A law firm's AI redaction policy should answer three questions before anyone uploads a document: is this use approved, what information may be shared, and who checks the final file?
Removing names is one useful control. It does not establish that an upload is permitted or that the remaining information cannot identify a client. A distinctive transaction, treatment history, or combination of facts can reveal the matter even after direct identifiers are removed.
Start with permission and the tool
The ABA's guidance accompanying Formal Opinion 512 identifies competence, confidentiality, communication, and reasonable fees as relevant duties when lawyers use generative AI. Applicable state rules and the circumstances of the matter still govern.
Assign someone to review the vendor's terms, retention settings, access controls, subprocessors, and permitted uses of submitted information. Record which account types and configurations the firm approves. Give staff a clear escalation path for uses outside that list.
Decide whether client consent, contractual permission, or another authorization is required before uploading. A redacted document should go through the same approval decision as any other proposed disclosure.
Define what staff should remove
Write a matter-specific checklist. Depending on the approved task, it may cover:
- Names, contact details, addresses, account numbers, and government identifiers.
- Client and counterparty identities, matter numbers, deal names, and project codes.
- Privileged communications, work product, commercial terms, or other content the approved use must exclude.
- Indirect identifiers: unusual dates, locations, job titles, or combinations of facts.
- Filenames, comments, tracked changes, attachments, and metadata.
Use consistent placeholders where relationships need to remain understandable. Keep any mapping back to real identities in a separately controlled location.
Make review a release step
Keep the original in the approved matter system. Work on a separate copy and apply actual redactions; drawing a rectangle over text is insufficient.
Compare the proposed redactions against the approved scope, confirm necessary context remains, and inspect the exported file. Search for known identifiers and try selecting and copying text around redactions. Scanned pages and handwriting need visual inspection because text search can miss them.
The free Redacto redaction checker can spot certain PDF redaction problems locally in the browser. Its results are a technical check, not a guarantee of anonymity or permission to disclose. Use the QA checklist for the broader review.
What to put in the policy
- Owner and scope: who maintains it, which teams it covers, and when it is reviewed.
- Approved uses and tools: permitted tasks, account settings, and prohibited inputs.
- Authorization: who resolves consent, confidentiality, and contractual questions.
- Preparation and review: what gets removed, who reviews it, and how exports are checked.
- Retention and incidents: where copies are stored, when they are deleted, and how staff report a mistaken upload.
- Evidence: the policy version, reviewer, and approval record, without unnecessarily duplicating sensitive content.
Test with synthetic documents before using client material. Track missed identifiers, unnecessary redactions, review time, and staff adherence. Update the policy when the tool or the firm's use changes.
For repeated work, try Redacto with an approved sample and measure the review effort. This is general operational information, not advice on the firm's professional obligations.