Clients Now Ask "How Are You Using AI?" on RFPs — National Law Review Documents the Shift

A National Law Review analysis published August 21 documents that client AI questions have matured from "Do you use AI?" to "How are you using it, and how are you controlling it?" — with RFPs now regularly requiring firms to specify which AI models and platforms are used on matters, whether client data is retained or used for model training, what security controls exist, and how attorneys supervise AI-assisted work. The shift is operationally significant for mid-sized firms because RFP compliance now requires a governance document, not just an affirmative answer. Firms that cannot articulate their AI governance posture in writing — approved tools list, data retention policies, supervision standards, incident escalation — face a structural disadvantage in panel reviews and competitive pitches against firms that have formalized these positions. The National Law Review piece also notes that clients are asking firms to exclude or redact sensitive data from AI tools entirely in some circumstances, creating a data classification requirement that most mid-sized firms have not yet operationalized.