AI Incident Response Runbook
For a managing partner who just discovered AI was used in a recent filing, client work, or other firm matter. Work the steps in order. Each step links to the artifact you need to fill in.
On this page
First 24 hours: contain and assess
- Identify the matter and the filing or work product. Pull the docket, the brief, the client memo, or the work product where AI was used. Note the date served or filed and the court or recipient.
- List every citation, quotation, and factual claim in the work product that may have been AI-generated. For each, mark Verified, Unverifiable, or Fabricated against the primary source (Westlaw, Lexis, the court website, the statute book). The Verification Log is the artifact for this step.
- Pull the AI tool's interaction logs if available. Enterprise-tier accounts (ChatGPT Enterprise, Claude Enterprise, Gemini for Workspace, Microsoft Copilot for M365) have admin APIs and audit logs. Consumer-tier accounts do not. See AI Tool Risk Tiers for what is available at each tier.
- Open an entry in the firm's Incident Log. Record the date discovered, the matter, the attorney, the tool, the initial findings, and the open questions.
- Stop further AI-assisted work on the matter until the firm has decided how to proceed.
Evaluate Rule 3.3 candor obligations
Rule 3.3(a)(1) prohibits a lawyer from knowingly making a false statement of fact or law to a tribunal. Rule 3.3(a)(3) requires a lawyer to take reasonable remedial measures when the lawyer learns that material evidence offered by the lawyer or the client is false. Those measures can include disclosure to the tribunal. ABA Formal Opinion 512 and the bar opinions tracked on the State Tracker reaffirm that the duty applies to AI-generated content. A lawyer who files a fabricated citation, then learns of the fabrication, owes the same duty as a lawyer in any other false-statement case.
Operational questions for the firm's attorneys to decide:
- Did any fabricated or unverifiable citation reach a tribunal? If yes, Rule 3.3(a)(3) remediation analysis is on the table.
- Is the matter still pending in the same tribunal? If yes, the remediation window is still open. If the matter has concluded, ABA Opinion 512 and most state guidance still expect notice to the tribunal in some circumstances.
- Did opposing counsel rely on the same fabricated material? Notice to opposing counsel is a parallel question.
See the relevant page on the State Tracker for the firm's jurisdiction. Rule 3.3 framing varies in detail by state.
Evaluate Rule 8.3 reporting obligations
Rule 8.3(a) covers a lawyer who knows that another lawyer has committed a violation of the Rules of Professional Conduct. If the violation raises a substantial question as to that lawyer's honesty, trustworthiness, or fitness to practice, the knowing lawyer must inform the appropriate professional authority. Whether AI-generated fabrication triggers Rule 8.3 turns on intent and severity, and the answer varies by state. The Cases Tracker includes sanctions cases where bar referrals were ordered alongside monetary sanctions. Each case detail page links the underlying order.
Consult the firm's ethics counsel before deciding on reporting.
Notify the malpractice carrier
Most lawyers' professional liability policies require notice of (a) any claim, defined as a demand for money or services, and (b) any circumstances the insured reasonably believes could lead to a claim. A potentially fabricated citation in a filed brief, an AI-related confidentiality breach, or a court order to show cause based on AI use may meet either threshold. Early notice is generally protective; late notice can void coverage under most policy forms.
If the carrier's prior renewal application asked about AI use and the firm's answer no longer matches actual practice, the prior representation may also be material under standard policy terms. See If an AI incident happens mid-policy on the Carrier Renewal page for the broker conversation framing. The policy form may also have been amended for the current period (silent AI cover replaced by an exclusion or governance-contingent coverage). When that's possible, AI Liability Insurance for Law Firms covers the named-carrier landscape and the questions that surface this at renewal.
Policy language controls. Read the firm's specific policy form and consult the broker before deciding on notice.
Court disclosure considerations
If the matter was filed in a court with an AI standing order or local rule, the firm's obligations under that order are independent of the Rule 3.3 analysis above. The Court Orders Tracker is the index; Court Disclosure Templates has compliant certification language for ongoing or future filings in the same court.
A standing order in force when the filing was made, but not followed, raises a separate issue from the underlying citation question. Surface that to the firm's attorneys.
Update or adopt the firm policy
If the firm has no written AI policy, the Policy Design Framework walks the 15 pre-adoption decisions a managing partner needs to make first. After those decisions are captured, the Policy Template is the document that gets filled in. When a policy is already in place, the incident usually surfaces a gap: an unapproved tool in use, a verification step that was skipped, an unclear escalation path. Patch the gap before the next renewal.
Train staff
Document the post-incident training (date, attendees, content) in a training log. The training itself should cover the specific failure mode that led to the incident. Training and CLE lists CLE programs that satisfy Rule 1.1 competence; pair with the Employee Acknowledgment Form for the updated policy.
What to keep on file
At the next renewal, a malpractice carrier will ask for these artifacts. Every one is produced by this runbook:
- Incident Log entry for this incident
- Verification Log showing the citation-check process
- Matter file or filing where the incident occurred
- Firm AI policy as of the incident, plus any updates made after
- Training log entry for any post-incident training
- Correspondence with the broker, if mid-policy notice was given
- Any court order or filing made in response
The Carrier Renewal page covers what carriers are publishing and asking on renewal applications; the Audit Report template is the cover document that summarizes the firm's program for the renewal binder.