State bars are moving on AI. What law firms need to do now.

Six months ago, when I wrote about the AI governance question every law firm needs to answer in 2026, the argument was largely anticipatory — get a governance posture in writing now, because the bar opinions are coming. The bar opinions have now arrived. Three specific events in spring 2026, taken together, change the regulatory calculus for any law firm using AI in 2026. If your firm is using AI tools without a formal policy, the clock is no longer just ticking. It's started ringing.

I want to walk through each event, what it actually says, and what the immediate operational response should look like. Brief reading: each is more aggressive than the last, and the trajectory is clear.

Event 1 — Oregon Formal Opinion 2026-208 (February 2026)

The Oregon State Bar released Formal Opinion 2026-208, addressing the question of whether law firms can use autonomous AI agents to handle client intake. The opinion's headline answer is "yes, qualified" — but the qualifications matter, and they're the operational story.

The opinion frames the use of AI intake under Rule of Professional Conduct 5.3, which governs lawyer supervision of non-lawyer assistance. The crucial analytic move: the lawyer's duty to supervise is treated as supervision of the service provider, not supervision of the AI agent itself. The AI agent is not an "assistant" in the rule's sense; the firm is responsible for vetting the vendor, understanding the data flow, ensuring confidentiality, and confirming the agent's behavior aligns with the lawyer's professional obligations.

What this means for your firm in practice:

• Vendor due diligence is now non-optional. If you can't produce documentation of who provides your intake AI, what their data retention policy is, and how confidentiality is preserved, you do not have a defensible posture under Rule 5.3.
• Conflict screening must be designed into the system, not bolted on. Oregon's opinion specifically calls out the risk that an autonomous intake agent could create attorney-client relationships, gather privileged information, or trigger conflicts — all without a lawyer in the loop.
• Disclosure obligations attach to AI intake. The prospective client should know they're interacting with AI, particularly when the AI's behavior could create reasonable confusion about whether they're speaking to a lawyer.

Oregon is a leading-indicator state, not an outlier. The opinion explicitly cites and aligns with ABA Formal Opinion 512 and Washington State Bar Advisory Opinion 202505. The framework is going to spread.

Event 2 — California's Rule 1.1 amendments (March 13, 2026)

This is the bigger deal. The California State Bar's Committee on Professional Responsibility and Conduct (COPRAC) approved proposed amendments to six existing rules, specifically incorporating AI obligations into the disciplinary code. The 45-day comment period opened on March 13. Final adoption is expected by the end of 2026.

The shift here matters enormously. California's 2023 practical guidance on AI was a "living document" — useful, but not disciplinary. The 2026 amendments would make AI-specific obligations part of the enforceable rules. Most other states have addressed AI through opinions with persuasive but not always disciplinary force. California's approach, if finalized, becomes the most muscular AI regime in U.S. legal practice.

The headline amendment most law firms need to focus on: a new comment to Rule 1.1 (Competence) explicitly addressing AI-generated citations. The proposed language makes clear that AI-generated citations are not exempt from the lawyer's verification duty, and that the verification obligation extends specifically to fabricated, misstated, or decontextualized authority. The committee's framing is that AI sharpens existing ethical duties rather than creating new ones — but the practical effect is that AI-specific failures will now be sanctioned under existing rules with new explicit guidance.

Five other rules are touched. The committee's full proposal is on the California Bar's website. Worth the read if your firm has California licensure.

AI sharpens existing ethical duties rather than creating new ones — but the practical effect is that AI-specific failures will now be sanctioned with new explicit guidance.

Event 3 — In re Mostafavi (February 2026)

For those who still treat the bar-discipline scenario as theoretical: in February 2026, a California State Bar Court judge approved a disciplinary agreement against attorney Amir Mostafavi, whose briefs contained AI-generated fake quotations. The agreement includes a stayed one-year license suspension, required ethics school attendance, and mandated coursework specifically on the risks and benefits of AI tools in legal work.

The Mostafavi matter is not the first AI-citation discipline case (those started in 2023), but it's notable for two reasons. First, the formal sanction now includes mandatory AI-specific training — the bar is signaling that "I didn't know" is no longer a defense. Second, the discipline came alongside California's broader move toward Rule 1.1 amendments. The cases will keep arriving, and the rules being put in place are designed to catch them under specific authority.

What every law firm should do in the next 30 days

Six specific actions, in order. Most firms I've worked with have done zero of these. Each of them is achievable in less than a week of focused work, and together they get the firm from exposed to defensible.

1. Conduct an AI tool inventory — formal, written, comprehensive.

Every AI tool currently used by anyone at the firm, formally or informally. Intake bots, research tools, drafting copilots, voicemail summarizers, free LLMs that paralegals are pasting into. The inventory is the artifact you'll need first if a bar investigator asks. The five-layer governance framework tells you what columns the inventory needs.

2. Draft a written AI policy. Even a short one.

One page is fine. It needs to name the approved tools, name the prohibited behaviors (no client data into free consumer LLMs, no unverified citations in any work product), name the verification requirement, and name the person responsible for governance. The policy is what state bars will ask for first.

3. Lock down vendor due diligence on every approved tool.

Data retention policy, training-on-customer-data terms, breach notification commitments, geographic data residency. Documented. Per vendor. This is the Oregon 5.3 supervision requirement — not optional, even informally.

4. Build the citation-verification workflow into your matter file.

For any work product that touches AI, the matter file should contain an attestation that the citations were independently verified against the source. California's proposed Rule 1.1 amendments make this explicit; everywhere else, it's already implicit in existing competence rules.

5. Disclose AI use where relevant.

For client billing affected by AI (Florida's Opinion 24-1 already requires this; other states are following), for AI-handled intake (Oregon's 2026-208 implicates this), and for any court that has imposed disclosure requirements (multiple Texas courts have done so). When in doubt, disclose.

6. Set a quarterly governance review.

Put a recurring 60-minute meeting on the calendar — the partner or COO responsible for AI governance, plus whoever runs intake and IT. Quarterly. Review the tool inventory, review new tools requested by staff, review the policy against new bar opinions, and update the documentation. Without the cadence, the policy will rot inside six months.

The trajectory.

It would not surprise me to see twenty additional state bars publish formal AI-specific guidance or rule amendments between now and the end of 2027. The ABA's 2025 AI Task Force Year Two Report explicitly highlights this acceleration; the Clio Legal Trends data shows 79% of legal professionals already using AI tools while only 56% of firms have any governance policy in place. The gap closes one of two ways — either firms close it voluntarily, or bars close it for them through discipline cases.

The firms doing this work in 2026 will be unremarkable in 2027 — boringly compliant, easy to insure, easy to acquire, easy to defend. The firms not doing it will be the ones in the news for the wrong reasons. Six weeks of focused work, now, prevents an unbounded amount of risk later. The math is simple. The decision is yours.

---

If your firm's AI governance is "we mean to write a policy," that's exactly what the diagnostic finds and prioritizes. Start there →