Managing partners have been running some version of this conversation for thirty years: a lateral arrives, a conflict surfaces, a screen goes up, the file gets walled. An ethical wall (also called an ethics wall) is a documented, court-recognized information barrier that separates an attorney from matters where their prior client relationships create a conflict — restricting file access, excluding the attorney from relevant discussions, and creating an auditable record of the separation. The ethical wall infrastructure at most Am Law 200 firms reflects decades of accumulated professional responsibility discipline. When a malpractice carrier or bar investigator asks how the firm handled a separation, there is a record.
That discipline did not happen by accident. It happened because the ABA Model Rules made it mandatory, regulators made it enforceable, and firms eventually built the operational infrastructure to match. The cycle took time, but the outcome is a compliance function that most chief risk officers trust.
AI governance is on the same track, moving faster, with less time to build the infrastructure before the consequences arrive. AI governance, for a law firm, means the documented policies, access controls, and audit procedures that determine which AI tools can touch which matter data — and demonstrate, when asked, that privileged information was handled consistently with the firm’s confidentiality obligations.
Why AI governance is now a Rule 5.1 obligation alongside conflicts and ethical walls
In March 2026, the State Bar of California’s Committee on Professional Responsibility and Conduct approved proposed amendments to six professional conduct rules. The proposals are notable for what they add to Rule 5.1, which governs the responsibilities of managerial lawyers at firms. Specifically, the proposed amendment to Comment [1] of Rule 5.1 adds governance of AI use to the list of internal policies that managing lawyers must implement, alongside the existing requirements for conflicts, calendaring, and client funds. This is a comment amendment, not a change to the black-letter rule text, but comments carry interpretive weight: they define what “reasonable efforts” under the rule actually require in practice.
This is not a standalone AI rule or an advisory opinion. It is an amendment to the enforcement framework that managing partners already operate under. If the California Supreme Court approves it, a firm without documented AI governance procedures will have a harder time demonstrating that its managing lawyers met their Rule 5.1 obligations.
California is the leading edge. New York’s court-wide certification rule took effect June 1. Over 35 state bars have issued guidance, and the pattern is consistent: AI obligations are not arriving as new categories of professional responsibility. They are arriving as sharpened applications of the obligations firms already have.
How ethical wall requirements and AI governance requirements ask the same question
The overlap with ethical wall requirements is not coincidental. Both disciplines exist to answer the same question: when privileged or confidential information moves within a firm, who controls where it goes?
An ethical wall answers that question for lateral hires. The screen separates the incoming attorney from matters where their prior representations create a conflict. It restricts file access, excludes the attorney from relevant discussions, and creates a documented record of the separation. Without it, a conflict can impute firm-wide under Rule 1.10.
The AI governance question is structurally identical. When a lawyer runs a matter file through an AI tool, where does that information go? Is it isolated within the firm’s infrastructure, or is it transmitted to a vendor’s external model? Can it surface in a response to a query on a different matter? Does the tool have access controls at the matter level, or does it operate across the firm’s full data set?
These are not IT security questions. They are privilege questions, and the California COPRAC Practical Guidance updated for 2026 says so explicitly: “Unrestricted or poorly configured agentic systems may unintentionally disclose confidential information across different matters.” The duty to configure AI tools with appropriate matter-level access controls is the governance equivalent of the duty to implement a timely ethics screen.
What the consequences look like when AI governance is missing
The stakes for getting this wrong are not theoretical. A January 2026 report documented more than 500 confirmed instances of AI-generated content appearing in U.S. court filings, and courts have moved from monetary sanctions to counsel disqualification. Outside counsel guidelines from Fortune 500 clients now routinely require explicit approval before client data is processed by any third-party tool — and 71% of Fortune 500 general counsel, according to a 2025 American Lawyer survey, are asking about AI use during panel negotiations. A firm that cannot answer those questions with documented controls is losing work to firms that can.
For a chief risk officer, this is the more immediate concern. The bar rulemaking will take time to finalize. The client-side consequence is already here.
What sound AI governance infrastructure actually requires
The firms that built sound ethical wall programs didn’t do it by writing a policy and assuming the organization would follow it. They built operational infrastructure: access controls, documented screen decisions, audit logs, notification procedures, and integration with the systems lawyers use every day. When those screens were challenged — in disqualification motions, bar complaints, or malpractice proceedings — that documentation was the difference between a defensible record and an exposed firm.
AI governance requires the same approach. A written policy is the starting point. What it cannot do on its own is demonstrate, at the matter level, that a specific AI interaction involving a specific client file was handled consistently with the firm’s confidentiality obligations — and produce that record in days, not weeks, when a GC or bar investigator asks. That requires operational infrastructure, not just intent.
The firms building that infrastructure now will be the ones that answer the bar’s questions, satisfy their clients’ OCG requirements, and retain panel work when governance becomes a selection criterion rather than an afterthought.
Speak with our team about governed AI for law firms.