SOC 2 Reports and the NJ Supreme Court's AI Guidelines: Is "Reasonable Efforts" Actually Measurable?

The phrase "reasonable efforts" appears in NJ RPC 1.6(c) as the standard for protecting confidential client information against unauthorized disclosure. The NJ Supreme Court's Preliminary Guidelines on New Jersey Lawyers' Use of Artificial Intelligence, issued January 24, 2024, carry that same standard into the AI context without defining what it looks like when you're evaluating a legal AI tool. That gap is the practical problem.

Most solo attorneys read "reasonable efforts" and think: I read the privacy policy, I didn't see anything alarming, I moved on. That probably isn't enough. Here's why, and here's a more defensible approach.

What the Guidelines actually say about data protection

The January 24, 2024 Preliminary Guidelines state that attorneys using AI tools remain bound by their existing professional obligations, including confidentiality under RPC 1.6. The Guidelines do not create a new data-protection checklist, but they make clear that using an AI tool does not suspend any existing duty. RPC 1.6(c) requires that a lawyer "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

The Guidelines also reference competence under RPC 1.1, which the NJ Supreme Court has consistently read to include understanding the tools an attorney uses. Taken together, those two threads point in one direction: before you feed a client's contract or deposition transcript into an AI platform, you need to understand, at a meaningful level, what that platform does with the data.

Why reading the privacy policy isn't the same as diligence

Privacy policies are written to protect the vendor, not the client. They often include broad rights to use "aggregated" or "de-identified" data for model training, and the definition of de-identified varies widely. Some policies permit the vendor to retain uploaded content indefinitely. Others allow disclosure to affiliated entities without naming them.

The more useful documents are the ones vendors produce for enterprise and regulated-industry buyers: SOC 2 Type II audit reports, data processing agreements (DPAs), and sub-processor lists. These aren't perfect either, but they're written to be audited, which means the representations in them carry weight that a marketing-facing privacy page doesn't.

A SOC 2 Type II report tells you whether a vendor's security controls operated effectively over a defined period, typically six to twelve months. It covers availability, confidentiality, and processing integrity, among other trust principles. It does not guarantee zero breaches, but it does tell you the vendor takes its controls seriously enough to pay for an outside audit.

For an NJ solo attorney, the specific questions to ask a vendor before uploading client data are:

• Do you have a current SOC 2 Type II report, and will you share it under NDA?
• Does your default product tier use client-uploaded content to train or fine-tune any model?
• Where is data stored, and is US-only storage available or default?
• Who are your sub-processors with access to uploaded content?
• Will you sign a DPA that limits use of our data to service delivery only?

If the vendor can't answer all five, or won't, that's a data point. It doesn't automatically disqualify the tool, but it should factor into your risk assessment and potentially into whether you anonymize data before uploading.

What "reasonable" looks like at the solo-firm level

Courts and disciplinary bodies have not yet set a bright-line standard for AI vendor diligence in New Jersey. The January 24, 2024 Preliminary Guidelines are preliminary by their own terms, and the Advisory Committee on Professional Ethics has not issued an AI-specific opinion as of this writing. So "reasonable" is currently a facts-and-circumstances inquiry tied to what a competent attorney would do.

A useful benchmark: if you were sending the same client files to a cloud storage vendor, what would you check? ACPE Opinion 701 (2006) addressed electronic storage and outsourcing, and it held that attorneys must exercise reasonable care in selecting outside providers and must ensure that third parties maintain appropriate confidentiality. That standard, issued almost twenty years ago for cloud storage, applies just as squarely to AI platforms that ingest client documents.

The practical floor, in my reading, is this: review the vendor's data terms, ask the five questions above, document your review in your file, and make a conscious decision about whether the tool is appropriate for the matter type. For a hypothetical solo handling a sensitive employment discrimination matter, running the client's personnel file through a general-purpose AI with no enterprise data agreement is a harder call than using a purpose-built legal tool with a signed DPA and a SOC 2 report on file.

That documentation step is what separates "reasonable efforts" from a post-hoc rationalization.

What the rule requires

NJ RPC 1.6(c) requires a lawyer to make reasonable efforts to prevent unauthorized disclosure of or access to client information. The NJ Supreme Court's Preliminary Guidelines on New Jersey Lawyers' Use of Artificial Intelligence (January 24, 2024) confirm that existing confidentiality obligations apply when attorneys use AI tools. ACPE Opinion 701 (2006) holds that attorneys must exercise reasonable care in selecting outside providers and must take steps to ensure those providers maintain confidentiality of client information. None of these sources specifies SOC 2 reports or DPAs by name.

What I recommend

Ask every AI vendor the five questions listed above before uploading any client data. Request the SOC 2 Type II report and a DPA, even if the vendor's sales rep seems surprised by the ask. Document the conversation and your decision in your matter file or a separate vendor-review log. For matters involving particularly sensitive facts, consider anonymizing or redacting identifying information before running content through the tool. Revisit your assessment annually or when the vendor updates its terms, whichever comes first. This isn't about perfection; it's about having a defensible record that you took the obligation seriously before something went wrong.