Law Firm AI Use Policy (Philippines)
Template for Philippine law firms · grounded in the Code of Professional Responsibility and Accountability (A.M. No. 22-09-01-SC) and the Data Privacy Act of 2012 (R.A. No. 10173).
Firm name: ________________________________
Effective date: ________________  ·  Next review date: ________________
Approved by (Managing Partner / Executive Committee): ________________
This template is a starting draft, not legal advice. Adapt it to your practice, clients and vendors. Always verify the current text of the CPRA and R.A. 10173.
1. Purpose
This Policy sets how lawyers, paralegals and staff of the Firm may use artificial intelligence (AI) and similar tools in client and firm work. It supports:
• Competence and diligence under CPRA Canon 4, Section 1 (competent, efficient and conscientious service; thorough research and preparation).
• Confidentiality under CPRA Canon 3, Section 27 (maintain client confidences; respect data privacy laws; duty continues after the engagement ends).
• Supervision under CPRA Canon 3, Section 10 (responsibility for mistakes, negligence, acts or omissions of subordinate lawyers, paralegals or employees under direct supervision).
• Non-delegation of non-delegable legal tasks under CPRA Canon 2, Section 35.
• Data privacy under R.A. 10173, especially Secs. 11 (general principles), 12–13 (lawful processing; sensitive and privileged information), 16 (data-subject rights), 20 (security measures) and 21 (accountability).
2. Scope
Applies to all partners, associates, of counsel, paralegals, clerks, interns and contractors who handle Firm or client information, on Firm devices or personal devices used for Firm work.
3. Approved and prohibited tools
3.1 Approved tools (list those with a written vendor agreement / DPA that the Firm has reviewed):
• _______________________________________________
• _______________________________________________
3.2 Prohibited for client or Firm confidential information: consumer or free AI chatbots and browser extensions without a Firm-approved data processing agreement. Do not paste client names, case facts, privileged communications or sensitive personal information into unapproved tools.
3.3 New tools require written approval from ________________ before any client data is entered.
4. What AI may be used for
Permitted, subject to human review in Section 5:
• First drafts of routine correspondence, checklists and internal memos.
• Research support and case digests — citations must be independently verified against official sources (e.g. Supreme Court E-Library, official rules PDFs).
• Document summarisation and issue-spotting on materials the Firm already holds.
• Administrative help (scheduling language, formatting), never as a substitute for professional judgment.
Not permitted:
• Sending AI output to a client, court, agency or opposing counsel without a qualified lawyer's review and approval.
• Relying on an unverified case citation, G.R. number, statute or quotation.
• Using AI to accept engagements, give final legal advice, or perform other non-delegable legal tasks (CPRA Canon 2, Sec. 35).
5. Human oversight (non-negotiable)
Before the Firm relies on or shares AI-assisted work:
• Research: a lawyer checks every citation against the official record.
• Drafts: a lawyer reviews accuracy, tone, strategy and privilege.
• Numbers / deadlines: a lawyer or trained staff recomputes against the governing rule.
The signing or sending lawyer remains professionally responsible (CPRA Canon 3, Sec. 10; Canon 4, Secs. 1 and 3).
6. Client data and privacy
• Process personal information only on a lawful basis under R.A. 10173 Sec. 12; treat sensitive and privileged information under Sec. 13.
• Implement organisational, physical and technical security measures under Sec. 20.
• The Firm remains accountable for personal information under its control or custody, including information transferred to a personal information processor (Sec. 21).
• Prefer tools that do not use Firm or client data to train public models; record the vendor's written position.
• Keep an inventory of AI tools that touch personal information and the lawful basis for each use.
7. Disclosure to clients
When material to the engagement, inform the client that the Firm uses approved AI tools under this Policy, that a lawyer reviews outputs before reliance, and that client confidences remain protected under the CPRA and R.A. 10173. Use engagement-letter language approved by ________________.
8. Training and incidents
• All covered persons complete AI-and-privacy training within 30 days of joining and at least annually.
• Report suspected data leaks, hallucinated citations that left the Firm, or unapproved tool use to ________________ within 24 hours.
9. Review
This Policy is reviewed at least annually, or sooner after a material change in tools, vendors, CPRA guidance or NPC circulars.
10. Acknowledgement
I have read this Policy and will follow it.
Name: ________________    Role: ________________    Signature: ________________    Date: ________
Sources (verify current text)
• Code of Professional Responsibility and Accountability, A.M. No. 22-09-01-SC (Supreme Court of the Philippines).
• Republic Act No. 10173 (Data Privacy Act of 2012), Secs. 11–13, 16, 20–21.
• Template published by ocoai for Firms (https://ocoai.in/ai-policy-for-philippine-law-firms). Not affiliated with the Supreme Court or the National Privacy Commission.