Can a Paralegal Use AI Unsupervised? What NJ's RPC 5.3 Actually Requires of Small Firm Attorneys

Your paralegal is faster than ever. She's drafting demand letters in twenty minutes, summarizing deposition transcripts before lunch, and generating first-pass discovery responses with an AI tool she found on her own. You glance at the output, it looks good, and you sign off.

That workflow has a name in the New Jersey Rules of Professional Conduct: a potential RPC 5.3 violation waiting to happen.

Non-lawyer supervision has always been a background obligation — something solo and small-firm attorneys acknowledge in the abstract but rarely operationalize. The arrival of AI in the hands of support staff has made that neglect genuinely dangerous. Here's why, and what you need to do about it now.

---

What RPC 5.3 Actually Says

Under New Jersey's RPC 5.3, attorneys with supervisory authority over non-lawyer staff — which includes every solo who employs a paralegal, legal assistant, or virtual administrative aide — must make "reasonable efforts" to ensure those staff members behave in ways compatible with the lawyer's professional obligations.

That duty isn't satisfied by assuming competence. It requires affirmative systems: clear instructions, meaningful review, and accountability structures that would surface a problem before it reaches a client or a court.

When a paralegal uses an AI tool without guardrails, several of the attorney's own obligations flow directly through RPC 5.3:

• RPC 1.6 (Confidentiality): Did the staffer paste client documents into a consumer AI tool with no data processing agreement? That's the lawyer's exposure, not just the employee's mistake.
• RPC 3.3 (Candor to the Tribunal): If AI-generated content with a hallucinated citation ends up in a filed brief because the supervising attorney's review was cursory, the lawyer — not the paralegal — faces sanctions.
• RPC 1.1 (Competence): The NJ Supreme Court's evolving competence standard increasingly encompasses understanding how the tools your firm uses actually work, even if a non-lawyer operates them.

---

The Specific Problem With AI and Non-Lawyer Staff

Traditional non-lawyer supervision risks were bounded: a paralegal could mis-cite a statute, miss a deadline, or send a document to the wrong party. Those errors were usually detectable with normal review.

AI compounds the problem in three ways that traditional supervision frameworks weren't designed to catch:

1. Output confidence masks errors. AI-generated text is fluent and authoritative-sounding. A paralegal — and even a reviewing attorney — can mistake polish for accuracy. Hallucinated case citations don't look like mistakes. They look like citations.

2. The input is the violation. With prior tools, the risk was in the output. With AI, uploading a confidential client file to an unsanctioned platform is itself the ethics problem, regardless of what comes back. By the time you review the output, the breach may already have occurred.

3. Staff will iterate without telling you. Employees adopt AI tools incrementally and informally. Your paralegal isn't trying to create liability — she's trying to do her job faster. But each new use case she explores without guidance is a new surface area for RPC 5.3 exposure.

---

What "Reasonable Efforts" Looks Like in a Small NJ Firm

The good news is that RPC 5.3 compliance doesn't require enterprise-scale governance. It requires documented, proportionate systems. For a solo or two-attorney firm, that means:

Maintain an approved tools list. Every AI tool a non-lawyer staffer uses should be expressly authorized by you — not discovered by you after the fact. This list doesn't need to be long or formal. It can live in a shared document. What matters is that it exists and is enforced.

Define what tasks AI can assist with — and which require attorney hands-on review. Court filings, client-facing communications, and any document that will be represented as accurate to a third party should trigger a mandatory attorney review step, not a cursory glance.

Create an input rule. No client-identifying information goes into any AI tool that hasn't been vetted for data handling — period. This single rule, enforced consistently, eliminates the largest confidentiality exposure vector for most small firms.

Build a lightweight escalation norm. Staff should know to flag any AI output that seems unusual, inconsistent with prior work, or that they can't independently verify. This isn't about distrust — it's about creating a culture where human judgment remains the final layer.

Document your supervision. If the NJ Office of Attorney Ethics ever asks what your oversight of AI-assisted work looked like, "I trusted my paralegal" is not an answer. A brief policy memo, even a one-pager, is meaningfully better than nothing.

---

The Supervisory Responsibility Most Attorneys Are Skipping

The framing attorneys often use — "I review everything before it goes out" — is necessary but not sufficient under RPC 5.3. The rule requires reasonable efforts to prevent conduct that would violate the RPCs, not just catch it after the fact.

That means the obligation runs upstream: to training, to tool authorization, to input rules, and to creating an environment where a paralegal knows exactly where the lines are before she starts typing.

AI has made non-lawyer staff more capable and more efficient. It has also made the supervisory obligations of their employing attorneys more concrete, more technical, and more consequential. The attorneys who recognize that now — and build even minimal systems around it — will be far better positioned than those who are still treating RPC 5.3 as a formality.