Implementation Guide: Generate demand letters, legal memos, and client status updates

Hardware Procurement

Software Procurement

Prerequisites

• Business-grade internet connection: minimum 100 Mbps symmetric (fiber preferred) with a secondary failover connection (LTE or secondary ISP). All AI processing is cloud-based and latency-sensitive.
• Active Microsoft 365 tenant with Business Standard or higher licenses assigned to all users. Verified custom domain (e.g., firmname.com) configured for Exchange Online.
• Microsoft Entra ID (formerly Azure AD) configured with Multi-Factor Authentication (MFA) enforced for all users via Conditional Access policies. Security Defaults enabled at minimum.
• Windows 11 Pro (version 23H2 or later) on all workstations with TPM 2.0 enabled. Macs must run macOS Sonoma 14.x or later.
• Current web browsers: Microsoft Edge (Chromium) v120+ or Google Chrome v120+ on all machines. Required for Clio web app and Copilot web experiences.
• Microsoft 365 Apps for Business installed on all workstations (included with Business Standard). Required for Copilot integration in desktop Word, Outlook, and Teams.
• Firm-wide AI Acceptable Use Policy drafted and approved by managing partner(s). Must cover: permissible use cases, prohibited data inputs, mandatory attorney review requirements, client disclosure obligations per ABA Opinion 512.
• Updated client engagement letters with AI disclosure language. Template language must be approved by the firm's ethics/compliance partner before any AI tools go live with client data.
• Clio Complete subscription activated with firm administrator account. All matters, contacts, and document templates migrated from legacy system (if applicable).
• DNS records configured: SPF, DKIM, DMARC for email security. CNAME records for Clio custom domain (if using Clio Connect portal with custom branding).
• Completed vendor due diligence checklist for Clio (SOC 2 Type II report reviewed, DPA executed, confirmation that client data is excluded from model training) and Microsoft (DPA executed, data residency confirmed to US region).
• FortiGate 40F firewall deployed and configured at office with FortiGuard UTM subscription active. VPN configured for remote attorney access.
• Backup solution (Veeam for M365) configured and initial baseline backup completed for all mailboxes and OneDrive accounts.

Installation Steps

Step 1: Network Infrastructure & Security Baseline

Deploy and configure the FortiGate 40F firewall, FortiAP wireless access points, and UPS units. Establish the secure network foundation that all cloud AI traffic will traverse. Configure VPN profiles for remote attorney access, SSL inspection policies (with certificate deployment to all endpoints), and content filtering to block known AI shadow-IT platforms (e.g., personal ChatGPT, Claude.ai) to prevent inadvertent client data leakage.

config system interface
  edit port1
    set ip 192.168.1.1 255.255.255.0
    set allowaccess ping https ssh
  next
end
config system dns
  set primary 208.67.222.222
  set secondary 208.67.220.220
end
# Enable FortiGuard web filtering
config webfilter profile
  edit 'Legal-AI-Policy'
    config ftgd-wf
      config filters
        edit 1
          set category 2
          set action block
        next
      end
    end
  next
end
# Block unauthorized AI platforms
config webfilter urlfilter
  edit 1
    set name 'Block-Shadow-AI'
    config entries
      edit 1
        set url 'chat.openai.com'
        set type wildcard
        set action block
      next
      edit 2
        set url 'claude.ai'
        set type wildcard
        set action block
      next
      edit 3
        set url 'bard.google.com'
        set type wildcard
        set action block
      next
    end
  next
end

Step 2: Microsoft 365 Tenant Configuration & Hardening

Configure the Microsoft 365 tenant with security best practices, assign licenses, and prepare for Copilot deployment. Enable Conditional Access policies, configure data loss prevention (DLP) policies for legal content, and set up sensitivity labels for attorney-client privileged documents.

# Connect to Microsoft Graph PowerShell
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes 'User.ReadWrite.All','Organization.ReadWrite.All','Policy.ReadWrite.ConditionalAccess'
# Verify all users have M365 Business Standard license
Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, AssignedLicenses

Step 3: Assign Microsoft 365 Copilot Business Licenses

Purchase and assign Copilot Business add-on licenses to all 15 users through your CSP distributor (Pax8, Ingram Micro, Sherweb, or AppDirect). Copilot requires an eligible M365 base license already assigned. Verify Copilot activation and run a quick validation test.

Connect-MgGraph -Scopes 'User.ReadWrite.All'
$CopilotSkuId = (Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq 'Microsoft_365_Copilot' }).SkuId
$users = Get-MgUser -All -Filter "department eq 'Legal'"
foreach ($user in $users) {
  Set-MgUserLicense -UserId $user.Id -AddLicenses @{SkuId = $CopilotSkuId} -RemoveLicenses @()
  Write-Host "Assigned Copilot to $($user.DisplayName)"
}
# Verify assignment
Get-MgUser -All | Select-Object DisplayName, @{N='Copilot';E={(Get-MgUserLicenseDetail -UserId $_.Id | Where-Object {$_.SkuPartNumber -like '*Copilot*'}).SkuPartNumber}}

Step 4: Clio Complete Deployment & Configuration

Set up Clio Complete for the entire firm. Configure practice areas, matter templates, custom fields, user roles, and document management settings. Enable Manage AI features and configure Clio Connect (client portal) for automated status update delivery.

Step 5: Configure Clio Integrations

Connect Clio to the firm's existing software ecosystem: Microsoft 365 (Outlook, OneDrive), DocuSign, and accounting software (QuickBooks Online). These integrations ensure AI-generated documents flow seamlessly through the firm's workflows.

Step 6: Deploy Cisco Umbrella DNS Security on All Endpoints

Install Cisco Umbrella roaming client on all workstations and configure DNS-layer protection. This ensures attorneys working remotely still have shadow-AI blocking and threat protection even when outside the FortiGate perimeter.

nslookup debug.opendns.com

# Custom block list — unauthorized AI platforms
chat.openai.com
claude.ai
bard.google.com
copilot.microsoft.com/personal

# Allow list
*.clio.com
*.goclio.com
copilot.microsoft.com

Step 7: Build Legal Document Templates in Clio

Create structured document templates within Clio's document management system for the three primary use cases: demand letters, legal memos, and client status updates. These templates serve as the foundation for AI-assisted drafting—Manage AI uses template structure plus matter data to generate contextually relevant first drafts.

# TEMPLATE 1: DEMAND LETTER — Key merge fields
{firm.name}, {firm.address}, {firm.phone}
{matter.client.name}, {matter.client.address}
{matter.opposing_counsel.name}, {matter.opposing_counsel.address}
{matter.description}, {matter.custom_field.incident_date}
{matter.custom_field.demand_amount}
{matter.custom_field.statute_of_limitations_date}
{user.name}, {user.bar_number}

# TEMPLATE 2: LEGAL MEMORANDUM — Key merge fields
{matter.client.name}, {matter.description}
{matter.practice_area}, {user.name}

# TEMPLATE 3: CLIENT STATUS UPDATE — Key merge fields
{matter.client.first_name}
{matter.description}, {matter.status}
{matter.next_task.description}, {matter.next_task.due_date}
{matter.custom_field.last_filing_date}
{user.name}, {user.phone}

Step 8: Build Custom Prompt Library for AI-Assisted Drafting

Create a curated library of tested, firm-specific prompts that attorneys can use with both Clio Manage AI and Microsoft 365 Copilot to generate high-quality first drafts. Deploy these prompts as a shared resource accessible to all firm users. This is the most critical value-add step for the MSP.

Step 9: Configure Attorney Review & Approval Workflow

Implement a mandatory human-review workflow that ensures no AI-generated document leaves the firm without licensed attorney review and approval. This is required by ABA Formal Opinion 512 (Rules 1.1, 5.1, 5.3) and is non-negotiable. Configure workflow automation in Clio and Microsoft 365 to enforce this gate.

Clio Workflow Configuration

Microsoft 365 Power Automate Flow (for Copilot-generated content)

Step 10: Enable Audit Logging & Compliance Monitoring

Configure comprehensive audit logging for all AI interactions across both Clio and Microsoft 365. This creates the defensible record required by ABA Opinion 512 and enables the MSP to monitor for policy violations, shadow AI usage, and unusual data access patterns.

• MICROSOFT 365 AUDIT LOG — Navigate to: compliance.microsoft.com > Audit
• Verify Unified Audit Log is enabled (on by default for M365 Business)
• Set retention to maximum available (180 days for Business Standard)
• Search for Copilot events: filter by 'CopilotInteraction' activity
• MICROSOFT 365 COPILOT USAGE REPORTING — Navigate to: admin.microsoft.com > Reports > Usage > Copilot
• Review weekly: active users, documents generated, features used
• Export monthly report for client review
• POWER AUTOMATE: SHADOW AI ALERT — Create flow: 'Shadow AI Detection Alert'
• Trigger: Scheduled (daily at 6 AM)
• Action 1: Query Umbrella API for blocked AI site attempts
• Action 2: If count > 0, send email alert to MSP and firm admin
• Action 3: Log incidents in SharePoint 'AI Compliance Log' list
• CLIO AUDIT TRAIL — Navigate to: Settings > Activity Feed (admin view)
• Review AI document generation events
• Export monthly for compliance file
• Note: Clio maintains its own comprehensive audit log of all user actions
• Create SharePoint List: 'AI Usage Compliance Log'
• Columns: Date, User, Platform, DocumentType, MatterID, ReviewedBy, ReviewDate, Status
• Purpose: Central compliance record for ethics inquiries

Step 11: Pilot Testing with 2–3 Attorneys

Before firm-wide rollout, run a 2-week supervised pilot with 2–3 tech-forward attorneys across different practice areas. Each attorney generates at least 5 demand letters, 3 legal memos, and 10 client status updates using the AI tools. Collect structured feedback on quality, accuracy, and workflow efficiency.

• No CLI commands — this is a supervised user testing phase

Pilot Structure

Week 1: Supervised Drafting (MSP engineer present for first 2 sessions)

• Day 1–2: Demand letter generation (2 per attorney)
• Day 3–4: Legal memo generation (1–2 per attorney)
• Day 5: Client status updates (3–5 per attorney)

Week 2: Independent Drafting with Feedback Collection

• Attorneys draft independently using prompt library
• Complete feedback form after each document
• MSP reviews all feedback at end of week

Feedback Form (Deploy via Microsoft Forms)

Create the feedback form at forms.microsoft.com. Include the following questions:

Step 12: Firm-Wide Rollout & Attorney Training

Deploy the solution to all remaining users with structured training sessions. Conduct separate sessions for attorneys and paralegals/staff, as their use cases and compliance obligations differ. Provide recorded training for future onboarding.

Training Session Schedule (2 Days)

• SESSION 1: Attorneys (2 hours)
• AI ethics overview: ABA Opinion 512, firm AI policy review (30 min)
• Clio Manage AI: Drafting demand letters and memos (45 min)
• M365 Copilot: Refining drafts in Word, status updates in Outlook (30 min)
• Review workflow walkthrough: checklist completion (15 min)

• SESSION 2: Paralegals & Staff (1.5 hours)
• AI policy overview: what staff can and cannot do with AI (20 min)
• Clio document templates: triggering AI drafts for attorney review (30 min)
• Workflow management: tracking AI drafts through approval (20 min)
• Quality checks: what to flag before attorney review (20 min)

• SESSION 3: All Users (30 min)
• Prompt library walkthrough and live demo
• Q&A

Recording & Storage Instructions

• Record all sessions via Teams Meeting recording
• Save recordings to: SharePoint > Firm Intranet > Training Videos > AI Tools

Post-Training Checklist (Per User)

Custom AI Components

Demand Letter Generator Prompt

For use in: Clio Manage AI (primary) or M365 Copilot in Word (secondary)

PROMPT TEMPLATE (copy into Clio Manage AI or Copilot):

You are a senior litigation attorney at [FIRM NAME] drafting a demand letter on behalf of our client. Generate a professional demand letter using the following case details. The letter must be authoritative, factually precise, and legally sound.

CASE INFORMATION:

• Client Name: [PULL FROM CLIO: matter.client.name]
• Client Address: [PULL FROM CLIO: matter.client.address]
• Recipient (Opposing Party/Insurer): [PULL FROM CLIO: matter.opposing_party.name]
• Recipient Address: [PULL FROM CLIO: matter.opposing_party.address]
• Date of Incident: [PULL FROM CLIO: matter.custom_field.incident_date]
• Type of Claim: [SELECT: Personal Injury / Breach of Contract / Property Damage / Employment / Other]
• Jurisdiction: [PULL FROM CLIO: matter.custom_field.jurisdiction]
• Statute of Limitations Deadline: [PULL FROM CLIO: matter.custom_field.sol_date]
• Demand Amount: [PULL FROM CLIO: matter.custom_field.demand_amount]

FACTUAL SUMMARY:

DAMAGES BREAKDOWN:

• Medical Expenses (to date): $[AMOUNT]
• Future Medical Expenses (estimated): $[AMOUNT]
• Lost Wages (to date): $[AMOUNT]
• Future Lost Earning Capacity: $[AMOUNT]
• Pain and Suffering: $[AMOUNT]
• Property Damage: $[AMOUNT]
• Other Damages: $[DESCRIPTION AND AMOUNT]

INSTRUCTIONS:

USAGE INSTRUCTIONS FOR ATTORNEYS:

PRACTICE AREA VARIANTS:

• Personal Injury: Add sections for medical provider liens, insurance policy limits, and medical narrative
• Breach of Contract: Add sections for contract terms, performance/non-performance, and cure notice
• Employment: Add sections for statutory violations (FLSA, Title VII), administrative exhaustion, and statutory damages
• Collections: Add sections for account details, payment history, and statutory interest calculations

Legal Memorandum Generator Prompt

For use in: Clio Manage AI (primary) or M365 Copilot in Word (secondary)

PROMPT TEMPLATE:

You are a senior associate attorney at [FIRM NAME] preparing an internal legal memorandum. Draft a comprehensive memo using the IRAC format (Issue, Rule, Application, Conclusion). This memo is for internal use by the supervising attorney and will NOT be sent to the client or filed with any court.

MEMORANDUM HEADER:

• TO: [Supervising Attorney Name]
• FROM: [Drafting Attorney Name]
• DATE: [Today's Date]
• RE: [PULL FROM CLIO: matter.client.name] — [PULL FROM CLIO: matter.description]
• MATTER #: [PULL FROM CLIO: matter.number]

QUESTION(S) PRESENTED:

Example: Whether [Client Name]'s claim for [type of claim] against [Opposing Party] is likely to survive a motion to dismiss under [jurisdiction] law.

RELEVANT FACTS:

[ATTORNEY INPUT: Provide all material facts in chronological order. Include dates, parties, key documents, and any contested facts. Note which facts are established vs. disputed.]

JURISDICTION & GOVERNING LAW:

• State/Federal: [SPECIFY]
• Jurisdiction: [PULL FROM CLIO: matter.custom_field.jurisdiction]
• Governing Statutes (if known): [ATTORNEY INPUT]
• Key Case Law (if known): [ATTORNEY INPUT — do not ask AI to find cases]

INSTRUCTIONS:

POST-GENERATION REFINEMENT (Copilot in Word):

• Strengthen the application section for Question 2 with more detailed fact analysis
• Add counterarguments to the Rule section
• Summarize the conclusion in plain language for a client-facing version
• Identify and flag any statements that need citation support

CRITICAL WARNING FOR ATTORNEYS:

Client Status Update Generator Prompt

For use in: Copilot in Outlook (primary) or Clio Manage AI (secondary)

PROMPT TEMPLATE FOR COPILOT IN OUTLOOK:

Draft a client status update email for [Client First Name] regarding their [matter type] case. Use a warm, professional, and reassuring tone. The client is not a lawyer — use plain language and avoid legal jargon where possible.

CASE STATUS DETAILS:

• Client Name: [Client First Name Last Name]
• Matter Type: [e.g., Personal Injury, Divorce, Business Dispute]
• Current Phase: [SELECT: Initial Investigation / Discovery / Negotiations / Pre-Trial / Trial Preparation / Settlement / Post-Resolution]
• Last Significant Event: [DESCRIBE: e.g., 'Filed the complaint on May 15, 2025', 'Received defendant's discovery responses on June 1, 2025']
• Next Steps: [DESCRIBE: e.g., 'Schedule depositions of defendant and two witnesses', 'Review settlement offer and prepare counteroffer']
• Expected Timeline for Next Steps: [e.g., '2-3 weeks', 'by end of July 2025']
• Action Required from Client: [DESCRIBE or 'None at this time']
• Upcoming Deadlines/Dates: [e.g., 'Mediation scheduled for August 15, 2025']

INSTRUCTIONS:

CLIO CONNECT PORTAL VERSION:

For firms using Clio Connect client portal, modify the prompt to generate a portal message instead of email:

• Remove email formatting (subject line, footer)
• Add: 'Format as a brief portal update message, 100-200 words'
• Clio Connect will automatically notify the client of the new message

BATCH STATUS UPDATE WORKFLOW:

For monthly client status updates across all active matters:

TONE VARIANTS:

• Positive Update: 'I'm pleased to share some good news about your case...'
• Neutral Update: 'I wanted to provide you with an update on where things stand...'
• Delay/Setback: 'I want to be transparent with you about a development in your case...'
• Action Required: 'I need your help with something important for your case...'

AI Document Review Checklist Workflow

Type: workflow

An automated workflow in Clio and Power Automate that enforces mandatory attorney review of all AI-generated documents before they can be sent to clients, filed with courts, or shared externally. This is the core compliance control required by ABA Formal Opinion 512.

Implementation:

# AI DOCUMENT REVIEW CHECKLIST WORKFLOW

Implementation across Clio Workflows + Microsoft Power Automate

CLIO WORKFLOW CONFIGURATION:

• Workflow Name: AI-Generated Document Review
• Trigger: Document tagged 'AI-Generated' is added to any matter
• Auto-tag rule: Any document created via Manage AI automatically receives the 'AI-Generated' tag

Workflow Steps:

1. Create Review Task

• Task name: 'REVIEW REQUIRED: AI-Generated [Document Type] for [Client Name]'
• Assigned to: Matter's Responsible Attorney
• Due date: 24 hours from document creation
• Priority: High
• Task description includes the full checklist below

2. Review Checklist (embedded in task):

AI DOCUMENT REVIEW CHECKLIST
================================
Matter: {matter.display_number} - {matter.client.name}
Document: {document.name}
Generated: {document.created_at}

Factual Accuracy

Legal Accuracy

Formatting & Professionalism

Compliance

Attorney Certification

Reviewed by: _______________
Date: _______________
Bar #: _______________

3. On Task Completion:

• Change document status from 'Draft' to 'Attorney Approved'
• Log completion in AI Compliance SharePoint list
• Notify paralegal/secretary that document is approved for finalization
• If document is a demand letter: prompt 'Send via DocuSign?' option

4. Escalation (if not completed within 48 hours):

• Send reminder to assigned attorney
• CC managing partner
• Log overdue review in compliance dashboard

POWER AUTOMATE COMPANION FLOW:

• Flow Name: AI-Document-Compliance-Logger
• Trigger: When a Clio task with name containing 'REVIEW REQUIRED: AI-Generated' is completed

Actions

MONTHLY COMPLIANCE REPORT (Power Automate Scheduled Flow)

• Trigger: 1st of each month at 8:00 AM

Actions:

Clio-to-Copilot Matter Context Bridge

Type: integration

A lightweight Power Automate integration that extracts key matter data from Clio and makes it available as a formatted context block that attorneys can paste into Copilot prompts in Word or Outlook. This bridges the gap between Clio's matter-specific AI (Manage AI) and Microsoft's general-purpose AI (Copilot) for scenarios where attorneys prefer working in Word.

Implementation:

# CLIO-TO-COPILOT MATTER CONTEXT BRIDGE

Power Automate Cloud Flow

FLOW OVERVIEW:

When an attorney clicks a button in Teams (or triggers via a SharePoint form), the flow pulls key matter data from Clio's API and formats it as a ready-to-paste context block for use with Copilot in Word/Outlook.

PREREQUISITES:

• Clio API key (generated at app.clio.com/api)
• Power Automate Premium license (included with M365 Business Standard)
• Custom connector for Clio REST API

STEP 1: Create Clio API Custom Connector in Power Automate

STEP 2: Create the Power Automate Flow

• Flow Name: Get-Matter-Context-For-Copilot
• Trigger: For a selected message (Teams) OR Manual trigger with input
• Input: Matter Number (text field)

# Get-Matter-Context-For-Copilot

{
  "trigger": {
    "type": "manual",
    "inputs": {
      "matter_number": {
        "type": "string",
        "description": "Enter the Clio matter number"
      },
      "document_type": {
        "type": "string",
        "description": "Select document type",
        "enum": ["Demand Letter", "Legal Memo", "Client Status Update"]
      }
    }
  },
  "actions": [
    {
      "name": "Search_Clio_Matter",
      "type": "HTTP",
      "method": "GET",
      "uri": "https://app.clio.com/api/v4/matters.json?query=@{triggerBody()['matter_number']}&fields=id,display_number,description,status,practice_area,responsible_attorney,client,statute_of_limitations",
      "headers": {
        "Authorization": "Bearer @{body('Get_Clio_Token')['access_token']}"
      }
    },
    {
      "name": "Get_Client_Contact",
      "type": "HTTP",
      "method": "GET",
      "uri": "https://app.clio.com/api/v4/contacts/@{body('Search_Clio_Matter')['data'][0]['client']['id']}.json?fields=id,name,first_name,address,email,phone_numbers",
      "headers": {
        "Authorization": "Bearer @{body('Get_Clio_Token')['access_token']}"
      }
    },
    {
      "name": "Format_Context_Block",
      "type": "Compose",
      "inputs": "## MATTER CONTEXT (Auto-generated from Clio)\n\n**Matter:** @{body('Search_Clio_Matter')['data'][0]['display_number']} — @{body('Search_Clio_Matter')['data'][0]['description']}\n**Client:** @{body('Get_Client_Contact')['data']['name']}\n**Client Address:** @{body('Get_Client_Contact')['data']['address']}\n**Practice Area:** @{body('Search_Clio_Matter')['data'][0]['practice_area']['name']}\n**Status:** @{body('Search_Clio_Matter')['data'][0]['status']}\n**Responsible Attorney:** @{body('Search_Clio_Matter')['data'][0]['responsible_attorney']['name']}\n**SOL Date:** @{body('Search_Clio_Matter')['data'][0]['statute_of_limitations']}\n\n---\nPaste this context block at the top of your Copilot prompt in Word or Outlook.\nThen add the appropriate prompt from the AI Prompt Library.\n---"
    },
    {
      "name": "Send_To_User_Via_Teams",
      "type": "Teams_PostMessage",
      "channel": "User's chat",
      "message": "@{outputs('Format_Context_Block')}"
    },
    {
      "name": "Copy_To_Clipboard_Card",
      "type": "Teams_AdaptiveCard",
      "body": {
        "type": "AdaptiveCard",
        "body": [
          {
            "type": "TextBlock",
            "text": "Matter context ready! Copy the block below and paste into Copilot:",
            "weight": "Bolder"
          },
          {
            "type": "TextBlock",
            "text": "@{outputs('Format_Context_Block')}",
            "wrap": true
          }
        ],
        "actions": [
          {
            "type": "Action.Submit",
            "title": "Open in Word with Copilot"
          }
        ]
      }
    }
  ]
}

STEP 3: Deploy as Teams Personal App

SECURITY NOTES:

• Clio API token is stored in Power Automate connection (encrypted at rest)
• Flow respects Clio user permissions — attorneys only see matters they have access to
• No client data is stored by the flow; it passes through and is delivered to the requesting user only
• All flow runs are logged in Power Automate run history for audit purposes

AI Acceptable Use Policy Template

Type: prompt

A complete, ready-to-customize AI Acceptable Use Policy document for the law firm, based on ABA Formal Opinion 512 requirements. This is a critical compliance deliverable that the MSP provides as part of the implementation and should be reviewed by the firm's ethics partner before adoption.

Implementation:

# LAW FIRM AI ACCEPTABLE USE POLICY

Template for MSP Customization

[FIRM NAME] ARTIFICIAL INTELLIGENCE ACCEPTABLE USE POLICY

• Effective Date: [DATE]
• Approved By: [Managing Partner Name]
• Last Reviewed: [DATE]
• Next Review: [DATE + 6 months]

1. PURPOSE

This policy establishes guidelines for the ethical, secure, and compliant use of artificial intelligence (AI) tools in the practice of law at [FIRM NAME]. This policy is adopted in accordance with the American Bar Association Model Rules of Professional Conduct and ABA Formal Opinion 512 (July 29, 2024), as well as [STATE] Rules of Professional Conduct.

2. SCOPE

This policy applies to all attorneys, paralegals, legal assistants, administrative staff, contract employees, and any third parties who access firm systems or handle client information.

3. APPROVED AI PLATFORMS

The following AI tools are approved for use with client matter data:

4. PERMITTED USES

4.1. Document Drafting: Generating first drafts of demand letters, legal memoranda, client correspondence, and status updates using approved platforms and firm-provided prompt templates.

4.2. Document Review Assistance: Using AI to summarize, analyze, or organize existing documents within approved platforms.

4.3. Administrative Tasks: Time entry descriptions, billing narrative generation, and calendar management within Clio.

4.4. Communication Drafting: Email drafts and client status updates using Copilot in Outlook, subject to attorney review.

5. PROHIBITED USES

• 5.1. No Unreviewed Output: AI-generated content shall NEVER be sent to a client, filed with a court, transmitted to opposing counsel, or shared externally without review and approval by a licensed attorney of this firm.
• 5.2. No Unauthorized Platforms: Client data, case information, and privileged communications shall NEVER be entered into unapproved AI platforms.
• 5.3. No AI-Generated Legal Citations: AI tools shall NOT be relied upon to generate, verify, or validate case citations, statutory references, or regulatory citations. All legal research must be conducted using Westlaw, LexisNexis, or Clio Work (vLex).
• 5.4. No Sensitive Data in Prompts: Social Security numbers, financial account numbers, medical record numbers, and minor children's identifying information shall NOT be included in AI prompts unless absolutely necessary for the task and the platform's data protection has been verified.
• 5.5. No AI for Legal Judgment: AI tools shall not be used as a substitute for professional legal judgment, strategy decisions, or ethical determinations.

6. ATTORNEY REVIEW REQUIREMENTS

6.1. Every AI-generated document must be reviewed using the firm's AI Document Review Checklist before finalization.

6.2. The reviewing attorney assumes full professional responsibility for the content, accuracy, and legal sufficiency of any AI-assisted work product, as if they had drafted it personally.

6.3. Review must include verification that no facts have been hallucinated, all citations are independently verified, and the document is appropriate for the specific jurisdiction and matter.

7. CLIENT DISCLOSURE

7.1. The firm's engagement letter includes disclosure of AI tool usage in accordance with ABA Model Rule 1.4 (Communication) and Rule 1.6 (Confidentiality).

7.2. Clients are informed that AI may be used to assist in document preparation, but that all work product is reviewed and approved by a licensed attorney.

7.3. If a client objects to AI use in their matter, the firm will accommodate this request and document the exception.

8. CONFIDENTIALITY & DATA SECURITY

8.1. All AI platforms used by the firm maintain SOC 2 Type II certification and have executed Data Processing Agreements (DPAs) confirming client data is not used for model training.

8.2. Users shall verify they are logged into their firm account (not personal account) before using any AI tool.

8.3. AI interactions are logged and subject to audit for compliance purposes.

9. SUPERVISION & TRAINING

9.1. All personnel must complete AI training before using AI tools. Training records are maintained by the firm administrator.

9.2. Supervising attorneys are responsible for ensuring supervised attorneys and non-lawyer staff comply with this policy (Model Rules 5.1, 5.3).

9.3. New employees must complete AI training within their first week.

10. BILLING

10.1. Time saved through AI assistance should be reflected in billing. Attorneys shall not bill clients for time that was substantially performed by AI.

10.2. AI-assisted drafting time should be billed at a rate reflecting the actual attorney effort involved (review and revision), not the time it would have taken to draft from scratch.

10.3. The use of AI tools does not change the firm's obligation to charge reasonable fees (Model Rule 1.5).

11. VIOLATIONS

11.1. Violations of this policy may result in disciplinary action up to and including termination.

11.2. Any suspected data breach involving client information and AI tools must be reported immediately to the Managing Partner and firm IT contact.

12. POLICY REVIEW

This policy will be reviewed every six months or whenever significant changes occur in AI technology, ABA guidance, or state bar regulations.

ACKNOWLEDGMENT

I have read, understand, and agree to comply with [FIRM NAME]'s AI Acceptable Use Policy.

• Name: _________________________
• Signature: _________________________
• Date: _________________________
• Bar Number (if attorney): _________________________

MSP CUSTOMIZATION INSTRUCTIONS:

Testing & Validation

• NETWORK TEST: From each workstation, verify internet speed (speedtest.net — confirm 100+ Mbps symmetric), verify FortiGate VPN connectivity from a remote location, and confirm that blocked AI sites (chat.openai.com, claude.ai) return a FortiGuard block page.
• CISCO UMBRELLA TEST: On a laptop connected to non-office Wi-Fi (mobile hotspot), attempt to browse to chat.openai.com and claude.ai — both should be blocked by Umbrella DNS policy. Verify by running 'nslookup debug.opendns.com' and confirming Umbrella resolver response.
• M365 LICENSE TEST: For each user, open Word desktop app and verify the Copilot icon appears in the ribbon (Home tab). Open Outlook and verify Copilot appears in the compose window. Open Teams and verify Copilot appears in the chat sidebar. If Copilot is not visible after 72 hours, check license assignment in admin.microsoft.com.
• COPILOT FUNCTIONALITY TEST: In Word, create a new document and use Copilot to 'Draft a professional business letter requesting payment of an outstanding invoice of $5,000 from ABC Company.' Verify that Copilot generates a coherent, well-formatted letter. Repeat in Outlook: compose a new email and use Copilot to draft a meeting request.
• CLIO MANAGE AI TEST: Open a test matter in Clio with populated client data, opposing party, and custom fields. Use Manage AI to generate a document draft. Verify that the output correctly incorporates matter-specific data (client name, case description, dates). Confirm the generated document is automatically tagged 'AI-Generated' in the document list.
• CLIO INTEGRATION TEST: Send a test email from Outlook to verify it is captured in the corresponding Clio matter via email sync. Create a test document in Clio and verify it can be sent for signature via DocuSign integration. Verify QuickBooks Online sync by creating a test invoice in Clio and confirming it appears in QBO.
• DEMAND LETTER GENERATION TEST: Using the firm's approved demand letter prompt, generate a complete demand letter for a test PI matter with known facts. Have a senior attorney review and score: (a) factual accuracy vs. matter data — must be 100%, (b) legal standards cited — must be generally correct for jurisdiction, (c) formatting — must follow firm template, (d) tone — must be professional and authoritative. Pass criteria: all four categories rated 'acceptable' or better.
• LEGAL MEMO GENERATION TEST: Using the memo prompt, generate a test memo analyzing a straightforward negligence question with provided facts. Verify IRAC format is followed, no case citations are fabricated (prompt instructs against this — verify compliance), and the analysis is logically sound. Have two attorneys independently review and compare assessments.
• CLIENT STATUS UPDATE TEST: Generate 5 client status updates for different test matters using the status update prompt in Copilot/Outlook. Verify each is personalized to the client, uses plain language, includes correct next steps, and does not include prohibited information (dollar amounts, strategy details). Time the process — target is under 3 minutes per update including review.
• REVIEW WORKFLOW TEST: Generate an AI document in Clio and verify: (a) the AI Document Review task is automatically created and assigned to the responsible attorney, (b) the checklist is embedded in the task, (c) upon task completion the document status changes to 'Attorney Approved', (d) the paralegal receives a notification, and (e) the completion is logged in the SharePoint AI_Compliance_Log.
• POWER AUTOMATE CONTEXT BRIDGE TEST: Trigger the Get-Matter-Context-For-Copilot flow from Teams with a valid Clio matter number. Verify the formatted context block is delivered to the requesting user's Teams chat within 30 seconds, contains correct matter data, and can be successfully pasted into a Copilot prompt in Word.
• AUDIT LOG TEST: Generate 3 AI documents across Clio and Copilot. Wait 24 hours, then verify: (a) all Copilot interactions appear in Microsoft 365 Unified Audit Log under 'CopilotInteraction' activity type, (b) all Clio AI usage appears in Clio's Activity Feed, (c) all completed reviews appear in the SharePoint AI_Compliance_Log with correct timestamps and reviewer information.
• SENSITIVITY LABEL TEST: Create a document and apply the 'Attorney-Client Privileged' sensitivity label. Attempt to share this document externally via OneDrive — it should be blocked. Verify the label persists when the document is downloaded and re-uploaded. Confirm that Copilot does not surface content from privileged documents in responses to unauthorized users.
• BACKUP AND RECOVERY TEST: Verify Veeam backup is capturing all M365 data by initiating a test restore of a single mailbox item and a single OneDrive file from the previous day's backup. Confirm the restored items are intact and match the originals. Document recovery time for SLA benchmarking.
• END-TO-END WORKFLOW TEST: Simulate a complete demand letter lifecycle: (1) Create a new matter in Clio with full client/opposing party data, (2) Generate demand letter using Manage AI and the approved prompt, (3) Export to Word for Copilot refinement, (4) Complete the AI Review Workflow checklist in Clio, (5) Apply sensitivity label, (6) Send for signature via DocuSign, (7) Verify the signed document is filed back in the Clio matter. Total time target: under 30 minutes for the entire lifecycle.

Client Handoff

Client Handoff Agenda (2-hour session with Managing Partner + key stakeholders)

1. SOLUTION OVERVIEW (15 min)

• Demonstrate the complete AI document generation workflow end-to-end
• Show a live demand letter generation from Clio matter data through attorney review to DocuSign
• Review the technology stack diagram: Clio Manage AI ↔ Microsoft 365 Copilot ↔ Review Workflow

2. AI ACCEPTABLE USE POLICY REVIEW (20 min)

• Walk through the customized AI Acceptable Use Policy document
• Confirm managing partner approval and signing schedule for all staff
• Review client engagement letter AI disclosure language
• Discuss billing implications (Section 10 of the policy)

3. PROMPT LIBRARY WALKTHROUGH (15 min)

• Demonstrate each of the three core prompts (demand letter, memo, status update)
• Show where prompts are stored (SharePoint page + Teams channel)
• Explain the prompt refinement process and how to request updates

4. COMPLIANCE CONTROLS (15 min)

• Demonstrate the AI Document Review Workflow and checklist in Clio
• Show the audit trail in SharePoint AI_Compliance_Log
• Review the monthly compliance report format
• Discuss the shadow-AI blocking controls (FortiGate + Umbrella)

5. TRAINING RECAP & RESOURCES (10 min)

• Provide access to recorded training sessions (SharePoint > Training Videos)
• Distribute the Quick Reference Card (1-page PDF with key prompts and workflow steps)
• Confirm all users have signed the AI policy acknowledgment

6. SUPPORT & ESCALATION (10 min)

• MSP help desk contact for technical issues (email, phone, portal)
• Response SLA: P1 (system down) = 1 hour, P2 (degraded) = 4 hours, P3 (question) = next business day
• Clio support contact for platform-specific issues: support.clio.com
• Microsoft 365 admin portal access: confirm firm admin credentials

7. SUCCESS CRITERIA REVIEW (15 min)

• Review measurable success metrics:
• 50%+ reduction in first-draft creation time (baseline: track for first 30 days)
• 100% attorney review compliance (zero documents sent without review workflow completion)
• 90%+ user adoption (all licensed users actively using AI tools weekly within 60 days)
• Zero ethics complaints or data incidents related to AI use
• Client satisfaction maintained or improved (survey at 90 days)
• Schedule 30-day post-launch review meeting
• Schedule 90-day optimization review meeting

8. DOCUMENTATION HANDOFF

• Delivered to client (digital + printed): AI Acceptable Use Policy (signed copy)
• Delivered to client (digital + printed): Prompt Library document
• Delivered to client (digital + printed): Quick Reference Card (1-page)
• Delivered to client (digital + printed): Network diagram with all security controls
• Delivered to client (digital + printed): Vendor contact list (Clio, Microsoft, DocuSign)
• Delivered to client (digital + printed): Training video recordings (SharePoint links)
• Delivered to client (digital + printed): AI Document Review Checklist (printable)
• Delivered to client (digital + printed): Monthly compliance report template
• Retained by MSP: Full technical configuration documentation
• Retained by MSP: API keys and admin credentials (in PSA/password vault)
• Retained by MSP: Clio API custom connector configuration
• Retained by MSP: Power Automate flow documentation
• Retained by MSP: FortiGate and Umbrella policy configurations

Maintenance

Ongoing MSP Maintenance Responsibilities

WEEKLY (30 minutes)

• Review Cisco Umbrella dashboard for blocked shadow-AI attempts and report any policy violations to the firm's managing partner
• Check Microsoft 365 Service Health dashboard for any Copilot service degradation
• Verify Veeam M365 backup jobs completed successfully for the past 7 days
• Monitor FortiGate threat logs for any anomalous outbound traffic to AI-related domains

MONTHLY (2 hours)

• Generate and deliver the AI Compliance Report from SharePoint AI_Compliance_Log (total documents generated, review compliance rate, average review time, late reviews, usage by attorney)
• Review Microsoft 365 Copilot usage reports in admin center — identify underutilized licenses for additional training
• Review Clio Manage AI usage metrics — confirm active usage across all licensed users
• Conduct 30-minute compliance review call with managing partner to discuss metrics, issues, and refinements
• Update prompt library based on attorney feedback collected during the month
• Apply Windows and Microsoft 365 updates via Intune; verify Copilot functionality post-update
• Review and rotate Clio API token if approaching expiration

QUARTERLY (4 hours)

• Comprehensive security review: FortiGate firmware updates, Umbrella policy review, Defender threat analytics review
• Prompt library major revision: review all prompts with senior attorneys, update for any changes in firm practice areas, jurisdiction focus, or legal standards
• Clio platform review: check for new Manage AI features, update configurations, enable new capabilities
• Microsoft 365 Copilot feature review: Microsoft releases Copilot updates monthly — review new capabilities and determine applicability for the firm
• Review and update the AI Acceptable Use Policy (required every 6 months; quarterly check ensures no drift)
• Conduct backup restore test: restore one mailbox and one OneDrive folder to verify recoverability
• Review all Power Automate flows for errors and update any deprecated connectors

SEMI-ANNUALLY (1 day)

• Full AI Acceptable Use Policy review and update with managing partner — incorporate any new ABA guidance, state bar opinions, or regulatory changes
• Update client engagement letter AI disclosure language if needed
• Comprehensive vendor due diligence refresh: request updated SOC 2 reports from Clio and verify Microsoft DPA terms
• License true-up: review user count vs. licenses, add/remove seats as needed for Clio, M365, Copilot, and Defender
• Strategic planning session with firm leadership: review AI ROI metrics, identify new use cases, plan next phase (e.g., adding legal research AI, expanding to contract review)

TRIGGERED MAINTENANCE

• New attorney onboarding: Provision all accounts (Clio, M365, Copilot, Umbrella), conduct 1-hour AI training session, obtain policy acknowledgment signature (SLA: within 2 business days of start date)
• Attorney departure: Deprovision AI access, archive AI-generated documents in matter files, transfer Clio matters, revoke Copilot license (SLA: same day as termination)
• AI platform incident: If Clio or Microsoft reports a data breach affecting AI services, immediately notify managing partner per incident response plan, assess exposure, and document in compliance log
• Ethics complaint: If the firm receives any ethics inquiry related to AI use, provide full audit trail from compliance log within 4 hours
• Model/platform changes: When Clio or Microsoft significantly updates their AI capabilities (major version changes, new models), test in a sandbox environment, update prompts if needed, and communicate changes to firm users within 1 week

SLA FRAMEWORK

• Response Time: 1 hour
• Resolution Target: 4 hours

• Response Time: 4 hours
• Resolution Target: 1 business day

• Response Time: Next business day
• Resolution Target: 3 business days

• Response Time: 2 business days
• Resolution Target: 1 week

Alternatives

Option B: Budget Stack — MyCase Pro + ChatGPT Business

Replace Clio Complete with MyCase Pro ($79/user/month) which includes MyCase IQ for AI-assisted drafting, and use ChatGPT Business ($25/user/month) instead of Microsoft 365 Copilot for general content generation. Total software cost drops from approximately $170/user/month to approximately $104/user/month. MyCase IQ provides document summarization, AI text editing, and tone adjustment within the practice management platform. ChatGPT Business provides enterprise-grade security with data not used for training.

Tradeoffs

• COST: Saves approximately $66/user/month ($990/month for 15 users = $11,880/year savings).
• CAPABILITY: MyCase IQ is less mature than Clio Manage AI for document generation — fewer native integrations and less sophisticated matter-context injection. ChatGPT Business lacks the deep M365 integration of Copilot (no inline Word/Outlook/Teams experience) — attorneys must copy-paste between ChatGPT and Word, increasing friction and risk of data leakage via clipboard.
• COMPLIANCE: ChatGPT Business has enterprise data protections but requires careful policy enforcement since the interface is more 'consumer-like' and attorneys may accidentally use personal accounts.
• RECOMMENDATION: Best for cost-sensitive firms with fewer than 5 attorneys who prioritize simplicity over deep integration. Timeline is shorter (6-8 weeks) due to simpler stack.

Option C: Enterprise Stack — Clio Complete + Thomson Reuters CoCounsel

Augment the primary Clio Complete deployment with Thomson Reuters CoCounsel (AI-assisted legal research) at $400–$1,200/month for the firm. CoCounsel adds AI-powered legal research, document review, deposition preparation, and contract analysis capabilities that go far beyond simple content generation. This creates a full AI-augmented practice where research findings directly feed memo generation.

Tradeoffs

• COST: Significantly more expensive — adds $400–$1,200/month on top of the primary stack ($4,800–$14,400/year additional). Total per-firm cost could reach $5,000–$6,000/month for software alone.
• CAPABILITY: Dramatically superior for legal research and complex memo writing — CoCounsel can find and validate real case citations, eliminating the hallucination risk that plagues general-purpose AI tools. Document review and contract analysis features add value beyond the three target use cases.
• COMPLEXITY: Longer implementation (12–17 weeks), more extensive training required, and attorneys need to learn an additional platform. CoCounsel is designed for firms with existing Westlaw subscriptions.
• RECOMMENDATION: Best for litigation-heavy firms with 10+ attorneys doing complex legal work where research accuracy is paramount and the firm already has a Westlaw relationship. The ROI is strongest for firms billing $300+/hour where research efficiency directly impacts profitability.

Option D: Microsoft-Centric — M365 Copilot Only (No Legal-Specific Platform)

Skip the legal-specific AI platform entirely and rely solely on Microsoft 365 Copilot Business ($21/user/month) with custom prompts, templates in Word, and SharePoint-based workflows. Attorneys use Copilot in Word with the firm's prompt library and manually input case details. Practice management remains in the firm's existing system (even if non-AI-enabled).

Tradeoffs

• COST: Lowest possible AI cost at $21/user/month ($315/month for 15 users). Total AI-specific spend is under $4,000/year.
• CAPABILITY: Significantly limited — no automatic matter-context injection (attorneys must manually type all case details into each prompt), no integration with practice management workflows, no legal-specific AI training. Output quality depends entirely on prompt engineering skill and manual data input accuracy.
• COMPLIANCE: Higher risk because there's no automated review workflow tied to the practice management system — must build manual processes.
• COMPLEXITY: Lowest technical complexity but highest operational burden on attorneys.
• RECOMMENDATION: Only appropriate as a Phase 1 'toe in the water' approach for very small firms (1-3 attorneys) that want to experiment with AI before committing to a legal-specific platform. Should be viewed as a 3-6 month pilot before upgrading to Option A.

Option E: Smokeball + Microsoft 365 Copilot (Document Automation Focus)

Use Smokeball (starting at $49/user/month for the Bill plan, with higher tiers for Archie AI) as the practice management platform with its built-in document automation engine, combined with Microsoft 365 Copilot for general AI content generation. Smokeball's strength is its deep document automation with 20,000+ legal form templates and Archie AI for intelligent drafting.

Tradeoffs

• COST: Potentially lower than Clio Complete depending on tier selected — Smokeball Bill ($49) + Copilot ($21) = $70/user/month at the low end, though AI features require higher tiers (Boost/Grow at $79–$99).
• CAPABILITY: Smokeball has the strongest document automation library in the SMB legal market (20,000+ templates) which is ideal for firms that do high-volume, template-driven work (real estate closings, estate planning, immigration). However, its AI capabilities (Archie AI) are newer and less proven than Clio Manage AI.
• INTEGRATION: Smokeball's Microsoft 365 integration is tight (it runs as a desktop application that syncs with Outlook and Word), which could provide a more seamless Copilot experience.
• RECOMMENDATION: Best for firms focused on high-volume document production in practice areas with standardized forms (real estate, estate planning, immigration, family law). Less suitable for complex litigation or highly customized demand letters.