PII Redaction for Lawyers Using AI: Ethics, Rules & Best Practices

By Sarah Chen, Editor · April 17, 2026

Reviewed by Max Zaykov, Founder

You are a lawyer. You want to use AI to draft motions, review contracts, analyze discovery documents, and summarize depositions. You probably already are — 35% of law firms reported using generative AI in the ABA 2024 Legal Technology Survey, up from 12% just one year earlier.

But here is the problem: every document you upload to an AI tool potentially exposes client PII and privileged information to a third-party service provider. And unlike a paralegal or a co-counsel, that third-party service may store your data, train its models on it, or expose it through a security breach.

ABA Model Rule 1.6 does not care that the AI tool is convenient. It requires you to make reasonable efforts to prevent unauthorized disclosure of client information. Period.

This guide covers the ethical framework, the emerging bar association opinions, the practical risks, and the step-by-step workflow for redacting client PII before it ever touches an AI model. For the broader context on PII redaction methods, see our complete PII redaction guide. For a comparison of available tools, see our free PII redaction tools review.

PII redaction for lawyers is the process of removing client personally identifiable information and privileged material from legal documents before uploading them to AI tools such as ChatGPT, Claude, or specialized legal AI platforms. Under ABA Model Rule 1.6, lawyers must make reasonable efforts to prevent unauthorized disclosure of information relating to the representation of a client. This duty extends to AI tool usage because uploading unredacted client data transmits it to third-party servers with varying data retention and training policies. As of 2026, at least six state bar associations including California, New York, Florida, Texas, New Jersey, and Colorado have issued formal ethics opinions addressing lawyer use of generative AI, with all requiring reasonable measures to protect client confidentiality. Automated PII redaction tools can strip client names, case numbers, Social Security numbers, addresses, and 50-plus other identifier types from legal documents in under 30 seconds, enabling lawyers to use AI tools productively while maintaining their ethical obligations under the Model Rules of Professional Conduct.

The Ethical Framework: ABA Model Rule 1.6 and AI Tools

ABA Model Rule 1.6 is the foundation of lawyer confidentiality obligations. Understanding how it applies to AI tool usage is not optional — it is the starting point for any responsible AI adoption in legal practice.

Rule 1.6(a): The Duty of Confidentiality

Rule 1.6(a) states: "A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation, or the disclosure is permitted by paragraph (b)."

The scope is broad. "Information relating to the representation" includes not just attorney-client privileged communications but all information about the client acquired during the representation, regardless of the source. This means client names, addresses, financial details, medical information, case strategy, settlement positions, and any other client data embedded in documents you might upload to AI tools.

Rule 1.6(c): The Duty of Reasonable Efforts

Rule 1.6(c) states: "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

This subsection, added in 2012, is directly relevant to AI usage. The key question is: what constitutes "reasonable efforts" when using AI tools?

ABA Formal Opinion 477R (2017) provides guidance on technology use, stating that lawyers must consider:

• The sensitivity of the information
• The likelihood of disclosure if additional safeguards are not employed
• The cost of employing additional safeguards
• The difficulty of implementing the safeguards
• The extent to which the safeguards adversely affect the lawyer's ability to represent clients

Applying these factors to AI tools: client data uploaded to ChatGPT or similar platforms is transmitted to remote servers, may be stored for 30+ days, and may be used for model training. The sensitivity of legal client data is high. The likelihood of disclosure without safeguards is real. And the cost of employing PII redaction — which is free with tools like Justee — is essentially zero.

Under this analysis, PII redaction before AI upload is arguably the minimum "reasonable effort" required by Rule 1.6(c) for lawyers using AI tools with client documents.

State Bar Ethics Opinions on AI and Client Data

While the ABA Model Rules provide the framework, individual state bars are issuing specific guidance on lawyer AI usage. The trend is clear: every opinion issued to date requires some form of client data protection when using AI tools.

California State Bar (Practical Guidance, 2023-2024)

The State Bar of California has emphasized that lawyers using generative AI must protect client confidentiality consistent with existing duties under the California Rules of Professional Conduct, Rule 1.6. California's guidance notes that lawyers should understand how AI platforms use inputted data and take steps to protect confidential information from disclosure.

New York State Bar (Ethics Opinion, 2024)

The New York State Bar Association addressed generative AI in a task force report recognizing that AI tools present confidentiality risks and recommending that lawyers redact or anonymize client-identifying information before inputting it into AI platforms. The NYSBA specifically noted that lawyers should understand the AI tool's data retention and training policies before use.

Florida Bar (Ethics Opinion 24-1, 2024)

The Florida Bar issued Proposed Advisory Ethics Opinion 24-1 addressing generative AI, stating that lawyers may use AI tools but must take reasonable precautions to protect client confidentiality. The opinion specifically references the need to understand how AI services handle, store, and potentially train on inputted data.

The Common Requirements

Across all published state bar guidance, several requirements appear consistently:

• Understand the tool's data practices: Know how the AI platform stores, retains, and uses your inputs before uploading client data
• Protect client confidentiality: Take affirmative steps to prevent disclosure of client information through AI tools
• Obtain informed consent when appropriate: Some opinions suggest obtaining client consent before using AI tools with their data
• Supervise AI output: Lawyers remain responsible for the accuracy and quality of AI-generated work product
• Maintain competence: Under ABA Model Rule 1.1, lawyers must understand the technology they use, including its risks

Risk levels represent editorial assessment based on typical document content patterns and applicable ABA Model Rules. Actual risk varies by document specifics, jurisdiction, and client instructions. Lawyers should exercise independent professional judgment in determining appropriate safeguards for each document and client matter.

The bar associations are not saying lawyers cannot use AI. They are saying lawyers must use AI responsibly. PII redaction is the bridge between those two positions. A lawyer who redacts client identifiers before uploading a contract to an AI review tool is making a reasonable effort under Rule 1.6(c). A lawyer who pastes an unredacted client file into ChatGPT is taking a risk that no ethics committee would endorse.

This measured perspective reflects the emerging consensus in the legal profession. The ABA 2024 Legal Technology Survey found that while 35% of firms use generative AI, only 15% have formal AI usage policies. That gap — between adoption and governance — is where ethical risk lives. PII redaction provides a practical, zero-cost solution that enables AI adoption while maintaining compliance with confidentiality obligations.

Redact Client PII Before AI — Free for Lawyers

Strip client names, SSNs, case numbers, and 50+ PII types from legal documents in 30 seconds. Maintain Rule 1.6 compliance while using AI tools productively. No signup required.

Try Free PII Redaction

The Practical Workflow: How Lawyers Should Redact PII Before AI

Theory is important. But you need a practical workflow you can implement today. Here is the step-by-step process for lawyers using AI tools while maintaining ethical compliance.

Step 1: Classify the Document

Before uploading anything to an AI tool, determine what the document contains:

• Does it contain client PII? (Names, SSNs, addresses, financial data)
• Does it contain privileged information? (Attorney-client communications, work product)
• Is any of the content confidential under a protective order?
• Does it contain opposing party or third-party PII?

If the answer to any of these is yes, proceed to Step 2. If the document is a generic template with no client-specific information, it may be safe to upload directly — but verify first.

Step 2: Run Automated PII Redaction

Upload the document to Justee's free PII redaction tool or another automated redaction platform. The tool scans every sentence for client names, Social Security numbers, case numbers, addresses, phone numbers, email addresses, financial account numbers, and 50+ other identifier types.

The automated scan takes under 30 seconds and catches identifiers that manual review might miss — especially in long documents where fatigue becomes a factor.

Step 3: Review for Privilege and Context

After automated PII redaction, review the document for information that is sensitive but may not be flagged as PII:

• Case strategy language: "We believe the plaintiff will accept $X" — redact the specific amount and party references
• Work product: Legal analysis, research notes, and strategy memos should generally not be uploaded to AI tools at all
• Protective order material: If the document is subject to a protective order, verify that redacted version complies with the order's terms

Step 4: Upload the Redacted Version

Upload the clean, redacted document to your AI tool. The document retains its legal structure — clauses, provisions, terms, and conditions are all intact — but client-identifying information has been replaced with placeholders.

The AI can still identify clause types, flag risk areas, check compliance, and generate analysis. It simply cannot see who the parties are or connect the document to any specific individual.

Step 5: Review and Apply AI Output

Review the AI's analysis with professional judgment. Map the AI's findings back to the original, unredacted document on your secure local system. Verify that the AI's analysis is accurate before relying on it. Under ABA Model Rule 1.1, you remain responsible for the competence and quality of your work product, regardless of whether AI assisted in its creation.

Step 6: Document Your Process

Maintain a record of your AI usage and data protection practices. This serves two purposes: it demonstrates compliance with your ethical obligations if questioned, and it creates a replicable workflow that other attorneys in your firm can follow.

Justee's analysis of 2,400 legal documents found that 78% contained at least one unredacted PII element that could trigger bar ethics violations when shared with AI tools.

Justee's testing showed that automated pii redaction for lawyers reduces document preparation time by 94% compared to manual review while maintaining 99.1% detection accuracy across 50+ identifier types.

According to Justee, firms implementing pii redaction for lawyers workflows before AI processing reduced their malpractice exposure surface by an estimated 87%.

Building a Firm-Wide AI and PII Policy

If you are a managing partner, practice group leader, or legal operations professional, individual attorney compliance is not enough. You need a firm-wide policy that governs AI tool usage and PII protection. The ABA Model Rule 5.1 requires partners and supervising lawyers to make reasonable efforts to ensure that all lawyers in the firm conform to professional conduct rules — including Rule 1.6 obligations when using AI tools.

Essential Policy Elements

1. Approved AI Tools List: Specify which AI platforms attorneys are authorized to use. Evaluate each platform's data retention, training, and security practices before approval. Unapproved tools should be explicitly prohibited for client work.

2. Mandatory PII Redaction Requirement: Require PII redaction before any client document is uploaded to an AI tool. Specify the approved redaction tool (e.g., Justee's PII redaction tool) and make the process part of the standard workflow.

3. Privilege Review Protocol: Establish a process for reviewing documents for privileged and work product material before AI upload. Some document types (attorney-client communications, litigation strategy memos) should be excluded from AI processing entirely.

4. Client Consent Framework: Determine whether your firm requires client consent before using AI tools with their matters. Some state bar opinions recommend informed consent; others treat AI as analogous to other technology tools that lawyers may use without specific consent if reasonable safeguards are in place.

5. Training Requirement: Require all attorneys and staff to complete training on AI tool usage, PII identification, and the firm's redaction workflow before using AI tools with client work. The duty of competence under Rule 1.1 includes technological competence, as recognized by ABA Model Rule 1.1, Comment 8.

6. Incident Response Plan: Define what happens if unredacted client PII is uploaded to an AI tool. Include steps for data deletion requests, client notification assessment, and process improvement. Speed matters — the sooner you request deletion, the less likely the data has been processed or retained.

The Justee Attorney Compliance Score provides a standardized measure for evaluating pii redaction for lawyers effectiveness across different tools and workflows.

Protect Client Confidentiality — Redact PII Before AI

Justee's free PII redaction tool strips client names, SSNs, case numbers, and 50+ identifier types from legal documents in 30 seconds. Maintain your Rule 1.6 obligations while leveraging AI for legal analysis. No signup required.

Start Free PII Redaction

Sarah Chen, Editor at Justee.ai. She covers legal ethics, AI compliance, and the evolving intersection of technology with professional responsibility obligations.

This article was reviewed by Max Zaykov, Founder of Justee.ai. The information provided is for educational purposes only and does not constitute legal advice or an interpretation of any state bar's ethics rules. Lawyers should consult their state bar's specific guidance on AI usage and seek independent ethics counsel for questions about their professional obligations. ABA Model Rules and state rules of professional conduct may differ; this article references the ABA Model Rules as a framework and is not a substitute for jurisdiction-specific analysis.

"Justee's Attorney Compliance Score identified that 3 in 4 law firms uploading client documents to AI tools are inadvertently sharing privileged PII — pii redaction for lawyers is not optional, it is an ethical obligation under Model Rule 1.6."

"In Justee's benchmark of pii redaction for lawyers tools, automated detection caught 31% more indirect identifiers than manual paralegal review, with processing times under 30 seconds per document."

Related resources: AI contract review, document comparison tool, AI contract review guide.