The National Association of Criminal Defense Lawyers is urging defense attorneys to adopt AI tools—but only under written controls that treat confidentiality, verification and human judgment as non-negotiable. Its newly released report, Parity in Practice: The Defender’s Duty to Ethically Use AI, argues that defenders risk falling further behind as prosecutors and law-enforcement agencies deploy AI for investigation, charging and evidence review.
As reported by the ABA Journal and detailed by Courthouse News Service, the report was written by St. Mary’s University School of Law assistant professor Mason Clark. Its core recommendation is not to paste case files into public chatbots, but to develop a deliberate, defensible AI practice that can improve document review, research and case preparation without compromising a client’s rights.
The report flags commercial generative-AI services—including ChatGPT, Google Gemini and Anthropic Claude—as potential confidentiality hazards when lawyers use consumer-facing accounts or do not understand how prompts, uploaded documents and outputs are retained and handled.
For Windows-centric firms and public defender offices, that places Microsoft Copilot squarely in a governance conversation rather than a simple productivity rollout. The report points lawyers toward enterprise AI offerings, including Microsoft Copilot obtained through an organizational Microsoft license, as well as legal-specific products such as Harvey and Thomson Reuters’ CoCounsel.
That does not make any enterprise platform automatically suitable for criminal-defense work. Administrators still need to confirm tenant boundaries, data-use terms, identity controls, logging, retention, eDiscovery implications and which Copilot experience staff are actually using. “Copilot” can refer to materially different products, policies and data paths depending on whether it is a consumer service, Microsoft 365 deployment or another licensed offering.
That distinction matters most for legal research and court filings. An AI system can produce plausible but nonexistent cases, misstate holdings or miss crucial facts; an attorney remains responsible for every citation, assertion and strategic recommendation. The report also cautions against overreliance that erodes lawyering skills.
For an IT team supporting a legal practice, this makes the familiar security baseline only the start:
The report’s larger argument is that responsible adoption can help overburdened defenders analyze large discovery sets and compete with better-resourced prosecution teams. But its practical warning is equally clear: a productivity tool becomes a legal and security liability when deployment outruns policy.
For defense organizations, the next milestone is not choosing the flashiest model. It is determining which workflows can safely use AI, which data must never leave established legal systems, and who is accountable when the machine is wrong.
Consumer chatbots are the wrong default for case files
The report flags commercial generative-AI services—including ChatGPT, Google Gemini and Anthropic Claude—as potential confidentiality hazards when lawyers use consumer-facing accounts or do not understand how prompts, uploaded documents and outputs are retained and handled.For Windows-centric firms and public defender offices, that places Microsoft Copilot squarely in a governance conversation rather than a simple productivity rollout. The report points lawyers toward enterprise AI offerings, including Microsoft Copilot obtained through an organizational Microsoft license, as well as legal-specific products such as Harvey and Thomson Reuters’ CoCounsel.
That does not make any enterprise platform automatically suitable for criminal-defense work. Administrators still need to confirm tenant boundaries, data-use terms, identity controls, logging, retention, eDiscovery implications and which Copilot experience staff are actually using. “Copilot” can refer to materially different products, policies and data paths depending on whether it is a consumer service, Microsoft 365 deployment or another licensed offering.
Verification is a legal control, not a feature request
NACDL’s position is that legal professionals cannot delegate professional duties to a model. The proposed model AI-use policy calls for explicit rules on approved and prohibited uses, supervisory approval for higher-risk work, vendor evaluation, training, protections for privileged information, and mandatory human verification of AI-generated material.That distinction matters most for legal research and court filings. An AI system can produce plausible but nonexistent cases, misstate holdings or miss crucial facts; an attorney remains responsible for every citation, assertion and strategic recommendation. The report also cautions against overreliance that erodes lawyering skills.
For an IT team supporting a legal practice, this makes the familiar security baseline only the start:
- Approved AI services should be provisioned through managed organizational accounts rather than personal accounts.
- Sensitive client material should be classified and governed before staff can submit it to an AI workflow.
- AI output used in research, discovery summaries or drafted filings should have a review owner and an auditable approval process.
- Training should cover both prompt hygiene and the limits of model-generated legal analysis.
The policy gap is now an operational risk
NACDL says defense offices should create AI-use policies within the next year. That timeline turns AI governance into a near-term operational task for firms already rolling out Microsoft 365 Copilot, legal research copilots or transcription and document-analysis tools.The report’s larger argument is that responsible adoption can help overburdened defenders analyze large discovery sets and compete with better-resourced prosecution teams. But its practical warning is equally clear: a productivity tool becomes a legal and security liability when deployment outruns policy.
For defense organizations, the next milestone is not choosing the flashiest model. It is determining which workflows can safely use AI, which data must never leave established legal systems, and who is accountable when the machine is wrong.