Research
What clients now tell their law firms about AI.
We read all 65 outside-counsel guidelines we could find on the open web, from companies, insurers, banks, public bodies, and universities. 7 mention AI. All 7 tell the firm to say when it used it.
6565 outside-counsel guidelines on the open web. We read every one.
77 mention AI at all.
77 require the firm to disclose when it used AI.
55 keep the client's information out of public AI tools.
55 require a lawyer to check the output.
55 change how AI work is billed.
The date on the document tells you whether AI is in it.
Dated before 2024
0 of 33
Dated 2024 or later
5 of 14
None of the 33 guidelines dated before 2024 mentions AI. 5 of the 14 dated 2024 or later do. The rest carry no date.
The 7 guidelines that mention AI, clause by clause.
| Guideline | Disclose AI use7 | Keep client data out of public tools5 | A lawyer checks the output5 | Ask before using it2 | Approved tools only1 | The firm has an AI policy1 | Banned outright0 | Bills AI work differently5 |
|---|---|---|---|---|---|---|---|---|
| Federal Deposit Insurance Corporation (FDIC)public bodies, 2026 | ||||||||
| UBS Group AGbanks, 2026 | ||||||||
| Arch Insurance Group Inc. (Arch Capital Group Ltd.)insurers, 2025 | ||||||||
| Office of the Attorney General of Texaspublic bodies, 2025 | ||||||||
| Zscaler, Inc.companies, 2025 | ||||||||
| The Hartford Financial Services Group, Inc.insurers | ||||||||
| University of Missouri System, Office of General Counseluniversities |
So what
The rules are short, and they all start in the same place.
For a company
If your guidelines say nothing about AI, you're with the majority, and your firms are deciding for you.
The 7 that do speak begin the same way: tell us when you used it. Then keep our information out of public tools, and have a lawyer check the work. 2 won't pay for time spent using or learning the tools. That's the whole clause set, and it fits on a page.
For a law firm
Read the 7. They're the template your other clients will copy.
None of them bans AI. The ask is to say so, to keep client data inside, and to bill for the lawyer's judgment rather than the tool's time.
In their own words.
Disclose AI use
“If a timekeeper uses generative AI for a discrete task, they should note that in their time entry.”
Keep client data out of public tools
“Never enter Sensitive Information or FDIC work product into a GenAI tool that operates in an "open environment."”
A lawyer checks the output
“The accuracy of all AI use and output must be independently verified via human review.”
Billing
“Any time and cost associated with AI-generated work product shall not be passed on to Zscaler.”
Writing the AI clause for your own guidelines?
The 7 above are the whole public record. We help companies write rules their firms can actually follow, and build the systems behind them.
The data.
Every guideline we could find on the open web, one organization per row, with the clauses and the document's own words in the CSV.
Download the data (CSV)How we did it
Outside-counsel guidelines are the rules a client gives the law firms it hires: how to bill, who may work on a matter, what to do with confidential information. Most organizations hand them to their firms through a portal and never publish them. We collected every one we could find on the open web on September 15, 2026, through search engines, sweeps of company, insurer, and public-body websites, and court dockets where guidelines had been filed as exhibits. That gave us 65 guidelines from 65 organizations: 27 from public bodies, 13 from companies, 11 from insurers, 11 from universities, 2 from banks, 1 from health systems. It's everything that is public, not a sample of everything that exists, and it leans toward public bodies and insurers, which publish, over companies, which mostly don't.
We read each document in full and coded it against a fixed rubric: does it mention AI, and if so, does it require the firm to disclose AI use, to get consent first, to keep the client's information out of public tools, to have a lawyer check the output, to use approved tools only, to hold an AI policy of its own, or to bill differently. A clause counted only when the document says it, and every yes carries the document's own words, which are in the CSV. A ban that lifts on consent counts as consent, not a ban. One organization, one record: where an organization publishes several guideline pages, we read them together. 1 document could not be read: Bayer AG (the site blocked automated requests).
Dates come from the documents themselves. 47 of the 65 carry one. The rest are left out of the before-and-after count.
The data is the table below and the CSV, released under CC BY 4.0 with attribution to Fulkerson Advisors. If your organization publishes guidelines we missed, email info@fulkersonadvisors.com and we'll add them.
All 65 organizations
- public bodies
- 27
- companies
- 13
- insurers
- 11
- universities
- 11
- banks
- 2
- health systems
- 1
Cite this study
Fulkerson Advisors (2026). What Clients Now Tell Their Law Firms About AI: 65 Outside-Counsel Guidelines Read. Read September 15, 2026. https://www.fulkersonadvisors.com/research/ai-in-outside-counsel-guidelines
Use any of these numbers or quotes. Credit Fulkerson Advisors and link to this page. The data is under a CC BY 4.0 license.
Questions
Do companies require their law firms to disclose AI use?
The ones with written rules do. Of the 65 outside-counsel guidelines on the open web, 7 mention AI, and 7 of those require the firm to disclose it, usually in the time entry or on the invoice.
Do clients refuse to pay for AI work?
Some do. Of the 7 guidelines that mention AI, 2 won't pay for time spent using or learning AI tools, 1 won't pay for AI subscriptions, and 1 expects the savings passed on as fewer hours.
Which organizations have AI rules for outside counsel?
As of September 15, 2026, on the open web: Federal Deposit Insurance Corporation (FDIC) (2026), UBS Group AG (2026), Arch Insurance Group Inc. (Arch Capital Group Ltd.) (2025), Office of the Attorney General of Texas (2025), Zscaler, Inc. (2025), The Hartford Financial Services Group, Inc. (undated), and University of Missouri System, Office of General Counsel (undated).
Do any clients ban AI outright?
None of the 7 does. 2 require the firm to ask first.