Before your firm turns on Copilot or ChatGPT: what to check
AI tools can genuinely help a law or accounting firm: summarizing long documents, drafting first versions of letters, cleaning up notes. Many firms are past the question of whether and are now asking how to roll them out sensibly. A few checks before you switch anything on will save rework later.
1. Find out what's already in use
Before choosing a tool, ask what staff are using today. People often try free chatbots, browser extensions, or AI features in software the firm already licenses. A short, no-blame survey usually gives a more honest picture than a policy announcement. The goal is an inventory, not a crackdown.
2. Understand what Copilot can see
Microsoft 365 Copilot works with the documents, email, chats, and meetings your users can already access. Microsoft's Copilot privacy documentation states that it only surfaces organizational data to which individual users have at least view permission.
That is reassuring and also the reason to look first. Copilot doesn't create new access, but it makes existing access much easier to use. A file shared too broadly years ago, such as a payroll spreadsheet visible to the whole firm or a matter folder shared with "Everyone," becomes easy to find with a simple question. Before rollout, ask your IT provider to review:
- SharePoint sites and Teams that are open to the whole organization
- Files shared with "Anyone with the link" or with large groups
- Former staff and guest accounts that still have access
- Whether sensitivity labels are in use, and if so, how they're applied
3. Read the terms for any tool outside Microsoft 365
For ChatGPT or other outside tools, the key questions are about the account type and its settings. What happens to what you type in? Is it retained, and for how long? Can it be used to train models, and can that be turned off? Who at the vendor can see it? Consumer and business versions of the same product often have different terms. Read the current terms for the specific plan you're considering rather than relying on what a colleague heard.
4. Decide what information should never go in
A simple rule set beats a long policy no one reads. For example: no client names, Social Security numbers, account numbers, or privileged content in tools the firm hasn't approved. In approved tools, staff still verify every output before it reaches a client, a court, or a return.
For law firms, the ABA's Formal Opinion 512 covers competence, confidentiality, client communication, supervision, and fees when using generative AI. Check your state bar's guidance as well.
For CPA and tax firms, AI use belongs in your Written Information Security Plan. The IRS notes that tax and accounting professionals are required to maintain a WISP under the FTC Safeguards Rule, and Publication 5708 provides a template. Adding approved AI tools and data rules to that plan keeps everything in one place.
5. Make sure you could look back later
If someone asks, "Did any client data go into an AI tool?", could you answer? Confirm with your IT provider that audit logging is on and how long records are kept under your licensing. For Copilot, Microsoft's documentation describes how admins can find and retain Copilot interactions through Microsoft Purview.
6. Start small and write it down
Pilot with a small group, collect feedback, and write a one-page guide covering approved tools, what not to enter, how to check outputs, and who to ask. Revisit it in a few months, because both the tools and the guidance from regulators and bar associations are still changing.
A sensible order
- Inventory current use.
- Clean up oversharing in Microsoft 365.
- Pick approved tools and read their terms.
- Write a short guide.
- Pilot, then expand.
None of this requires buying new software. It mostly requires an honest look at access you already have.
About Switchback Cyber. Switchback Cyber offers a fixed-scope, read-only review of a single Microsoft 365 tenant that includes an AI-use inventory, a review of sharing and access, and practical AI guidance your team can actually follow. It is designed to work alongside your current IT provider. If that would help before a rollout, you can find more at switchbackcyber.com.