California State Bar Proposes Enforceable AI Ethics Rules — What California Law Firms Need to Do Now

Published: May 18, 2026 | By: The Crossing Report

---

California's bar association just moved from advisory to enforceable on AI.

In March 2026, the California Standing Committee on Professional Responsibility and Conduct (COPRAC) approved proposed amendments to six Rules of Professional Conduct. Public comment closed May 4. The Board of Trustees vote is imminent. When it passes, these won't be guidelines — they'll be ethics rules with disciplinary teeth.

California licenses roughly 250,000 attorneys. When California moves, the rest of the country eventually follows. If you practice law in California, this is your compliance deadline. If you practice elsewhere, this is your advance warning.

Here is what every California law firm owner needs to understand right now.

---

Why This Is Different From the 2023 Guidance

In 2023, California issued advisory guidance on attorney AI use. Good advice, voluntary compliance, no enforcement mechanism. Firms could read it, nod, and go back to work.

The 2026 proposed amendments are different. They amend the Rules of Professional Conduct — the same rules that govern competence, communication, confidentiality, and candor to the court. Violations are subject to State Bar investigation, formal discipline, and in serious cases, suspension or disbarment.

The legal standard was always there. What changes is that the bar is now spelling out explicitly how it applies to AI tools — removing the "I didn't realize" defense and establishing a documented expectations framework against which attorney conduct will be measured.

---

The Four Rules That Matter Most

Rule 1.1 — Competence: You Must Verify Every AI Output

The proposed Rule 1.1 amendment makes explicit what malpractice exposure already implied: competent representation when using AI requires verifying AI-generated output before relying on it.

This is not a "review it if you have time" standard. It is a verification requirement. An AI-drafted brief you haven't reviewed, a contract clause you accepted as written, a research memo you forwarded without checking — all of it falls under this rule.

What this means in practice:

• Every AI-generated document must pass through a licensed attorney's substantive review before use
• Review means checking for accuracy and completeness, not just proofreading for typos
• The fact that AI generated it is not a defense; the attorney signed it

For a small firm using AI to draft intake documents, contracts, or client correspondence: your workflow must include a documented review step. Not a formality — a real check.

---

Rule 1.4 — Communication: Client Disclosure Is Now Required

Under proposed Rule 1.4 amendments, disclosure of AI use to clients is required when material to the representation. The proposed standard makes this a defined obligation.

The ambiguity of "when material" will be resolved through bar guidance and case-by-case enforcement over time — but the direction is clear. If AI is a meaningful part of how you deliver legal services, clients should know.

What this means in practice:

• Update your engagement letters to address AI use — that AI tools may be used in service delivery, that all AI-generated work product is reviewed and validated by a licensed attorney, and that client data handling follows your firm's confidentiality protocols
• If a client asks directly whether AI was used, that question triggers the disclosure obligation regardless of whether you consider the use "material"
• Staff responsible for client-facing communications should know your firm's AI disclosure policy

This also has a competitive angle: firms that proactively disclose their AI use and explain their verification protocols are differentiating on trust, not just compliance.

---

Rule 1.6 — Confidentiality: Client Data in AI Tools Is a Risk You Must Analyze

Under proposed Rule 1.6 amendments, entering client confidential information into an AI tool triggers a confidentiality analysis before you proceed.

This applies broadly: ChatGPT, Claude, Microsoft Copilot, specialized legal AI platforms. Any tool that processes client data.

What this means in practice:

• Before entering client information into any AI tool, you need to understand: does this tool store my inputs? Does it use my data to train its models? Who can see what I've entered?
• Tools that use inputs for training (some consumer versions of AI chatbots) create a confidentiality problem that client consent or technical safeguards may or may not resolve
• Enterprise or privacy-focused AI deployments (Microsoft 365 Copilot with enterprise data protection, Claude Pro, firm-licensed platforms with data processing agreements) are structured to address this — but you have to know the difference

For a small firm that has been using a free-tier AI tool with client matters: this rule requires you to understand your data handling exposure. That conversation with your IT vendor or the AI provider's terms of service should happen before the Board of Trustees vote makes it mandatory.

---

Rule 3.3 — Candor to Tribunal: AI Citations Must Be Verified Before Filing

Under proposed Rule 3.3 amendments, attorneys must verify AI-generated citations and legal authority before filing with any tribunal. No exceptions.

This is the rule generated by the national crisis of AI hallucinations in court filings — cases like Mata v. Avianca (ChatGPT hallucinated case citations, attorney sanctioned $5,000) and Gauthier v. Goodyear ($10,000+ sanctions for AI-cited cases that did not exist). California is codifying what courts have been sanctioning under inherent authority.

What this means in practice:

• Every case citation generated by AI must be verified in Westlaw, LexisNexis, or an equivalent validated database before filing
• The verification step is non-delegable — a paralegal confirming that a case "looks right" is not sufficient; the supervising attorney must be confident the citation is accurate and cites for what you say it cites for
• Document your verification step. A simple note in the file — "Citations verified [date] [attorney initials]" — creates a record that demonstrates compliance if the question ever arises

Courts and bar investigators look at workflow documentation when sanctions or disciplinary proceedings are involved. The firms that can show a verification step will be in a better position than those who cannot.

---

What California Law Firms Should Do Before the Board Vote

You do not need to wait for the Board of Trustees to vote to start closing compliance gaps. These rules formalize what competent practice already required. The firms that act now spend an afternoon on documentation. The firms that wait spend days in disciplinary proceedings explaining why they didn't.

Step 1 — Audit your AI tools. List every AI tool your firm uses: ChatGPT, Copilot, legal research AI, contract review tools, drafting assistants. For each: confirm who owns the data, whether the tool trains on inputs, and whether a data processing agreement is in place. Tools that process client data without a DPA are Rule 1.6 exposure under these amendments.

Step 2 — Update your engagement letter. Add an AI disclosure clause. It should state: (a) the firm may use AI tools in service delivery; (b) all AI-generated work product is reviewed and validated by a licensed attorney; (c) client confidential information is handled in accordance with the firm's confidentiality obligations. If you want a template, the ABA's guidance following Opinion 512 and the North Carolina Bar's published policy framework are both useful starting points.

Step 3 — Implement a documented verification workflow. For any AI-generated document going to a client or court: create a simple checklist — attorney reviewed, citations verified, client data handled in compliance with 1.6. It does not have to be complex. It has to exist and be consistently used.

---

What the California Rules Mean for the Rest of the Country

California is typically six to eighteen months ahead of other state bars on professional responsibility questions. The 2023 advisory guidance rippled out to comparable guidance in New York, Texas, Florida, and others within that window. The 2026 amendments — moving to enforceable standards — will create pressure for other state bars to do the same.

If you practice in a state other than California: this is your advance notice. The requirements California is codifying now — verify AI output, disclose AI use to clients, protect client data in AI tools, confirm citations before filing — reflect a direction of travel for professional responsibility rules nationally.

The firms that treat this as a California-only problem will be unprepared when their own state bar moves. The firms that use California's framework as a compliance template will be ahead of the deadline wherever they practice.

---

The Competitive Angle

There is a business case for compliance beyond avoiding discipline. Thomson Reuters' 2026 AI in Professional Services Report found that 68% of corporate clients don't know whether their law firm uses AI. Clients are aware that AI is changing legal work. Many are uncertain whether it is making their representation better or creating unreviewed work product they're paying for.

The firm that can say clearly: "Yes, we use AI. Here is how we use it. Here is our verification protocol. Here is how client data is protected." — that firm differentiates on trust. That is a competitive advantage in the middle market, particularly against PE-backed and large-firm competitors who are deploying AI at scale but haven't necessarily communicated their governance to clients.

Compliance is not optional. But treating it as only a cost and not also an asset misses half the opportunity.

---

Where to Watch for Updates

The California State Bar Board of Trustees was expected to vote on the proposed COPRAC amendments in May 2026. Check calbar.ca.gov for the official adoption notice and effective date. Once the rules are adopted, the State Bar typically publishes implementation guidance — watch for that within 60-90 days of the Board vote.

For ongoing coverage of AI ethics rules affecting professional services firms, The Crossing Report covers these developments weekly — specifically filtered for owners of small and mid-size professional services firms who need to act on them, not just understand them.

---

The Crossing Report is published by The Crossing Co. This article is editorial analysis, not legal advice. Consult qualified legal counsel for guidance specific to your firm and jurisdiction.