A Corporate Client Will Not Engage Your Law Firm Without a Written Security Policy
It arrives with the outside counsel guidelines, or as a schedule to the engagement letter. Before the matter opens, the client’s legal department or procurement team wants a copy of your firm’s written information security policy. Some also want a policy on how your lawyers and staff use artificial intelligence tools with the client’s information.
Your law firm may run perfectly good security and have nothing written down. That is the gap the request exposes. The client is not asking whether you are careful. It is asking for the document.
It is not a regulator asking. It is a client deciding whether it is safe to hand you its information. That makes it a business problem before it is a compliance problem, and it has a date attached: the day the matter is supposed to start.
Why the client is asking
The client is regulated too, or answers to someone who is. When it hands your firm privileged material, that material leaves the client’s own controls and lands in yours. Its own auditors, insurers and regulators ask what it did to check the firms it sends information to.
A written policy is the shortest answer to that question. It is something the client can file.
Two things follow from that.
The request is a contract condition, not a rule. The client can set whatever bar it likes, and it can decline to send you work if the bar is not met.
And a policy the firm does not follow is worse than no policy. If the document says every laptop is encrypted and one is not, the client has been given a representation the firm cannot support.
What the client is really asking for
Strip away the template language and the request comes down to a few questions.
Who is responsible. A named person at the firm who owns information security. Not a vendor.
What protects the information. Access controls, multi-factor authentication, encryption on devices and in transit, how the firm handles email and file sharing with the client.
What happens when something goes wrong. An incident response plan, and who at the client is told, and how quickly.
What your people may and may not do with AI tools. Whether client information can be entered into a public AI service at all, which tools are approved, and how work product that came out of one is checked before it goes to the client. This is the newest section of these requests and the one law firms are least likely to have written.
Whether it is written down and kept current. A document with a date on it, an owner, and a review cycle. The client is asking for documentation, not intentions.
The duties sitting behind the request
The client’s request is not a standard the client invented. It is a subset of what already reaches a Texas law firm.
The Texas Disciplinary Rules of Professional Conduct state duties that bear on it directly:
- Rule 1.01, competence
- Rule 1.05, confidentiality of client information
- Rule 5.01, the responsibilities of partners and supervisory lawyers, which is how the rules reach a firm rather than only an individual
- Rule 5.03, responsibilities regarding nonlawyer assistants
Rule 5.03 matters here because a security policy names who does what, and much of it is done by nonlawyers — staff and outside IT. A lawyer who retains a nonlawyer must make reasonable efforts to ensure that person’s conduct is compatible with the lawyer’s own obligations. The policy is one of the ways a firm shows it made those efforts.
The State Bar’s Professional Ethics Committee has issued a chain of opinions on technology that runs from email, through cloud services and technological competence, to generative AI in 2025. They are interpretive rather than binding, and they are the reason the AI section of a client’s request is not a novelty. The Committee has already addressed the question.
On the AI policy specifically, Texas law now speaks as well. The Texas Responsible Artificial Intelligence Governance Act took effect on January 1, 2026, and it reaches any person who conducts business in Texas. What it prohibits for a private firm turns on intent — using an AI system to manipulate, to discriminate, or to produce unlawful content — and it is enforced by the Attorney General, with a cure period. It also lets a licensing authority sanction its own licensees. For a law firm, the licensing authority is the State Bar.
Separately, and regardless of the Bar, Texas breach notification law reaches any person who conducts business in Texas and owns or licenses computerized data containing sensitive personal information. There is no registration test and no size test in that statute.
One thing we do not do. We do not tell you whether a given policy satisfies a Disciplinary Rule, and we do not tell you what your lawyers may or may not do. That judgment belongs to your own counsel or to the State Bar, never to your IT provider. What we can do is establish what your firm actually has in place, write it down accurately, and keep the document true.
Answering it when the matter will not wait
The engagement date is fixed, and the policy is signed off by someone at your firm.
Write what is true. A policy that describes the controls you actually run is workable, even if it is thinner than the client hoped for. A policy copied from a template that describes controls you do not have is a representation to the client.
Where a control is missing, say what compensates for it, and when it closes. A documented exception with a date reads very differently from silence.
Do the AI section from your own facts. Which tools are in use at the firm today, by whom, with what information. A firm that does not know the answer cannot write the policy, and the client’s question is often the first time anyone has asked.
Gather the evidence behind each statement. The MFA setting, the encryption status of each device, the incident response plan, the training record. The policy says what is so; the evidence is how you know.
Then close the gaps properly, so the next client’s request is a retrieval exercise.
See the eleven obligations that reach Texas legal and financial firms →
How Briggs IT Services helps
We start with a Compliance Readiness Review. We gather what your firm actually has, then review it against what the client’s guidelines ask for and what Texas law and the Disciplinary Rules state as duties for your firm.
You get a written report: what the firm can put in a policy truthfully today, where the gaps are, and what closing each one takes.
From there we create the plan. If you have IT, internal or outside, we guide them through the changes and they do the hands-on work. Your IT keeps doing their job. If you have no IT, we do the hands-on work ourselves, inside a scoped remediation phase with a defined end.
Then we build the documentation — the information security policy, the AI use policy, the incident response plan — from what the firm actually runs, and we keep it current, so the next request is answered from a file rather than from memory.
Common questions
Do we have to give a client our security policy?
Not as a matter of law. It is a contract condition. The client is deciding whether to send you its information, and it can set its own bar. Declining is usually the same as declining the matter.
Can we send the client a template policy?
You can send anything you like. A policy that describes controls the firm does not run is a representation to the client that the firm cannot support, and the client is relying on it. Whether that raises a question under the Disciplinary Rules is for your counsel.
Does the AI use policy have to ban AI tools?
That is the firm’s decision, and its counsel’s. The Professional Ethics Committee has addressed generative AI in an opinion, and Texas now has an AI statute that reaches any person doing business in the state. What a workable policy has to do is say which tools may be used, with what information, and how the output is checked — and then be followed.
Our IT company says they will write the policy for us.
They can supply the facts about the systems, and they should. The policy is the firm’s, and under Rule 5.03 a lawyer who retains a nonlawyer must make reasonable efforts to ensure that person’s conduct is compatible with the lawyer’s obligations. The duty does not transfer to the vendor.
Does Texas breach notification law apply to a small firm?
The statute reaches any person who conducts business in Texas and owns or licenses computerized data containing sensitive personal information. It contains no size test. Whether a particular incident triggers notice is a question for your counsel.