Course Overview

Most small and mid-size law firms already use generative AI, and most of them have no written program for governing it. This course gives the person responsible for AI at a firm of 5 to 50 people a complete, right-sized governance program: a risk map built on NIST AI 600-1, a management cycle built on the NIST AI Risk Management Framework, an acceptable-use policy and approved-tool inventory that support supervision under Rules 5.1 and 5.3, a security control baseline that addresses the OWASP Top 10 for LLM Applications, an incident playbook, a weighted vendor due-diligence scorecard with a pilot plan, and a regulatory watch list current as of October 2026.

The course is designed for managing partners, firm administrators, and attorneys in charge of technology. It connects every control and every contract question to a professional duty: confidentiality under Rule 4-1.6, competence under Rule 4-1.1, and supervision under Rules 4-5.1 and 4-5.3 as interpreted in Florida Bar Ethics Opinion 24-1 and ABA Formal Opinion 512. Learners will leave able to explain when a firm is a deployer or an employer under state AI laws, what Microsoft Copilot enterprise data protection does and does not cover, how to read an AI vendor’s data processing agreement, and how to run an annual governance cycle. The course is designed for Florida CLE accreditation; accreditation is pending.

What You Will Learn

• Identify the NIST AI 600-1 generative AI risks that most affect a small or mid-size law firm and map each to a practice-level consequence.
• Apply the four NIST AI RMF functions (Govern, Map, Measure, Manage) to design a right-sized governance program for a firm of 5 to 50 people.
• Implement an AI owner role, an approved-tool inventory, and an acceptable-use policy that support supervision under Rules 5.1 and 5.3.
• Recognize the OWASP Top 10 for LLM Applications (2025) threats that reach a law firm and select the identity, data, tenant, and logging controls that reduce them.
• Evaluate an AI vendor using a weighted due-diligence scorecard covering training, retention, subprocessors, attestations, contract terms, and exit.
• Analyze whether a law firm is a deployer or an employer under current U.S. state AI laws and the EU AI Act, and identify the practical obligations that follow.
• Assess the firm's own AI-related marketing claims against FTC substantiation principles and Florida Bar advertising rules.
• Implement an annual governance cycle with metrics, training refresh, policy versioning, leadership reporting, and an incident playbook.

Who Should Take This Course

• Managing partners and firm administrators at small and mid-size firms
• Attorneys responsible for technology, risk, or vendor decisions
• Legal operations, IT, and compliance staff who support law firms

Course Outline

1. Section 1: Governance for a Law Firm
   • Lesson 1.1: Why Governance, and the Risk Map
   • Lesson 1.2: NIST AI RMF for a Small Firm
   • Lesson 1.3: Roles, Inventory, and the Acceptable-Use Policy
   • Quiz 1: Governance Foundations
2. Section 2: Security
   • Lesson 2.1: Threats Specific to Generative AI
   • Lesson 2.2: Controls That Work
   • Lesson 2.3: Shadow AI, Incidents, and Response
   • Quiz 2: Security for the Small Firm
3. Section 3: Vendor Due Diligence
   • Lesson 3.1: The Questions That Matter
   • Lesson 3.2: Reading the Paper
   • Lesson 3.3: Scorecard and Pilot
   • Quiz 3: Vendor Due Diligence
4. Section 4: The Regulatory Horizon (Current as of October 2026)
   • Lesson 4.1: U.S. State Laws That Can Reach a Firm
   • Lesson 4.2: EU AI Act and Cross-Border Clients
   • Lesson 4.3: FTC and Your Own Marketing Claims
   • Lesson 4.4: The Annual Governance Cycle
   • Quiz 4: The Regulatory Horizon
5. LGTAI401 Final Exam (20 questions, 80 percent to pass)

Course Details

• Level: Intermediate
• Instruction: 80 narrated minutes (1 hour 20 minutes), plus quizzes and a final exam
• Prerequisites: LGTAI101 AI Fundamentals for Legal Professionals, or equivalent working knowledge of generative AI
• Format: Self-paced online course with narrated lessons, interactive exercises, section quizzes, and a graded final exam

Materials Included

• Student handbook (PDF)
• Quick reference card: vendor due-diligence questions (PDF)
• Vendor scorecard and pilot plan template (PDF)
• Incident playbook (PDF)

Continuing Legal Education

This course is designed for Florida CLE accreditation (anticipated request: 1.5 General, 1.5 Technology). CLE accreditation is pending; no credit is approved until The Florida Bar issues a course number.

How to Use This Course

• Complete the sections in order; each builds on the last.
• Work through every interactive exercise before taking the section quiz.
• Pass each quiz and the final exam with a score of 80 percent or higher to earn your certificate of completion.
• Keep the student handbook and quick reference card for use in practice.

Current as of October 2026. Product names, vendor policies, rules, and court decisions discussed in this course change; the course is reviewed on an annual cycle.