Outside Counsel Guidelines Now Ask About AI. Here Is How Firms Answer Honestly
The honest answer is a record, not a policy. Corporate legal departments have started writing AI questions into outside counsel guidelines and RFPs, and the firms that can show what actually left their environment on each matter answer those questions in minutes. The firms that cannot, answer with paper.
TL;DR
In-house use of generative AI more than doubled in one year, and clients are now writing AI questions into outside counsel guidelines. The ACC/Everlaw 2025 survey found active GenAI use in corporate legal departments jumped to 52% in 2025 from 23% in 2024, while 59% of in-house counsel say they do not know whether their outside counsel is using GenAI on their matters. That gap is what the new OCG questions exist to close. A policy document does not close it. A record of actual use does.
Table of Contents
Why the Questions Arrived
The pressure on outside counsel guidelines comes from a specific place: in-house teams adopted AI faster than the firms that serve them. The Association of Corporate Counsel and Everlaw surveyed 657 in-house legal professionals across 30 countries for their 2025 report, and found active generative AI use in corporate legal departments jumped to 52% in 2025 from 23% in 2024 (ACC/Everlaw 2025 report). Only 9% of respondents reported a company policy prohibiting GenAI use, down from 29% in 2024, on the same survey.
So the clients stopped asking whether AI is acceptable and started asking what their firms do with it. Lexology Pro's summary of the same survey data describes the finding bluntly: 59% of in-house counsel say they don't know whether their outside counsel is using GenAI on their matters, and 80% are neither requiring nor encouraging outside counsel AI use, a state the coverage calls a "critical disconnect" between corporate clients and law firms (Lexology Pro, 2025).
A client who does not know what their firm does with AI has two options. They can ignore it, or they can ask. The survey data and the syndicated coverage of it point in one direction: Barchart's coverage of the ACC/Everlaw report notes that as in-house AI fluency rises, corporate legal departments are increasingly expected to formalize AI-specific questions into outside counsel guidelines and RFPs rather than leaving AI use unaddressed (Barchart, 2025). Ignoring it is how a client discovers the answer in litigation.
What the Questions Look Like
The AI provisions showing up in OCGs and security questionnaires cluster around a handful of themes. Clients want to know which tools the firm uses and whether those tools are on a sanctioned list. They want to know what client data may be entered into a model, and whether it is masked, redacted, or entered raw. They want to know whether a lawyer reviews AI-assisted output before it reaches the client, and whether the firm will notify the client when AI is used on their matters. Increasingly, they also want audit rights: the ability to see a record of AI use on their work.
These questions land in the same place the ethics guidance landed. The American Bar Association issued Formal Opinion 512, its first ethics guidance specifically on generative AI tools, on 29 July 2024 (American Bar Association, 29 July 2024), and the opinion requires lawyers to understand how a given tool handles and stores input data before entering information relating to a client representation. We cover what the opinion says in detail in our guide to ABA Formal Opinion 512. The OCG questions are the client-side mirror of the same concern: what happens to our information inside your tools.
The practical difficulty for a firm is not understanding the questions. It is answering them truthfully across dozens or hundreds of lawyers. That is where the honest answers start to diverge from the comfortable ones.
Why "We Have a Policy" Is Not an Answer
The most common firm response to an AI question in an OCG or questionnaire is to attach the firm's AI policy. In-house teams have learned what that is worth. ILTA's 2025 Technology Survey, drawing on 580 law firms, found only 45% of firms report having an official policy governing generative AI tool use or a list of vetted applications, even as 80% of firms said they are using or exploring the technology (eDiscovery Today, ILTA 2025 Technology Survey coverage).
Read those two numbers together. Most firms are using or exploring generative AI, and most of those firms have no official policy at all. A client who receives a policy attachment knows it describes intent, not practice. The policy says lawyers should not paste confidential client information into public AI tools. It says nothing about what any given associate actually pasted last Tuesday.
This is the same enforcement gap that shows up inside firms as shadow AI, unsanctioned individual use that no policy reaches. We cover the general problem in our shadow AI overview and the detection side in how to detect shadow AI. For the legal-sector specifics, including what the surveys show about firm-level use, see our comparison of shadow AI in law firms. The OCG consequence is simple: a firm cannot honestly represent what its lawyers do with AI when the firm itself cannot see it.
How a firm should characterize its AI use to a client, and what its duties of disclosure require, are questions for the firm's ethics counsel. What an information governance team can do is make the underlying facts knowable, so that whatever representation is made is accurate.
What an Honest Answer Requires
An honest answer to an AI question in an OCG has three components, and every one of them is operational rather than aspirational. First, visibility: the firm knows which AI tools its lawyers actually use, including the ones nobody approved. Second, data discipline: the firm can say what kinds of information leave its environment in prompts, and what protection applied to that information before it left. Third, a record: the firm can produce, for a given matter and time period, evidence of both.
The record is the piece most firms are missing, and it is the piece the questions are actually probing. "We use AI in accordance with our policy" is a statement about intent. "Here is a log of what left our environment on your matters, and what was masked before it left" is a statement about fact. In-house teams read the difference instantly, because they have been trained to by every other vendor security questionnaire they have ever sent.
Building that record starts with prompt-level protection. If client identifiers are detected and masked on the device before a prompt is sent to a model, then a usage log of what left and what was masked is a natural byproduct of normal work rather than an extra compliance exercise. Firms assembling this capability can start with the legal-sector approach we describe for law firms, and broader context on secure AI deployment is in our enterprise AI guide.
The Firm That Answers Well Wins Work
There is a commercial reason to get this right beyond avoiding an awkward conversation. The ACC/Everlaw survey found 64% of in-house counsel expect generative AI to reduce their reliance on outside counsel, 50% anticipate lower outside counsel costs (up from 46% in 2024), and 61% plan to push for changes in how outside legal services are priced or delivered (ACC/Everlaw 2025 report). Clients are looking for firms that help them capture that value instead of resisting it.
The current state of the relationship gives firms an opening. The same survey found 59% of in-house counsel report receiving no time or cost savings yet from outside counsel's GenAI use, and only 24% are satisfied with outside counsel's GenAI adoption efforts to date (ACC/Everlaw 2025 report). Satisfaction is low and expectations are rising. A firm that can demonstrate controlled, visible, matter-level AI use is answering a question most of its competitors are still fumbling.
The firms winning these conversations pair their policy with a control stack that makes the policy true: sanctioned tools lawyers actually want to use, training, and prompt-level protection with a usage record.
Prompt-Level Protection and the Usage Record
This is the layer that turns an OCG answer from a claim into evidence. Secured AI sits between the lawyer and the AI model, and it is built with compliance-focused architecture. It detects and masks identifiers on the device before the prompt leaves. That includes names, dates of birth, account and record numbers, contact details, and custom patterns, plus legal data detection covering client names, matter numbers, case names, opposing parties, witness names, contract terms, and settlement details. Real values are restored locally when the response comes back, so the workflow does not change for the lawyer.
The part that matters for outside counsel guidelines is the record. Because masking happens at the prompt level, the system keeps a record of what left and what was masked. That is the artifact an OCG question is asking for. Matters can be governed with matter-level policies and role-based access, keys live in a zero-knowledge vault where the master key is never stored server-side, and the system works with models including OpenAI and DeepSeek.
The result is a firm that can answer the questionnaire the same day it arrives, with data, because the data was captured as a byproduct of lawyers doing their work. For more on the legal-sector deployment, see our solutions page for law firms.
Frequently Asked Questions
Do corporate clients require law firms to disclose AI use?
What should outside counsel guidelines say about generative AI?
Is having an AI policy enough to answer an OCG AI question?
Can we tell a client we do not use AI if some lawyers use it on their own?
What does a record of actual AI use look like?
Answer the next OCG AI question with evidence, not paper
Secured AI masks client identifiers on the device before a prompt leaves and keeps a record of what left and what was masked. Learn how it works for law firms on our legal solutions page.