ocoaiOne Click Operation AIPhilippine Bar & law practiceSign inOpen the app
For Philippine law firms

AI policy for PH firms: CPRA + Data Privacy Act

Adoption is easy; governance is the hard part. Philippine lawyers already owe competence, confidentiality and supervision under the CPRA, and privacy duties under R.A. 10173. This page turns those duties into a usable firm policy — with a free Word template you can download and adapt.

Download the AI-use policy template (Word)Open ocoai for Firms

Why Philippine firms need a written AI policy

Consumer chatbots and embedded AI features are already on lawyers' phones. Without a firm rule, each associate invents their own standard for what may be pasted where. That is how privileged facts leave the firm and how invented G.R. numbers reach a pleading. A short, specific policy is cheaper than a complaint, a breach notification, or a mistrial of trust with a corporate client who now asks in RFPs: which AI tools do you use, and who reviews the output?

Foreign practice-management vendors have started publishing Philippines-facing AI governance posts (for example Clio's September 2026 note on AI in Philippine law firms). Those pieces are useful as prompts. They are not a substitute for citing the CPRA and R.A. 10173 in your own house rules.

CPRA provisions that already cover AI-assisted work

The Code of Professional Responsibility and Accountability (A.M. No. 22-09-01-SC) does not need an “AI chapter” to apply. These sections are the ones firms should quote in the policy:

ProvisionWhat it requires (summary)AI implication
Canon 4, Sec. 1Competent, efficient, conscientious service; thorough research, preparation and application of legal knowledge.AI drafts and research must be checked; unverified citations are not “thorough research”.
Canon 4, Secs. 3 & 8Diligence and punctuality; lifelong learning.Train the team on tools you actually approve; do not leave juniors to guess.
Canon 3, Sec. 27Maintain client confidences; respect data privacy laws; duty continues after the engagement ends.No client facts in unapproved consumer AI; vendor DPAs matter.
Canon 3, Sec. 10Responsibility for mistakes, negligence, acts or omissions of supervised subordinates.Partners own AI misuse by staff they supervise.
Canon 2, Sec. 35Non-delegable legal tasks (e.g. accepting cases, giving legal advice) must not be left to non-lawyers.AI is a tool under lawyer control — not a substitute counsel.
Canon 2, Sec. 40Do not reveal confidential information in online posts.Same logic applies to prompts typed into public AI products.

Data Privacy Act (R.A. 10173) hooks

  • Sec. 11 — general data privacy principles for any processing of personal information.
  • Sec. 12 — lawful criteria for processing personal information.
  • Sec. 13 — stricter rules for sensitive personal information and privileged information (typical in litigation and family files).
  • Sec. 16 — rights of the data subject (access, correction, etc.).
  • Sec. 20 — organisational, physical and technical security measures.
  • Sec. 21 — accountability of the personal information controller, including information transferred to a processor.
Practical test before approving a tool: Is there a written agreement that states where data is stored, whether it is used to train public models, who can access prompts, and how the Firm can export or delete client data? If not, keep client files out of that tool.

What to put in a policy that people will actually follow

  1. Purpose in one paragraph — tie it to CPRA Canons 3–4 and R.A. 10173 Secs. 20–21.
  2. Approved vs prohibited tools — name the products; ban consumer chatbots for client data.
  3. Allowed use-cases — first drafts, summarisation, research support — each with a human-review rule.
  4. Citation rule — no G.R. number, statute or quotation leaves the firm until checked against an official source (e.g. Supreme Court E-Library).
  5. Supervision — who trains juniors; who approves new vendors; 24-hour incident reporting.
  6. Client disclosure — optional engagement-letter sentence when material to the matter.
  7. Annual review — or sooner after a vendor or NPC/CPRA change.

Free downloadable template

Download a Word (.docx) starter policy you can put on firm letterhead. Fill in the approved-tool list, approver names and review date. It cites CPRA Canon 4 Sec. 1, Canon 3 Secs. 10 & 27, Canon 2 Sec. 35, and R.A. 10173 Secs. 11–13, 16, 20–21.

Download ph-law-firm-ai-use-policy-template.docx Plain-text version

How ocoai for Firms supports a governed AI workflow

ocoai is built for Philippine practice, not as a generic US/AU practice-management clone. Features that map to this policy:

  • Citation proof / SC-record check — blocks export when a G.R. citation does not match ocoai's Supreme Court E-Library index.
  • Court-format engine — A.M. No. 11-9-4-SC paper, margins and font specs for filings.
  • Partner review and audit log — human sign-off and a trail of who ran which AI action.
  • Labor / NLRC calculators and JAR helpers — deterministic PH workflows beside generative research.
  • Taglish research with refuse-when-unsure — answers only from the laws DB and SC decisions DB.

Start a Firms trial from the Firms homepage, then pair it with the written policy above so associates know what is allowed.

Sources

Last reviewed November 9, 2026. Laws, rules and Bar Bulletins change; if a source above has been amended or superseded, the official text controls.

AI policy FAQ for PH law firms

Do Philippine law firms need a written AI policy?

The CPRA does not use the words “AI policy”, but Canon 4 (competence and diligence), Canon 3 Sec. 27 (confidentiality and data privacy), Canon 3 Sec. 10 (supervision of subordinates) and Canon 2 Sec. 35 (non-delegable legal tasks) already apply to AI-assisted work. A written policy is how a firm shows consistent compliance. R.A. 10173 Secs. 20–21 also require security measures and accountability for personal information, including when processors (vendors) handle it.

Which CPRA provisions matter most for AI?

Start with Canon 4 Sec. 1 (competent, efficient, conscientious service and thorough research), Canon 3 Sec. 27 (maintain client confidences and respect data privacy laws), Canon 3 Sec. 10 (responsibility for supervised staff), and Canon 2 Sec. 35 (do not delegate non-delegable legal tasks to non-lawyers). Online posts that reveal client confidences are separately barred by Canon 2 Sec. 40.

What does the Data Privacy Act require when we use AI vendors?

R.A. 10173 Sec. 12 sets lawful bases for processing personal information; Sec. 13 tightly limits sensitive and privileged information; Sec. 16 lists data-subject rights; Sec. 20 requires reasonable organisational, physical and technical security; Sec. 21 makes the personal information controller accountable even when data is with a processor. Map each AI tool, its lawful basis, and the written vendor terms before client data goes in.

Can juniors paste case facts into a free chatbot?

Not under a careful reading of Canon 3 Sec. 27 and R.A. 10173. Free consumer tools usually lack a firm data processing agreement. Treat them as prohibited for client or firm confidential information unless the managing partner has approved a specific configuration in writing.

How is this different from generic “AI for law firms” blog posts?

This guide cites the Philippine CPRA (A.M. No. 22-09-01-SC) and R.A. 10173 by section, and ships a downloadable template you can adapt. It is not a product pitch for a foreign practice-management suite. For Philippine filing, citation checking and court format, see ocoai for Firms.

Related guides and tools

ocoai vs Clio

Honest comparison: PH legal work vs global practice management.

ocoai for Firms

Trial workspace with citation checks, court format and audit log.

ocoai for lawyers

Research, pleadings, judicial affidavits, docket and MCLE.

See ocoai for Firms
AI policy for Philippine law firms (CPRA + Data Privacy Act) | ocoai