Agentic AI in a law firm: what California’s 2026 guidance asks

What changed in 2026

• Autonomy doesn’t replace judgment: An agentic system’s autonomy “does not satisfy a lawyer’s duty to exercise independent judgment.” Lawyers must not let an agentic system make substantive legal determinations, communicate legal advice, or prepare and file pleadings without meaningful lawyer supervision and review (p. 2).
• More autonomy, more controls: The greater the autonomy given to an AI system, the more important supervisory controls and verification mechanisms become (p. 3; repeated under Competence, p. 5).
• Competence includes knowing the system: Lawyers need to understand how much autonomy a system has, when it may act without prompting, what data it can reach, and what safeguards prevent errors (pp. 2–3). Because models change, competence also means reassessing a system’s capabilities and risks from time to time, including before using it for new tasks (p. 5).

The guidance ties these points to the duties of competence and diligence, Rules 1.1 and 1.3.

Confidentiality when AI can read email and files

• Consent before risky tools: A lawyer must not put confidential client information into a generative AI tool that may present material risks to confidentiality or security without the client’s informed consent (p. 5).
• Read past the marketing: Reasonable efforts take more than generalized marketing assurances: review the terms of use, privacy policy and vendor documentation, and where needed consult qualified IT or cybersecurity professionals (p. 5).
• Narrow and monitor access: Agentic systems connected to email, document management, calendars or client files raise acute confidentiality concerns. Lawyers must carefully evaluate and limit that access and put monitoring and access controls in place (p. 6).
• Nothing leaves unattended: A lawyer “must not deploy an agentic AI system in a manner that permits autonomous external transmission of client information” without appropriate safeguards and human review. That includes automated communications, filings and data transfers (p. 6).

The guidance cites Business and Professions Code section 6068(e) and Rules 1.6 and 1.8.2 for these duties.

A checklist for any AI tool in your practice

• Can you set the autonomy level for each kind of task, including off?
• Are outbound messages, court filings and billing blocked from running unattended?
• Is every AI action logged, and can applied actions be undone?
• What data can the AI reach, and can you narrow it?
• Does the vendor train models on your data, and how long does it keep prompts and responses?
• Is there a data processing agreement and a published subprocessor list?

How Proserus Legal handles it

• Autonomy per task: Your firm sets each AI task to one of four levels: off, on demand, propose for approval, or automatic.
• Hard ceilings: The Service enforces ceilings so that outbound communications, court-facing documents, billing finalization, and calendar or task changes always require human approval regardless of configuration.
• Audit trail and undo: Approvals, rejections and reverts of AI actions are written to the firm’s audit log. AI-drafted time entries, calendar events, tasks and client communication drafts can be undone after they are applied.
• Where data lives: Documents, email and calendar stay in your firm’s Microsoft 365 tenant. Practice records live in a database we host, kept separate for each firm. Our DPA and subprocessor list are public.
• A lawyer reviews everything: AI output is not legal advice. A lawyer must review all of it before relying on it.

What Proserus asks Microsoft for · Terms (autonomy controls) · DPA · Subprocessors

About this page

This page summarizes published guidance. It is not legal advice, and Proserus Legal is not a law firm. Check the State Bar’s current text and your own jurisdiction’s rules.

State Bar of California: Practical Guidance for the Use of Generative AI (PDF)