Choosing Legal Tech

Why write an ethics opinion about copiers?

Why would the Florida Bar’s ethics committee write an opinion about office copiers? Opinion 10-2 (opens in a new tab) gave the reason in 2010. A copier with a hard drive stores each document it copies as a file, which usually stays on the drive until something overwrites or deletes it. A leased copier eventually goes back to a company outside the firm, hard drive and all. In 2013 the committee turned to cloud computing, where client files sit on a vendor’s servers, and it asked many of the same questions. Both hold client information on equipment the firm does not control, and both end someday, taking whatever they hold unless someone planned for that day.

This reading sets the two side by side, because those questions belong on any rubric a firm uses to choose software, next to the usual ones about fit and price. In the activity, you compare two real products for one function at Temko Eden and recommend one. The sections below follow the purchase in order: what the firm needs, what the vendor promises, how the firm leaves, and what changes when the tool can learn.

What the firm needs, before anyone shows it a machine

A firm shopping for a copier compares speed, paper trays, and the cost per page. None of those numbers says what the machine keeps, which was the committee’s concern. It is the kind of requirement a spec sheet leaves out.

A needs assessment guards against that kind of gap from two sides. The people who will use a tool know their own tasks. A bookkeeper who reconciles the trust account by hand knows exactly what a system would have to do to give him back two days a month. What users rarely know is what the rules add. No one at a firm asks for trust records that outlive the software, yet Rule 5-1.2(f) requires them to be kept for six years after each representation ends. A good list carries both kinds of requirement, and it states each one as a task. “Whatever the big firm down the street uses” names a product, and a product is an answer to the list, not an item on it.

An evaluation rubric turns the list into a decision. Each criterion gets a weight, and the weights are set before anyone sees a demo, for a plain reason: a weight chosen afterward can be tuned until the favorite wins. Must-haves work differently. A tool that cannot reconcile a trust account is out, and a high score for its calendar does not bring it back. The rest of the rubric rewards evidence. A feature you watched work in a trial counts for more than the same feature on a marketing page, and the scorecard should show which one you had.

What the vendor promises, and where it says so

Opinion 10-2 gave lawyers who use machines that store data a set of reasonable steps. The firm identifies the risk and writes policies for it, keeps an inventory of the devices, and gets assurances of confidentiality from the outside people who service them. It gets meaningful assurances from the vendor when a device arrives, and confirmation that the device was cleaned when it leaves.

Opinion 12-3 (opens in a new tab) carried the same caution to the cloud, where no one at the firm can walk over and look at the machine. So its questions turn to what the vendor has promised. It adopts a New York list that begins with “an enforceable obligation to preserve confidentiality and security,” and it asks whether the provider will notify the lawyer if served with process for client information. From an Iowa opinion it adds questions about the user agreement itself. Which law and which forum govern a dispute? Does the agreement limit the provider’s liability, or give the provider any rights over the data?

That is vendor due diligence, and it changes how you read a vendor’s website. A security page that describes encryption and audits is useful evidence of what the vendor does. It is not a promise the vendor has to keep. The promise, if there is one, sits in the terms of service or the subscription agreement the firm accepts. That is why the Security Review asks where each answer came from. An answer found only on a marketing page becomes a question to put to the vendor before the firm signs.

The comment to Rule 4-5.3 treats an internet service that stores client information as help from outside the firm. The lawyer must make reasonable efforts to see that the service is provided in a way that fits the lawyer’s own obligations. The circumstances that count include the provider’s reputation and the terms of any arrangement for protecting client information. A breach record is part of a reputation. The California Attorney General’s list shows the notices a company filed after a breach, but only notices sent to more than 500 California residents. A company missing from it may simply never have had to file there.

When the machine goes back

Leases end, and the copier goes back to the leasing company with its hard drive. Opinion 10-2 was blunt about that moment. It is “not sufficient to merely obtain an agreement” that the vendor will clean the device. The lawyer has to find out that the cleaning happened, through some meaningful confirmation or by having it done at the office.

A software subscription ends the same way, except that nothing comes back to the office. The records stay on the vendor’s servers, and the firm’s access depends on the agreement. Opinion 12-3’s Iowa questions reach this moment too: whether the provider keeps the information after the lawyer ends the relationship, and what access the lawyer has to the data then. Data portability is the practical answer. Can the firm export everything it put in, in a form another program can open, and for how long after it stops paying?

The rules raise the stakes. Trust records must be kept for six years after each representation ends. A contingency fee contract and its closing statement must be kept for six years after the closing statement is signed. Opinion 06-1 (opens in a new tab) lets a firm keep its files electronically, but they must stay readily reproducible and protected from change or loss. A trust ledger locked inside a canceled account meets neither test. So the exit plan belongs in the purchase. It is written before the firm signs and tested during the trial with a real export.

Leaving also has a price, and it belongs in the total cost of ownership. The per-user price on a vendor’s page is where a budget starts. The plan that actually covers the must-haves may cost more than the one advertised, and an add-on may carry the one feature the firm needs. Moving the old system’s records in, and someday moving them out again, takes hours that no price page lists.

A machine that learns

A copier keeps what it copies. It does not learn from it. Many legal products now carry generative AI features that draft, summarize, and answer questions, and a tool like that may keep what users enter, pass it to another company’s model, or learn from it. That adds a question the copier never raised.

Florida Bar Ethics Opinion 24-1 (opens in a new tab) answers it with the same kind of research. A lawyer may use generative AI while protecting client confidences, and that protection starts with the program’s policies on data retention, data sharing, and self-learning. Where a third-party program would receive confidential information, the opinion recommends the client’s informed consent first, and it notes that a program hosted in-house can ease the concern. It also has lawyers develop policies and practices so that the use meets their ethical duties. That is the policy paragraph your memo drafts.

The binding terms matter most here. One e-signature company’s contract terms for its AI features (opens in a new tab), in their July 2026 version, license it to train AI on customer data, anonymized and aggregated, unless the customer opts out. An opt-out leaves the company its rights in the training data it already made. ABA Formal Opinion 512 tells lawyers to read and understand a tool’s terms of use and privacy policy, or to consult someone who has. So the rubric scores AI on what the terms let the vendor do with the firm’s data, and on whether the firm can switch the features off.

Understanding those terms is part of technology competence. Since October 2024, the comment to Rule 4-1.1 has named generative AI among the technology whose benefits and risks a lawyer should understand. Rule 6-10.3(b) requires 3 of the 30 CLE hours a Florida lawyer completes every three years to be in approved technology courses. Opinion 10-2 described the same duty across a machine’s whole life, from the day the lawyer takes control of it until it leaves, and even after.

A subscription has a life too, and implementation and training are where a firm builds its competence with a new tool. A training plan that skips the lawyers leaves the people who carry the duty without the knowledge it asks of them.

Back to Temko Eden

Dana Whitfield’s email in the activity offers you two functions, each propped up by a workaround: trust records in a spreadsheet, and signed letters in one employee’s personal account. Each is a small version of the copier problem, with records the firm depends on sitting where the firm does not control them. Start with the Firm Profile and the staff notes, and let the Requirements Interviewer press you on every must-have. Set your weights before you open a trial. Then read each vendor’s promises in the documents that bind it.