get help with your firm’s AI policy

As a Service helps South African law firms find out how AI is already being used, choose secure tools and put a practical policy in place. Learn more about our shadow AI reviews and IT and AI strategy for law firms, or book a consultation.