Hoag Law.ai

Tag: AI ethics

  • California’s SB 37: Your AI Chatbot Is Your Ad. You Own it. Act Like It.

    California’s SB 37: Your AI Chatbot Is Your Ad. You Own it. Act Like It.

    This is educational material and does not constitute legal advice nor is any attorney/client relationship created with this article, hence you should contact and engage an attorney if you have any legal questions.

    California’s SB 37 took effect January 1, 2026, and if you’re a California attorney with an AI chatbot on your website, you’re already in the highest-risk category under the new law.

    SB 37 is about attorney responsibility in outsourced influence. It doesn’t matter whether your marketing vendor wrote it, your intake platform generated it, or your chatbot spit it out.

    If it markets your firm, you own it.

    The chatbot problem most attorneys haven’t thought through

    AI chatbots on law firm websites sit at the intersection of two distinct compliance obligations, and most attorneys are only thinking about one of them.

    The first is SB 37: your chatbot’s responses are advertising. They need to comply with California’s attorney advertising rules, so no misleading claims, no implied guarantees, proper identification of a responsible California-licensed attorney.

    The second is privilege. This one is urgent right now, because of a case that just dropped two weeks ago.

    In United States v. Heppner (SDNY, Feb. 17, 2026), Judge Rakoff held that a criminal defendant’s conversations with the consumer version of Claude — used independently, without attorney direction — were not protected by attorney-client privilege or the work product doctrine. The reasoning: Claude isn’t a lawyer, and Anthropic’s consumer ToS expressly permits review and disclosure of user inputs. No confidentiality, no privilege. (Beyond the ruling’s text, I should clarify that this is almost certainly true even if training is toggled off, and even on paid consumer plans. Only enterprise plans, and even then, optimally, with ZDR policies in place, are sufficiently safe not to waive privilege.)

    While this is obviously a NY-only ruling for the moment, it stands to reason that other states will follow suit. So that ruling has a direct implication for your intake chatbot. If a prospective client starts describing their legal situation to your AI chatbot before they’ve engaged you, that conversation may be discoverable. Likewise, if your client — or potential client — use an AI chat bot powered by a consumer-tier AI with permissive data handling terms, you’ve compounded the problem.

    How I implemented live chat on my site

    I recently set up a live chat tool (Crisp.chat if you’re curious; one nice thing, they’re EU-based in France so it makes GDPR compliance a breeze) for my own law practice website — not an AI bot, just a standard live chat widget — and I set it to auto-open on the first page load with this:

    “Please do NOT share any private or otherwise confidential information here as there is no attorney/client privilege between us unless and until we sign an Engagement Letter. In the meantime, please do NOT discuss any legal issues with a public AI tool like ChatGPT, Claude, Grok, Gemini, etc., as this may waive any attorney/client privilege that might otherwise exist between us.”

    That’s not legalese for its own sake. It’s a direct response to Heppner and to the data handling realities that SB 37 now forces you to confront.

    For the record, I have mixed feelings on the direction the law is trending:

    First, although I agree with the technical reality that an AI chat both is entirely different to a cloud storage provider, I question the practical reality, and thus, whether it should be considered a third party disclosure.

    And second, I find it exceedingly hard to reconcile the recognition that more than 1 billion people world wide now use ChatGPT for discussing their most private, personal, and confidential matters, while we steadfastly maintain that there is no expectation of privacy in such discussions. These two conclusions seem absolutely, undeniably, mutually exclusive to me.

    A practical checklist

    Before your next client intake conversation happens through your website chatbot — whether it’s an AI bot or simple “dumb chat box,” ask yourself:

    • Does my chatbot identify a responsible California-licensed attorney?
    • Are its responses reviewed by an attorney before going live?
    • Do I know where those conversations are being sent and stored?
    • Am I warning visitors not to share privileged information?
    • If it’s AI-powered, what are the underlying platform’s data retention and disclosure terms?

    If you can’t answer all five confidently, you have work to do.

  • Everything you need to know about California’s new AI romance bill

    Everything you need to know about California’s new AI romance bill

    In era where artificial intelligence is weaving itself into the fabric of daily life, California has taken a bold step forward with Senate Bill 243 (SB 243). Fast on the heels of California’s first-in-nation AI law, SB53, and signed into law by Governor Gavin Newsom on October 13, 2025, this legislation marks the nation’s first targeted regulation of AI-powered companion chatbots, aiming to shield users — particularly minors — from potential mental health risks and emotional harms. With tragic incidents highlighting the dark side of unregulated AI interactions, SB 243 introduces mandatory disclosures, safety protocols, and reporting requirements to ensure these digital companions don’t exacerbate issues like suicidal ideation or dependency.

    The Rise of Companion Chatbots and the Need for Regulation

    Companion chatbots, such as those powered by models like ChatGPT (which, according to OpenAI CEO Sam Altman, is soon to be fully unlocked to allow “erotic” interactions) and xAI’s Grok, are designed to simulate human-like conversations, offering adaptive responses that can fulfill social needs and sustain relationships over multiple interactions. 

    These tools have exploded in popularity, providing everything from casual chit-chat to emotional support. However, their anthropomorphic qualities — mimicking empathy, humor, and personality — can blur the line between machine and human, leading to unintended consequences.

    The impetus for SB 243 stems from harrowing real-world cases. For instance, the suicide of 14-year-old Sewell Setzer in Florida was linked to interactions with a chatbot that inadequately responded to his expressions of distress and even encouraged harmful thoughts. Similarly, California teen Adam Raine’s death was allegedly influenced by a chatbot’s encouragement of self-harm. Reports have also surfaced of chatbots engaging in inappropriate “sensual” dialogues with children or failing to detect suicidal ideation, prompting concerns from child safety advocates and experts. 

    Senator Steve Padilla, the bill’s author, emphasized that while AI can be a powerful educational tool, the tech industry’s incentives often prioritize user engagement over well-being, potentially at the cost of children’s real-world relationships and mental health. SB 243 addresses these gaps by mandating safeguards, building on existing laws like those combating cyberbullying and supporting suicide prevention efforts through the state’s Office of Suicide Prevention.

    Key Provisions of SB 243

    SB 243 adds Chapter 22.6 to California’s Business and Professions Code, defining and regulating “companion chatbots” while excluding benign uses like customer service bots or video game features. Here’s a breakdown of its core requirements for operators (companies making these platforms available to California users):

    1. Transparency and Disclosures

    • If a chatbot could mislead a reasonable person into thinking they’re talking to a human, operators must provide a clear and conspicuous notification that it’s AI-generated.
    • For all users, platforms must disclose that companion chatbots may not be suitable for some minors, displayed prominently on apps, browsers, or other access points.

    2. Protections for Minors

    • Operators must disclose to known minor users that they’re interacting with AI.
    • During extended interactions, minors receive automatic reminders every three hours to take a break and reaffirm that the chatbot is not human.
    • Reasonable measures must prevent chatbots from generating sexually explicit visual material or encouraging minors to engage in such conduct.

    3. Mental Health Safeguards

    • Operators cannot allow chatbot engagement without a published protocol to prevent content promoting suicidal ideation, suicide, or self-harm. This includes referring users to crisis services like suicide hotlines if such topics arise.
    • Protocols must be detailed on the operator’s website, using evidence-based methods to detect and respond to these risks.

    4. Reporting and Accountability

    • Starting July 1, 2027, operators must submit annual reports to the Office of Suicide Prevention, detailing crisis referrals, detection protocols, and prohibitions on harmful responses, without including personal user data.
    • The office will publicly post this data, fostering transparency and ongoing monitoring.

    The law takes effect on January 1, 2026, giving companies time to comply. Noncompliance opens the door to civil actions, where affected individuals can seek injunctive relief, damages (at least $1,000 per violation), and attorney fees. 

    Implications for Tech Companies, Users, and AI Regulation

    For tech giants like OpenAI and Meta, SB 243 means retooling platforms to include robust monitoring and referral systems, potentially increasing operational costs but also setting a precedent for ethical AI design. 

    The Computer and Communications Industry Association, initially opposed, ultimately supported the bill after amendments, viewing it as a balanced approach to child safety without banning AI outright. 

    However, some advocates, like Common Sense Media, criticized it for not going far enough, preferring stricter measures in related bills like AB 1064. 

    Users, especially parents and minors, gain peace of mind through enforced transparency and harm prevention. 

    Experts like UC Berkeley’s Jodi Halpern hail it as a critical step against addictive dependencies and public health risks.

    Broader implications position California as a leader in AI governance, complementing other 2025 laws on privacy and child protections, and potentially influencing federal policies amid FTC investigations into chatbot harms. 

    Conclusion: A Foundation for Safer AI Interactions

    SB 243 isn’t just legislation, it’s a response to the human cost of unchecked innovation. As Senator Padilla noted, it establishes “the bedrock for further regulation as this technology develops.” By prioritizing mental health and accountability, California is charting a path toward AI that enhances lives without exploiting vulnerabilities. As we integrate more AI into our social spheres, laws like this remind us: technology should serve humanity, not the other way around.

  • Using AI in Law: Compliance with ABA Model Rules and Best Practices [UPDATED: February 19, 2026]

    Using AI in Law: Compliance with ABA Model Rules and Best Practices [UPDATED: February 19, 2026]

    This is educational material and does not constitute legal advice nor is any attorney/client relationship created with this article, hence you should contact and engage an attorney if you have any legal questions. Any discussion on technical matters may be inaccurate or no longer timely, so you should consult with the various vendors mentioned below to clarify and to ascertain accuracy.

    The ABA Model Rules of Professional Conduct strongly imply, if not yet require, the adoption of generative AI technology in the practice of law.

    The legal sector is rapidly embracing generative AI to streamline tasks such as research, drafting, document review, finding the needle in a haystack of email discovery, and more.

    The case in 2023 of a New York lawyer being sanctioned for filing a brief with fake AI-generated case citations first alerted the world with a cautionary reminder: while AI can enhance our capabilities, it must be wielded with utmost responsibility to prevent ethical violations and safeguard our reputation.

    While hallucinations have largely vanished as of this update in February 2026, attorneys must always review AI-generated output just as they review other associates’ and paralegals’ output, too.

    Accordingly, the ABA Model Rules of Professional Conduct and California Rules of Professional Conduct, which largely align with the ABA Rules, not only imply but arguably necessitate the adoption of technology, including generative AI, to maintain competent client representation.

    Embracing Competence through Technology

    Maintaining competence is a fundamental ethical obligation for lawyers. According to ABA Rule 1.1 on Competence, this includes staying updated on changes in the law and its practice, including the benefits and risks associated with relevant technology (Comment 8 to ABA Rule 1.1).

    This rule arguably implies that lawyers should use AI tools to enhance their practice, while emphasizing the need to ensure the accuracy and reliability of AI-generated content.

    Regular training and the adoption of advanced AI tools are prudent ways to fulfill this obligation, ensuring that lawyers are well-versed in both the capabilities and limitations of AI technologies.

    Enhancing Diligence with AI

    ABA Rule 1.3 on Diligence requires lawyers to act with reasonable diligence and promptness in representing a client; this therefore implies strongly that technology must be used to balance a lawyer’s workload.

    A lawyer relying on pen and paper to draft in days or weeks what would ordinarily take hours with a word processor, or to eschew email entirely for communicating with opposing counsel in favor of using only postal mail, would arguably run afoul of this rule if only because of the unnecessary delays and resulting costs that such anachronistic work would impose upon clients.

    AI tools can likewise be a significant asset in managing workloads and delivering timely service to clients. By automating routine tasks like legal research, document review, drafting, and sifting through hundreds and thousands of discovery documents, lawyers can free up valuable time for more complex and strategic aspects of their work; in some instances the time and cost savings can be profound, sometimes reducing to mere minutes what would have otherwise taken hours.

    However, it is crucial to remember that AI is not a substitute for human judgment and expertise, and errors are still a concern. Lawyers must still exercise diligence in reviewing and verifying AI-generated content to ensure its accuracy and relevance to the specific case at hand.

    Ensuring Accuracy in AI Outputs

    ABA Rule 3.1 on Meritorious Claims requires that lawyers only bring forward claims that are based on law and fact. Comment 2 to this rule emphasizes that an “action is frivolous … if the lawyer cannot make a good faith argument on the merits of the action taken” or support it by a good faith argument for the extension, modification, or reversal of existing law.

    Therefore, it is essential to independently verify the accuracy of AI-generated content, including sources, citations, case law, statutes, and quoted language.

    Manually checking all citations and legal references against primary legal sources is crucial, and simply asking or “prompting” a generative AI tool to “double-check its work,” as it were, will not usually suffice.

    What can sometimes help is to use multiple generative AI platforms in parallel, by running your desired output from the first platform back and forth through all of them, as if slowly distilling the end result through a funnel to filter out the errors.

    Maintaining Transparency and Protecting Confidentiality

    Transparency in disclosing AI usage not only fosters trust but also helps the court and clients understand the role of AI in your work. ABA Rule 1.4 on Communication emphasizes the importance of keeping clients reasonably informed about the status of their matter.

    When using AI tools, lawyers should disclose this to their clients and explain how AI is being used to assist with their case. This can be done through engagement letters or other client communications. Below is an example of such a clause:

    Use of Artificial Intelligence (AI)

    In representing you, I may use generative AI tools for tasks such as legal research, drafting, email and file management, and analysis. These tools augment, but do not replace, my professional judgment. Any use of such tools will be consistent with applicable ethics rules, and I will maintain human oversight and protect your confidential information.

    However, ABA Rule 1.6 on Confidentiality mandates that lawyers must protect client information. When using AI tools, particularly those connected to public APIs, it is crucial to ensure that no confidential information is inadvertently disclosed.

    Crucially, when evaluating any AI platform for use with client-confidential information, attorneys should assess the following factors — roughly in decreasing order of importance:

    1. Zero Data Retention (ZDR) Policies. The single most critical requirement. Confirm that the AI provider contractually commits to not retaining your prompts, outputs, or uploaded documents beyond the duration of the session or API call. This is distinct from merely “opting out” of training — ZDR means the provider does not store your data at all, period. Major providers like OpenAI and Anthropic offer ZDR through their API and enterprise tiers if negotiated, but their free consumer products typically do not provide this protection. Always verify ZDR commitments in the provider’s Data Processing Agreement (DPA) or enterprise terms, not just their marketing materials.
    2. No Training on Your Data. Separately from retention, confirm that the provider does not use your inputs or outputs to train, fine-tune, or improve its models. While most enterprise and API tiers now exclude customer data from training by default, consumer-tier products often do not. This should be an explicit contractual commitment, not merely a toggle in a settings menu that can be changed unilaterally.
    3. Data Isolation and Access Controls. Understand the provider’s architecture: Is your data logically or physically isolated from other customers? Who at the provider has access to your data, and under what circumstances (e.g., trust and safety review, debugging)? Enterprise deployments and private instances offer stronger isolation, but even shared-infrastructure API access can be acceptable if ZDR and no-training commitments are in place.
    4. Encryption in Transit and at Rest. Ensure the platform uses industry-standard encryption (TLS 1.2+ in transit; AES-256 at rest). This is table stakes — virtually every reputable provider meets this standard — but it should still be confirmed, particularly for any data that is retained (e.g., conversation logs you choose to save on the platform).

    The critical distinction is between cloud storage (where the platform functions like a filing cabinet, holding your data for your later retrieval) and data processing (where the platform processes your data ephemerally and discards it).

    For AI tools handling privileged information, you want processing without storage — and ZDR is how you get there.

    And no, public AI platforms are not the same as cloud storage. The former is considered disclosure to a third party and thus risks waiving privilege, while the latter is not.

    Finally, if the platform allows you to save conversation histories or upload documents for persistent use, confirm that (a) such data is deletable on demand, (b) deletion is actual deletion and not merely soft-deletion or archival, and (c) you understand the provider’s data retention schedule for any backups or logs.

    My AI Privacy Guide was built for precisely this reason: to help you understand the various platforms’ Terms of Service and Privacy policies so that you can make a better informed decision.

    Ethical Supervision of AI Tools

    As AI tools — generative AI specifically — become more prevalent in legal practice, lawyers must remember that they are ultimately responsible for the work product generated using these tools.

    ABA Rules 5.1 and 5.3 emphasize the ethical duties of lawyers to supervise subordinate lawyers and non-lawyer assistants, including AI tools. This involves understanding how the AI tool works, monitoring its output for accuracy and reliability, and ensuring that its use aligns with ethical and professional standards, including and especially, matters involving privacy and confidentiality.

    Addressing Emerging AI Challenges

    The rapid advancement of AI in the legal industry raises novel ethical and legal questions that lawyers must be prepared to address. ABA Resolution 112 (2019) urges courts and lawyers to address emerging issues related to AI usage, such as algorithmic bias, explainability, and transparency.

    By staying informed about these issues and proactively implementing best practices for ethical AI usage, lawyers can harness the power of AI to improve efficiency and client service while upholding the highest standards of professionalism and integrity. This proactive approach includes engaging in continuous education about AI technologies and their ethical implications.

    If you’re curious to try an interesting academic thought exercise, consider asking your favorite AI chatbot — be it ChatGPT; Claude; or GC.AI — to draft a new set of fictitious rules for the ABA or California Rules of Professional Conduct governing the use of AI. I used the prompt below, but you should play around and see what you come up with:

    Can you please produce a fictitious rule for the California Rules of Professional Conduct, about the use of AI like LLMs like ChatGPT? Please give it appropriate headings and section numbers to fit into a logically coherent place in the existing rules, make sure it’s suitably detailed, and so on.

    I don’t want to give anything away, but I think you’ll find this exercise as entertaining as it is awe-inspiring and impressive. And while it obviously offers no practical value, it certainly suggests a very plausible direction to where things are likely headed with generative AI and the legal community.

    Spoiler alert: I’ll state for the record that I think it will soon be ethical malpractice NOT to use AI in the practice of law, or indeed, any profession, very soon; say, 2030.

    Closing Thoughts

    Generative AI is a revolutionary, society-changing tool the likes of which humanity has never seen before; a fantastic magic heretofore relegated only to the realm of fantasy and science fiction. It can significantly enhance the efficiency, accuracy, and client service in legal practice, but is not yet a replacement for human judgment and expertise.

    Attorneys must remain ethically responsible for their work product, regardless of the tools used. By selecting appropriate AI tools, verifying AI-generated content, adhering to court rules, transparently disclosing AI usage, and addressing the ethical implications of AI, lawyers can effectively integrate AI into their practice while avoiding potential pitfalls.

    And despite the risks, it is precisely because of the immense power and productivity gains offered by generative AI that the ABA and California Ethics Rules at least impliedly support and potentially encourage the thoughtful use of such technology to uphold the high standards of competence and ethical practice required in the practice of law, which at the end of the day, must always be in the client’s best interest.

    For more insights on responsible AI usage in legal practice, feel free to reach out or explore our resources.