Why On-Premise AI Satisfies Florida Rule 4-1.6 When Cloud Tools Don't

Florida Rule 4-1.6 requires attorneys to protect client confidences. Cloud AI tools send privileged data to third parties; on-premise AI does not. Here is the confidentiality analysis that favors local, self-hosted legal AI.

What Florida Rule 4-1.6 Actually Requires

The cornerstone of the attorney-client relationship is confidentiality. In Florida, this is codified in Rule 4-1.6 of the Rules Regulating The Florida Bar. The rule is not ambiguous. It states a lawyer “must not reveal information relating to the representation of a client” unless the client gives informed consent or the disclosure is implicitly authorized. This duty extends to all information related to the representation, regardless of its source.

Recent guidance has clarified that this foundational duty applies directly to the use of artificial intelligence. The Florida Bar’s Ethics Opinion 24-1, approved in January 2024, explicitly states that lawyers using generative AI must take reasonable precautions to protect client data. The opinion stresses that attorneys must research an AI provider's policies on data retention and sharing before use.

Furthermore, effective October 28, 2024, the Florida Supreme Court amended the comments to several Chapter 4 rules to address AI. The comment to Rule 4-1.6 now warns that “a lawyer should be aware that generative artificial intelligence may create risks to the lawyer's duty of confidentiality.” The practical risk it points to is real: self-learning models that incorporate client data into future responses put confidential information outside the lawyer's control. This is a direct acknowledgement from the state's highest court that the *architecture* of the AI tool is central to the confidentiality analysis.

Rule 4-1.6(e): The Duty to Prevent Inadvertent Disclosure

Rule 4-1.6(e) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” This is the core operational mandate for technology use. The question for a managing partner is what constitutes “reasonable efforts” when using AI.

When an attorney at a 15-lawyer personal injury firm in Orlando uploads a client’s medical records, deposition transcripts, and expert witness reports to a cloud-based AI service like CoCounsel or Harvey, they are transmitting privileged data to a third-party vendor. The data leaves the firm’s direct control and resides on servers owned and managed by that vendor. While vendors provide contractual assurances and security protocols like SOC 2 certification, the data has still been disclosed.

The vendor’s terms of service become critical. Do they reserve the right to use anonymized data for training? What are their data breach notification procedures? Harvey’s privacy policy, for example, states it does not train on customer data by default, a crucial commitment. However, the fundamental act of transmission to a third party has occurred.

An on-premise system operates differently. For an employment law firm in Miami using Mi Assist Legal’s OpenClaw product on a local Mac Mini, the process is internal. Case files, interview notes, and client communications are indexed and processed by a large language model like Llama 3.2 running on a machine inside the firm’s own network. The data never traverses the public internet or enters a third-party environment. This architecture eliminates the risk of inadvertent disclosure to an outside vendor because no disclosure occurs.

Rule 4-1.1: Technological Competence

The duty of competence, defined in Rule 4-1.1, includes understanding the “benefits and risks associated with the use of technology.” The official comment to the rule was amended in 2024 to explicitly mention generative AI, noting that competence requires understanding the technology's risks and limitations.

For a real estate practice in Tampa, competence means understanding the difference between a public AI tool and a private one. Using a consumer-grade tool and inputting details from a purchase and sale agreement risks waiving privilege and violating Rule 4-1.6. Clio's 2026 report on solo and small firms found that many are using such general-purpose tools, creating "real confidentiality risks."

A competent attorney must be able to assess whether their use of an AI tool aligns with their ethical duties. This involves asking critical questions:

• Where does the data processing occur?
• Is client data used to train the vendor's model?
• What are the vendor's security protocols and breach history?
• Does the vendor have access to the queries or the documents being analyzed?

The 2025 ABA Legal Technology Survey Report revealed that data privacy and security concerns are a top-three issue for 47% of lawyers, a figure that rises to 56% in firms of 10-49 attorneys. This indicates a growing awareness that competence requires a deeper look into the technology stack. Opting for a fully local, on-premise solution is a direct way to mitigate the primary risk identified by peers: third-party data exposure.

Rule 4-5.3: Supervising Nonlawyer Assistants (and AI)

The Florida Supreme Court also amended the comment to Rule 4-5.3, which governs the supervision of nonlawyer assistants. The new language clarifies that AI tools are analogous to nonlawyer assistants and require the same level of supervision. A lawyer must give "appropriate instruction and supervision" and "consider safeguards when assistants use technologies such as generative artificial intelligence."

This has two major implications. First, as the Florida Supreme Court’s new rule effective June 15, 2026, makes clear, attorneys are responsible for the accuracy of all AI-generated output, especially legal citations in court filings. The rule was created to impose a uniform, statewide standard to deal with the risk of AI "hallucinations."

Second, supervision requires controlling the tools used. If a paralegal at a 10-attorney immigration firm in Fort Lauderdale is using a personal account on a cloud AI service to summarize client asylum applications, the supervising attorney is responsible for any resulting breach of confidentiality. The firm has a duty to provide compliant tools. An on-premise system provides a controlled environment. The firm’s IT director or MSP can ensure that the only AI tool available for handling client data is the one running securely inside their firewall, eliminating the risk of staff using unvetted, non-compliant cloud services for firm work.

A Plain-Summary Compliance Table

Ethical Duty	Cloud AI (e.g., CoCounsel, Harvey)	On-Premise AI (e.g., OpenClaw Legal)
Rule 4-1.6: Confidentiality	Client data is transmitted to and processed by a third-party vendor. Compliance depends entirely on the vendor's terms, security, and staff.	Client data never leaves the firm's network. Processing happens locally. The firm maintains 100% data control.
Rule 4-1.6(e): Prevent Disclosure	Requires extensive due diligence on the vendor's data handling, encryption, and breach notification policies. The risk of a third-party breach is always present.	Eliminates the risk of third-party disclosure by design. Data is physically and logically isolated from the public internet.
Rule 4-1.1: Competence	Requires understanding complex vendor agreements, data sovereignty issues, and the technical specifics of cloud security architecture.	Requires understanding that the system is fully contained. The risk model is simpler and aligns with existing firm IT security practices.
Rule 4-5.3: Supervision	Firm must create and enforce policies preventing staff from using unapproved third-party AI tools. Difficult to monitor and enforce.	The firm provides a single, sanctioned AI tool. Access is managed internally, simplifying supervision and compliance.

What Mi Assist Legal Does

Our team at Mi Assist Legal provides OpenClaw Legal, an on-premise AI document search and summarization platform. We install the system on a dedicated Mac Mini or Docker host that lives inside your firm’s network. By running state-of-the-art language models like Llama 3.2 locally via Ollama and indexing your case files into a private ChromaDB or Qdrant database, we ensure that your client data never leaves your control. This architecture is designed specifically to satisfy the strict confidentiality requirements of Florida Rule 4-1.6.

Frequently Asked Questions

What about cloud vendors that promise zero-retention or that they don't train on my data?

Those are crucial and necessary contractual promises. Major vendors like Harvey and Thomson Reuters make these commitments. However, they do not change the fundamental fact that to use their service, you must transmit confidential client data to their servers. An on-premise system avoids this data transmission entirely, offering a structurally superior approach to confidentiality under Rule 4-1.6.

Is an on-premise system difficult for a small firm's IT person to manage?

No. We designed the OpenClaw Legal platform for firms that have an IT consultant or a single tech-savvy employee, not an in-house engineering team. The system runs on standard hardware (a Mac Mini) or a common container platform (Docker) and is managed through a simple web interface. Our team handles the initial installation, configuration, and provides ongoing support, ensuring it integrates smoothly with your existing network.

Does using on-premise AI satisfy my duty of technological competence under Rule 4-1.1?

Using any AI tool requires competence, but an on-premise system simplifies the analysis. Instead of vetting a third-party's complex global data infrastructure, you are verifying a self-contained system that operates under your own IT policies. By choosing an architecture that inherently protects confidentiality, you are demonstrating a clear understanding of the primary technological risk The Florida Bar has identified with AI use.

Our team provides a 4-week sandbox pilot program for qualified firms. This allows you to test the OpenClaw Legal platform with your own documents in your own environment, demonstrating its workflow benefits and compliance posture firsthand. Contact us to schedule a 30-minute on-site assessment.