Storing Client Files in the Cloud While Using AI: What ACPE Opinion 701 Still Requires NJ Attorneys to Do

Most solo practitioners in New Jersey know about the Supreme Court's "Preliminary Guidelines on New Jersey Lawyers' Use of Artificial Intelligence," issued January 24, 2024. Fewer have gone back to read ACPE Opinion 701, the Advisory Committee on Professional Ethics opinion from 2006 that still governs how attorneys store client information electronically.

That's a problem, because the two authorities address different parts of the same workflow. Understanding what each one actually covers, and where they stop talking to each other, is probably the most underappreciated compliance gap for NJ solos using any AI tool that touches client files.

What ACPE Opinion 701 Actually Says

ACPE Opinion 701 (2006) addressed whether a New Jersey attorney may store client files using a third-party internet-based server. The opinion answered yes, subject to specific conditions grounded in RPC 1.6, which governs confidentiality of client information.

The opinion holds that an attorney using cloud storage must: (1) take reasonable precautions to ensure the provider maintains adequate security measures, (2) stay informed of the provider's actual practices, and (3) have a reasonable basis to conclude that the provider's confidentiality protections are comparable to what the attorney would otherwise maintain.

Opinion 701 was written before "AI" meant anything close to what it means today. It was thinking about file servers and early cloud storage, not about large language models that ingest document content to return a legal summary. But the core obligation it creates is durable: your duty to investigate the vendor's security practices does not disappear just because the tool is newer.

Where the 2024 AI Guidelines Pick Up

The NJ Supreme Court's Preliminary Guidelines, issued January 24, 2024, speak to competence, supervision, and accuracy verification when using AI. They remind attorneys that AI outputs require human review and that the supervising attorney remains responsible for any work product the AI contributes to.

The guidelines do not create new confidentiality rules. They explicitly note that existing RPCs, including RPC 1.6, continue to apply to AI use. That sentence is doing a lot of work. What it means in practice is that uploading a client's contract to a generative AI tool for analysis triggers the same Opinion 701 analysis that uploading that contract to a file server did in 2006. The question is still: does this vendor have adequate security measures? Do I have a reasonable basis to believe so?

The Gap That Neither Authority Fills

Here is where a careful NJ attorney hits real uncertainty. Opinion 701 tells you to investigate the vendor. The 2024 guidelines tell you to maintain competence and review AI output. Neither tells you what "adequate security" looks like for an AI platform specifically.

To answer that question, you have to do your own work. For most AI tools marketed to legal professionals, this means reviewing the vendor's terms of service for data retention clauses (does the vendor train on your input?), looking for a data processing addendum or legal-specific privacy policy, and checking whether the product offers a business associate agreement if any health-related client data might be involved.

A hypothetical worth sitting with: imagine a solo family law attorney in Newark who uses a general-purpose AI assistant to draft settlement agreement language. She pastes in her client's financial disclosure. She has not read the vendor's terms. Under Opinion 701, that is not a reasonable precaution, regardless of what the 2024 guidelines say about verifying the AI's output.

The 2024 guidelines make it easy to focus on accuracy: "Did the AI hallucinate a case citation?" But Opinion 701 forces you to ask the prior question: "Should I have given the AI this information at all?"

A Practical Sequencing That Works

The two authorities actually sequence well if you treat Opinion 701 as the gate and the 2024 guidelines as the operating rules once you're through it.

Before any client data touches an AI tool, run the Opinion 701 check: review the vendor's security representations, confirm the data is not used for model training (or that you've opted out), and document that review in your own records. Many vendors have a separate "enterprise" or "professional" tier with stronger data commitments than the consumer product. That distinction matters for your RPC 1.6 analysis.

Once you've cleared that gate, the 2024 guidelines take over: supervise the output, verify citations independently, and do not file or send anything the AI generated without your own substantive review.

Running these in the wrong order, or skipping the Opinion 701 step entirely because the 2024 guidelines feel newer and more relevant, is the compliance mistake most likely to create exposure for a NJ solo attorney right now.

The ACPE has issued no AI-specific opinion to date. Until it does, Opinion 701 and the 2024 Preliminary Guidelines are the two anchors you have. Read them together, not as alternatives.

What the rule requires

NJ RPC 1.6 prohibits revealing information relating to the representation of a client unless an exception applies. ACPE Opinion 701 (2006) holds that an attorney using a third-party electronic storage provider must take reasonable precautions to verify that the provider maintains adequate security, stay informed of the provider's actual security practices, and have a reasonable basis to believe the provider's confidentiality protections are comparable to those the attorney would otherwise provide. The NJ Supreme Court's Preliminary Guidelines on New Jersey Lawyers' Use of Artificial Intelligence (January 24, 2024) state that existing RPCs, including RPC 1.6, continue to apply to the use of AI tools, and require that attorneys supervise AI output and take responsibility for any AI-assisted work product.

What I recommend

Review your AI vendor's data terms before any client content touches the tool, not after. Specifically check whether your input is used to train the model, and opt out or choose a product tier that prohibits that use. Save a copy of the vendor's privacy policy or data processing addendum at the time you begin using the product so you have a contemporaneous record of your reasonable-precaution review under Opinion 701. If the vendor won't tell you how it handles your data, that is itself an answer. For AI tools used in matters involving health information, check whether a business associate agreement is available. Treat Opinion 701 as a pre-flight checklist and the 2024 guidelines as your in-flight rules, and run them in that order every time you add a new tool to your practice.