An associate wants to summarize an invention disclosure. A patent agent needs help drafting claims. A litigation team wants a first-pass claim chart. Each request involves different information, permissions, and review obligations.

Your law firm AI policy needs to make those distinctions usable at the matter level. A patent-specific policy gives practitioners a clear approval path, protects sensitive invention material, and defines the review required before AI-assisted work reaches a client or patent office.

Scope: This is a drafting framework for U.S. patent practices, including work before the United States Patent and Trademark Office (USPTO). Firm counsel must adapt it to applicable state rules, court orders, client agreements, and cross-border obligations before adoption. It is not a matter-specific legal opinion.

What a law firm AI policy should control

A law firm AI policy sets the conditions under which attorneys, patent agents, staff, and contractors may use AI for firm work. It should answer 4 questions for every proposed use:

1. Is this environment approved for the information involved?
2. Does this client's instruction permit the task?
3. Who reviews the resulting work product?
4. What record proves that approval and review occurred?

In Formal Opinion 512, the American Bar Association (ABA) addresses competence, confidentiality, communication, supervision, candor, and fees when lawyers use generative AI. It interprets the ABA Model Rules; it is not a uniform rule binding every U.S. practice.

Approval belongs to a specific environment and task. A firm's permission to summarize published patents does not authorize uploading an unpublished invention disclosure to the same service.

Patlytics supports connected patent workflows, including Patent Drafting and Claim Charting. Its source-to-draft workflow uses invention materials to assist with claims and specification drafts. Claim Charting assists with charts mapping claim elements to prior art or product evidence for practitioner review. Your policy should assign permissions and reviewer responsibilities to each workflow. The platform assists practitioners; attorneys retain substantive review and decision authority.

Classify the whole request, including the search query

Use the data-tier framework in the client confidentiality guide as a starting point. The schedule below turns those tiers into recommended firm approval conditions. These are internal policy choices, not legal classifications or guarantees of privilege.

A public document can be part of a sensitive request. A query combining published patent numbers with an unreleased product specification reveals more than the patents alone. Even a selected list of public references may reveal a client's litigation strategy.

Make classification cover the prompt, attachments, connected repositories, and resulting output. Under the proposed policy, mixed requests inherit the highest applicable tier. Removing an inventor's name does not downgrade a disclosure if its technical content still reveals the invention. Outputs remain at that tier until an authorized reviewer approves a change.

For Tier 3 material, document processing locations and access by provider personnel, alongside retention and downstream processing. The USPTO's AI guidance identifies potential export-control and foreign-filing issues with overseas servers and certain access by non-U.S. persons. A U.S. hosting location alone does not settle that assessment.

Patlytics provides System and Organization Controls (SOC) 2 Type II attestation and certification under ISO 42001, the International Organization for Standardization's AI-management-system standard. Patlytics does not use customer data to tune or train its models without explicit consent or necessity. These security commitments inform vendor assessment; the Tier 3 hold remains until your firm approves the exact use and data path.

Pair permitted tasks with a concrete review standard

“Attorney review required” is incomplete unless your policy defines what the reviewer examines. A task schedule should distinguish source accuracy from the legal inference drawn from that source.

Prior-art searching identifies potentially relevant disclosures. Patentability evaluates proposed claims; invalidity evaluates existing claims. Infringement analysis maps claims to accused activity. FTO assesses potential exposure for a defined commercial activity. Keep these purposes separate in task approvals and work-product labels.

For an invalidity chart, a correct quotation does not establish that a reference discloses every claim limitation. The reviewer also assesses the mapping and the applicable anticipation or obviousness theory. Likewise, a draft claim's fluent wording does not establish support in the specification. The USPTO's written-description guidance explains the requirement that the disclosure convey possession of the claimed invention.

A reusable law firm AI policy template

The editable policy template contains these clauses, the data-tier and task schedules, and fillable approval, matter, review, and incident records. Bracketed fields identify firm-specific decisions. No provider is preapproved by the template.

1. Purpose, scope, and ownership

Suggested clause: This policy governs AI use for [Firm] work by partners, attorneys, patent agents, staff, contractors, and other personnel acting on the firm's behalf. It covers direct AI access and AI capabilities embedded in existing services, connectors, and browser extensions.

[Policy owner] maintains the policy and approval register. [Risk counsel] owns professional-responsibility interpretation. [Security lead] owns technical assessments. The responsible attorney retains authority over substantive legal work and its release. Firm approval does not override law, court orders, or client restrictions.

2. Approved environments and prohibited uses

Suggested clause: Personnel may use AI for firm work only within the accounts, configurations, tasks, and data tiers listed in [Approved-environment register]. Personal AI accounts and unapproved extensions or connectors are prohibited for firm work.

Each approval identifies the service, account type, permitted inputs, access controls, retention and deletion terms, model-training treatment, processing locations, downstream providers, and accountable owner. A new connector or a material change in these conditions requires reassessment before affected work continues.

Personnel must not use AI to fabricate evidence, experimental results, source quotations, or authorities, or issue unreviewed legal advice. Filing and external transmission require authorized human approval. Unapproved systems may not access firm repositories or matter files.

For USPTO submissions, human approval is separate from signing and authenticated account access. The required signer personally supplies their own signature under 37 CFR 1.4, part of the Code of Federal Regulations (CFR). An authorized human filer may submit a document properly signed by another person.

When a USPTO.gov account is required or used, an authorized natural person uses their own permitted credentials without sharing them. AI or automation may not obtain an account or be sponsored as support staff, as specified in the USPTO's September 2025 Patent Electronic System Legal Framework.

AI may assist preparation. Human-operated computer assistance remains permitted when it complies with USPTO rules. AI cannot act as signer or authenticated account user. The human presenter retains the applicable responsibilities under 37 CFR 11.18, including reasonable inquiry into the paper's legal and factual basis.

3. Client instructions and matter authorization

Suggested clause: Before AI-assisted matter work begins, [Matter partner] records applicable engagement terms, outside-counsel instructions, protective orders, and disclosure or consent requirements in [Matter AI record]. The record states the permitted tasks, environments, data tiers, and reviewer.

If an instruction is unclear, affected AI use stops pending resolution by the matter partner and risk counsel. Any client approval required or obtained is documented with its scope and conditions. Firm personnel may not waive a client's restriction internally.

Disclosure and consent are separate questions. The ABA's informed-consent guidance explains that their necessity depends on the circumstances. Where informed consent is required, generic engagement-letter language is insufficient. Your matter record should capture the actual use, information involved, benefits, risks, and client's decision.

4. Sensitive invention information and data handling

Suggested clause: Personnel classify the entire request under [Data-tier schedule] before processing. Mixed requests and outputs retain the highest applicable tier unless an authorized reviewer approves reclassification. Only the minimum necessary information may be supplied.

Tier 2 and Tier 3 processing requires the approvals specified in that schedule. Trade-secret, unpublished, export-restricted, and protective-order materials require assessment of the specific data path and access restrictions. Removing names alone is insufficient to reclassify technical material.

Prompts, attachments, outputs, and review records remain within approved matter locations. Sharing links, downloads, and exports follow the same restrictions as the underlying material. Matter access controls and ethical walls apply to connected repositories and cross-matter retrieval.

5. Permitted tasks, citations, and claim review

Suggested clause: AI may assist only with tasks listed in [Task-and-review schedule] and authorized for the matter. Every substantive output used in legal work requires review by a qualified practitioner under the responsible attorney's supervision. Attorneys retain legal judgment and final approval authority.

The reviewer confirms source identity, quotations, locators, dates where relevant, claim text, and the reasoning supporting each material assertion. Drafts are reconciled with the controlling application, claims, office action, or evidence set. Unsupported citations and technical additions are corrected, removed, or escalated before reliance.

For claims and specification drafts, review includes disclosure support, dependencies, technical accuracy, and inventor confirmation of newly proposed technical content. AI-generated experiments must never be represented as experiments actually performed. An unresolved issue prevents release of the affected work product.

6. Records, retention, and billing

Suggested clause: [Matter AI record] identifies the task, environment, available version/configuration information, input classification, approval, reviewer, material corrections, and final work-product location. Required source evidence is retained in approved matter storage.

[Records owner] assigns retention periods for prompts, outputs, and review records consistent with client terms, firm policy, and preservation obligations. Personnel must not delete records subject to a hold or incident-preservation instruction. This policy does not promise a universal retention period or privilege protection.

Hourly entries reflect time actually spent performing and reviewing the work. Fixed-fee arrangements and AI-related expenses follow engagement terms and applicable fee rules. Formal Opinion 512 distinguishes hourly time actually worked from historical time a task would have taken without AI.

7. Incident reporting and containment

Suggested clause: Personnel immediately report suspected unauthorized uploads, cross-matter disclosures, unexpected access, and material output errors to [Incident contact] and [Matter partner]. They stop affected processing and prevent further distribution without destroying potentially relevant records.

[Incident lead] coordinates containment, evidence preservation, and assessment with risk counsel and security. The assessment identifies affected information, recipients or systems, client restrictions, and any work product already sent or filed. Risk counsel determines notification, correction, and other required responses. Restart requires documented authorization.

8. Training, exceptions, and review

Suggested clause: Personnel complete role-specific training before access to approved AI environments. Training covers data classification, client instructions, citation and claim review, permitted tasks, and incident reporting. Refresher training follows material policy or environment changes.

[Policy owner] reviews the policy every [Review interval] and after a material incident, regulatory change, or change in provider terms or processing. Exceptions require written approval from [Risk counsel], [Security lead], and [Matter partner] as applicable, with a defined scope and expiry. No exception overrides a legal prohibition or client restriction. Personnel acknowledge the current policy.

Turn the policy into a matter-level decision

A signed policy needs 3 operating records: an approved-environment register, a matter AI record, and a review record. Keep them accessible to the practice team without broadly exposing sensitive matter information.

Consider a proposed FTO project for an unreleased medical device. The patent references are public, but the product specification is nonpublic. The complete request belongs in Tier 3 under the proposed schedule. The matter partner establishes the client's permission and scope; risk and security approve the processing path; counsel defines the jurisdiction, product version, and date for review. The team cannot treat the project as Tier 0 because most attachments are published patents.

For a patent draft, the review record should connect the final claims to the approved source disclosure and identify how unsupported additions were resolved. For a claim chart, it should preserve the claim version, cited evidence, reviewer, and unresolved gaps. “Reviewed” without those details leaves the next practitioner with little to inspect.

The patent-AI evaluation guide provides the broader selection criteria. Your approval register records the firm's resulting decision for a particular environment, data category, and workflow.

Apply the policy to a patent-specific workflow

Start with a defined task and work product: a reviewed application draft or an evidence-backed claim chart. Give the responsible attorney a clear input boundary, review standard, and release decision. Keep vendor approval separate from client permission and substantive legal approval.

See how Patlytics can fit within your firm's approved AI environment, with attorney review before drafting and charting outputs are released. Book a demo focused on your practice's permitted inputs and review requirements.