What the Florida Bar expects of your firm's technology and security

The Florida Bar publishes no IT standard. There's no approved product list and no certificate to hang in reception. What there is instead is a short set of rules and ethics opinions that all say the same thing: you may use the technology, and you are responsible for understanding it well enough to protect your clients.

That puts the judgment on you. This article collects what the Bar has said, in one place, and turns it into a list a managing partner can act on. It isn't legal advice or an ethics opinion. Read the sources, and call the Bar's Ethics Hotline with a specific question.

1. Competence includes technology (Rule 4-1.1)

The comment to Rule 4-1.1 says staying competent includes understanding the benefits and risks of the technology you use. Since 2024 it names generative AI.

It also offers a way to meet the duty: a lawyer can retain a non-lawyer adviser with established technological competence. You don't have to become an engineer. You do have to know enough to choose one and to ask the right questions.

2. Three hours of technology CLE

Florida lawyers complete 30 hours of continuing legal education every three years, and at least three of those hours must be in approved technology programs.

3. Confidentiality means reasonable efforts (Rule 4-1.6)

Rule 4-1.6 requires reasonable efforts to prevent unauthorized access to, or disclosure of, information relating to a client's representation.

"Reasonable" is weighed after the fact, against things like how sensitive the information was, how likely a disclosure was without more protection, and what that protection would have cost.

Our reading, for what it's worth: that test moves. Multi-factor authentication is close to free and takes a morning to turn on. It gets harder each year to argue that going without it was reasonable.

4. Cloud storage is allowed, with homework (Opinion 12-3)

Ethics Opinion 12-3 says lawyers may keep client files in the cloud, provided they take reasonable precautions. In practice that means researching the provider: how it secures the data, whether it's contractually bound to keep it confidential, and whether you can get your files back.

For the systems most firms use, that homework is a matter of reading the terms and keeping a note that you did. For a small or unfamiliar vendor, ask the questions in writing.

5. Devices that store client data (Opinion 10-2)

Ethics Opinion 10-2 covers copiers, scanners, printers and anything else with storage inside it. The lawyer has to know what the device keeps, supervise whoever services it, and make sure it's wiped when it leaves the firm.

The usual gap is the leased copier that goes back to the dealer with every page it ever scanned still on its drive. The same goes for old laptops, phones and backup drives.

6. Your vendors are your responsibility (Rule 4-5.3)

Rule 4-5.3 makes lawyers responsible for the conduct of non-lawyers who assist them, and that reaches outside vendors. Your IT provider holds the keys to every file in the firm. Your e-discovery vendor, your answering service and your document storage all touch client information.

For each one you should know what they can access, what the contract says about confidentiality, and how they protect themselves. Our ten questions to ask an IT provider covers this, especially question four.

7. AI is allowed, with conditions (Opinion 24-1)

Ethics Opinion 24-1, issued January 19, 2024, says a lawyer may use generative AI, subject to the existing duties:

• Confidentiality. Research the tool's policies on data retention, data sharing and self-learning. The opinion recommends getting the client's informed consent before using a third-party AI tool in a way that discloses confidential information.
• Accuracy. Verify everything it produces, as you would a junior's work.
• Billing. No charging twice for the same work.
• Advertising. The usual rules apply to chatbots and AI-written marketing.

We go through what that means in practice in can your firm use ChatGPT with client information?

8. When something goes wrong

Florida's rules have no breach-specific provision, but three things apply:

• Rule 4-1.4 requires you to keep clients reasonably informed.
• ABA Formal Opinion 483 says a lawyer who suffers a breach must stop it, work out what happened, and tell current clients whose confidential information was involved. ABA opinions are persuasive rather than binding in Florida, but this is the standard you'd be measured against.
• Florida's data breach statute sets a 30-day deadline for notifying people whose personal information was accessed. See Florida's data breach law.

And one more, where money is concerned: funds in trust are the most direct target a law firm has. See wire fraud at closing and the call-back rule.

What a managing partner should have in place

Each line maps to something above. The last one matters most.

• Multi-factor authentication on email, the document system and remote access (Rule 4-1.6)
• Encryption on every laptop and phone (Rule 4-1.6)
• A vendor list showing what each one can access, with the confidentiality term in each contract (Rule 4-5.3, Opinion 12-3)
• A disposal step for copiers, computers and phones (Opinion 10-2)
• A written AI policy naming the approved tools (Opinion 24-1). Our AI use policy template is a start.
• Same-day removal of access when someone leaves. See the offboarding checklist.
• Backups that have been tested, including email and cloud files
• A one-page incident plan with your insurer's and a breach lawyer's numbers
• Training records and your technology CLE hours
• All of it written down. "Reasonable efforts" is judged afterward, by someone reading a file. What you can show is what counts.

Our law firm cybersecurity checklist goes through the technical side in more detail.

What it costs, against what's at stake

For a lawyer the exposure isn't only money. It's a grievance, a malpractice claim, a trust account, and a client's privilege.

	What it comes to
Our Business plan for a ten-person firm	$1,490 a month, $17,880 a year
Our Secure plan, with a written security plan and help answering client security questionnaires	$2,340 a month, $28,080 a year
One day locked out before a deadline	Eight timekeepers billing six hours at $350 is $16,800 of time, before the motion for an extension
One diverted wire	About $123,000 on average, by the FBI's 2025 figures for email payment fraud
A breach of client files	Notifying clients, a claim on your insurance, and the conversation with your largest client's general counsel

The billing figures are an example; put in your own. The point stands at most rates. A year of having this handled costs about what one bad day does, and on that day you have someone to call who already knows your systems, your insurer's requirements and what your records will show.

That's what most managing partners are really buying. Not software. The ability to say, to a client or to the Bar, "here is what we had in place," and to have somebody in their corner while they say it.

Where to start

Pick the three lines on the list you're least sure of and find out the answer this week. If you'd like a second pair of eyes, book a free review. We work only with professional firms; see how we look after law firms.