Does a NJ Small Firm Actually Need a Written AI Policy? What the Ethics Rules Say and Where to Start

Most NJ solo attorneys I talk to have added at least one AI tool to their practice in the past two years. Many have added three or four. Almost none of them have a written policy governing how those tools get used.

That's not a criticism. Running a solo or small firm means every administrative hour competes with billable work, and a "firm AI policy" sounds like something a 200-lawyer firm's general counsel worries about. But the ethics obligations that point toward having one don't care about firm size, and the NJ Rules of Professional Conduct create some real exposure for practitioners who haven't thought this through in writing.

Here's what the rules actually say, and what a practical policy needs to cover for a one-to-five attorney NJ firm.

Why "We're Careful" Isn't Enough

RPC 5.1 requires supervising attorneys to make reasonable efforts to ensure that the firm has measures in place to prevent ethical violations by other lawyers. RPC 5.3 extends that obligation to non-lawyer staff and vendors. When you hire a paralegal and hand them access to an AI drafting tool, both rules are live. "I told her to be careful" won't satisfy either standard if something goes wrong.

The NJ Supreme Court's Committee on the Unauthorized Practice of Law and the ACPE haven't issued a standalone AI ethics opinion yet as of this writing, but the existing RPCs map onto AI use without much translation required. Competence under RPC 1.1 now includes understanding the tools you use well enough to supervise outputs. Communication under RPC 1.4 reaches the question of whether clients know AI is being used on their matter. These aren't speculative future problems. They're present obligations.

A written policy is how you demonstrate that "reasonable measures" were in place. A court or disciplinary panel looking at a grievance will ask what your firm did systemically, not just what happened in one instance.

What a NJ Small Firm Policy Actually Needs

Forget the 20-page enterprise document. A practical policy for a small firm should fit on two or three pages and answer four core questions.

Which tools are approved, and for what tasks? Name the specific tools your firm uses. Don't leave it open-ended. If a paralegal is authorized to use one AI drafting platform but not another, say so. The policy should specify approved uses: drafting first-pass briefs, summarizing discovery documents, generating research memos for attorney review. It should also specify prohibited uses: generating client-facing advice without attorney review, processing confidential financial data in a tool without a signed data processing agreement, running conflicts checks without the attorney confirming the output against the master list.

What does review look like before anything goes to a client or court? This is the supervision piece under RPC 5.1 and 5.3. The policy should state that no AI output leaves the firm without attorney review, and it should describe what that review entails. For a pleading, that means cite-checking every authority. For a client letter, it means confirming that all factual assertions are accurate and that the legal analysis matches the jurisdiction. Vague language like "attorney will review" doesn't create the paper trail you'd want.

How do we handle client disclosure? NJ doesn't yet have a rule that expressly mandates disclosing AI use to clients, but that doesn't mean you have no obligation. RPC 1.4's communication requirements and RPC 1.5's fee provisions both have implications here, particularly if AI is reducing the time a task takes and you're billing by the hour. Your policy should state your firm's disclosure approach: do you include a standing disclosure in your retainer? Do you disclose on a matter-by-matter basis when AI is used substantively? Pick a position and document it. Inconsistency creates its own risk.

What data can go into which tools? This is where most small firms have a genuine gap. Not every AI tool you're using has a signed data processing agreement or a BAA if health information is involved. Your policy should prohibit staff from entering client names, matter-specific facts, or identifying information into any tool not on the approved list. It should also require that any new tool proposed for firm use go through a basic vendor review before adoption. That review doesn't need to be elaborate, but it should confirm at minimum: where data is stored, whether the vendor trains on your inputs, and what the contract says about confidentiality.

The One Section Most Templates Leave Out

Sample AI policies circulating online tend to skip the escalation protocol. What happens when a staff member isn't sure whether a particular use is covered? What happens when an AI tool produces an output that looks plausible but something feels off?

Your policy should have a named point of contact for those questions, even if that's just you, and a stated expectation that the question gets asked before the output gets used. Building that reflex into firm culture is worth more than any checklist.

A Practical Starting Point

If you're starting from scratch, draft your policy around the four questions above. Keep the language specific to your actual tools and workflows, not generic. Date it, sign it, and share it with anyone who works in your firm, including contract support staff. Review it any time you add a new tool or change how an existing one is being used.

The NJ Bar will almost certainly issue more specific guidance on AI in the next 12-24 months. Having a documented policy in place now means you're updating an existing framework rather than building one after a problem surfaces.