AI-Assisted Document Review: Ethics, Verification and a Workflow You Can Defend

When a client hands over six years of email, a phone’s worth of messages or a folder of four thousand screenshots, AI-assisted review is no longer a novelty question. The ethics question is not whether your team can use AI to get through the material. It is how you keep the review yours: accurate, confidential, supervised and explainable when someone asks how it was done.

This guide breaks AI-assisted document review into the stages where AI actually enters the work, names how each stage tends to fail, and lays out a verification and documentation workflow a litigation team can adopt. It is written for attorneys who sign off on review and the paralegals and staff who run it day to day. The rules cited are the ABA Model Rules and Federal Rules; your state’s versions and local practice may differ.

What makes AI-assisted review an ethics issue?

AI review produces derived work product, such as extracted text, summaries and relevance or privilege codes, that looks authoritative and can quietly replace the source in people’s minds. The duties are the same ones that govern human review; the failure modes are different.

The professional obligations that apply most directly:

• Competence (Rule 1.1). Understand what the tool does and does not do well, and verify accordingly. ABA Formal Opinion 512 applies this directly to generative AI.
• Confidentiality (Rule 1.6). Know where client documents go when the tool processes them, and whether inputs are retained or used for training.
• Supervision (Rules 5.1 and 5.3). The lawyer is responsible for the review process, including what nonlawyers and outside tools contribute.
• Candor (Rule 3.3) and discovery certifications. Under Federal Rule of Civil Procedure 26(g), signing a discovery response certifies a reasonable inquiry. “The software missed it” is not a plan.

For the full rule-by-rule picture, see our guide to ABA Formal Opinion 512.

Where does AI enter the review workflow, and how does it fail?

AI typically touches five stages of review. Each has a characteristic failure, and each needs its own control.

Notice the pattern: the riskiest error is usually omission, not invention. A summary that leaves out the one message that matters reads perfectly well. That is why sampling what the tool excluded matters as much as checking what it produced.

How do you verify AI review output?

Verify in proportion to how the output will be used: lighter checks for internal triage, line-by-line checks for anything that becomes an exhibit, a quote or a representation to the court. A repeatable protocol looks like this:

1. Preserve first. Before any tool processes the material, keep the originals untouched and record a hash value for each file, so you can later show the source was not altered. Our guide to hash values in litigation explains what that fingerprint does and does not prove.
2. Keep AI output in its own layer. Extracted text, summaries and codes should sit beside the original, clearly labeled as machine-generated, never written into or over it.
3. Set acceptance criteria by use. Decide in advance what level of checking each output type needs before anyone relies on it.
4. Review and correct. A person compares output to source and records corrections separately, so you can see both what the tool said and what the reviewer changed.
5. Sample the excluded set. Pull documents the tool marked not relevant or not privileged and have a reviewer read them.
6. Escalate and sign off. Relevance and privilege judgment calls go to the responsible attorney, who approves the results.

Sampling the discard pile

Choose a sample size you can explain, draw it randomly rather than picking convenient documents, and record what the reviewer found. Sample within meaningful groups, too: a tool that performs well on email may struggle with scanned handwriting or group chats, so a single blended sample can hide a weak category. If the sample surfaces responsive or privileged material the tool missed, that is a signal to widen human review or adjust how the tool is being used, and to note the change in your review record. For more on structuring review stages, see our evidence review workflow for paralegals.

How do you protect confidentiality during AI review?

Treat every AI tool as a place client documents travel to, and confirm the terms before the first upload. ABA Formal Opinion 512 concludes that a self-learning tool requires the client’s informed consent before information relating to the representation is entered.

• Confirm whether the tool retains inputs, uses them for training, or sends them to another processor.
• Keep review data segregated by matter, with access limited to the assigned team.
• Never paste client productions into a consumer chatbot account outside firm controls.
• Remove material that does not need AI processing, such as already-reviewed privileged files.
• Record client consent where required, and keep the tool’s terms with the matter file.

What should you disclose, and to whom?

Disclosure obligations run to three audiences, and each depends on context rather than a universal rule.

The client. Under Rule 1.4 and Opinion 512, tell the client when they ask, when consent is required, when AI output will drive a significant decision, or when AI use affects the fee.

Opposing counsel. Review methodology, including technology-assisted review, is often discussed at the Rule 26(f) conference or in an ESI protocol. If your protocol addresses it, follow it. If privilege review relies partly on automation, consider whether a clawback agreement or an order under Federal Rule of Evidence 502(d) or its state counterpart makes sense; our privilege log guide covers the logging side.

The court. Some judges and courts require disclosure or certification of AI use in filings. Check standing orders before anything AI-assisted is filed.

How do you document a defensible AI-assisted review?

Write a short, contemporaneous review memo for each matter. If anyone later questions the review, you can explain what happened without reconstructing it from memory.

What goes wrong most often?

Most AI review problems are workflow problems, not technology problems. These five recur:

• The summary becomes the evidence. Someone quotes the summary in a declaration instead of the document.
• Speakers get flipped. Screenshot extraction loses which side of the conversation a bubble was on.
• Times shift. Exports and extraction tools handle time zones differently, and events land on the wrong day.
• Privilege slips through. An unflagged email to counsel is produced because nobody sampled the unflagged set.
• Corrections overwrite originals. A reviewer “fixes” the text and nobody can tell what the source said.

Tools can build several of these controls in. Evidence Helper preserves each original untouched with a SHA-256 hash on arrival, offers AI-assisted text extraction that a person reviews, stores corrections separately and generates exhibit PDFs deterministically without AI (details on how evidence review works). Whatever you use, the same rule applies: the AI drafts, people verify, and the record shows who did what. If a review decision turns on how your jurisdiction treats a particular issue, the responsible attorney makes that call.