Implementation Guide: Research case law and synthesize relevant precedents for a specific matter

Hardware Procurement

Network Switch

USB-C Docking Stations (if not using monitor hub)

Software Procurement

Prerequisites

• Stable internet connection with minimum 100 Mbps symmetrical bandwidth (250+ Mbps recommended for 10+ concurrent users); verify with speed test from ISP modem
• Active Microsoft 365 Business Premium licenses for all users (or plan to migrate from existing email/productivity platform as part of this project)
• Current firm practice management software identified (Clio Manage recommended; if using MyCase, PracticePanther, or LEAP, confirm AI research tool integration compatibility before proceeding)
• Complete inventory of all existing legal software subscriptions: research (Westlaw, Lexis, Fastcase), DMS (NetDocuments, iManage, SharePoint), accounting (QuickBooks, CosmoLex, LeanLaw), e-filing, and e-discovery tools
• Client matter data classification completed: identify which matters involve PHI (medical malpractice, PI), PII of minors, EU citizen data (GDPR), or California resident data (CCPA) — this affects vendor selection and data handling requirements
• Written authorization from firm managing partner or IT committee to proceed with AI tool deployment, including acknowledgment of ABA Formal Opinion 512 requirements for AI oversight
• All attorney and paralegal users have state bar association memberships verified (some tools like Fastcase/vLex provide free access through bar membership that can supplement the primary platform)
• Existing firewall and network equipment inventoried with model numbers and firmware versions; plan for replacement if equipment is >5 years old or lacks UTM capabilities
• Domain registrar access and DNS management credentials available (needed for email security configuration and SSO setup)
• Current cyber insurance policy reviewed to confirm coverage extends to AI tool usage and cloud-based data storage; if not, recommend policy update before deployment
• Conference room or training space identified with projector/display for attorney training sessions
• Firm's existing AI usage policy reviewed, or acknowledgment that one will be created as part of this project

Installation Steps

Step 1: Network Infrastructure Assessment and Upgrade

Conduct a thorough assessment of the firm's existing network infrastructure. Test internet bandwidth using speedtest.net or iPerf3 from multiple workstations. Verify that the ISP connection supports the minimum 100 Mbps symmetrical requirement. Inspect existing cabling (must be Cat6 or better for gigabit LAN). If the existing firewall is consumer-grade or >5 years old, plan for FortiGate 40F replacement. Document all findings in a site survey report.

iperf3 -c iperf.he.net -p 5201 -t 30
# Test from multiple workstations to verify consistent throughput
ping -n 50 eastus.azure.com
# Verify latency to Azure East US (target <50ms)
tracert login.microsoftonline.com
# Verify clean routing to Microsoft 365 endpoints

Step 2: Deploy FortiGate 40F Firewall and Network Equipment

Rack-mount or desktop-deploy the FortiGate 40F. Perform initial setup via the console port or web GUI (https://192.168.1.99). Register the unit on FortiCloud for MSP remote management. Configure WAN interface with ISP settings (static IP preferred for law firms — request from ISP if not already provisioned). Configure LAN interfaces with VLAN segmentation: VLAN 10 (Attorney/Staff - 192.168.10.0/24), VLAN 20 (Guest WiFi - 192.168.20.0/24), VLAN 30 (IoT/Printers - 192.168.30.0/24). Enable FortiGuard UTM services including web filtering (block high-risk categories), IPS, antivirus, and application control. Configure SSL inspection with a custom CA certificate pushed via Intune to managed endpoints.

# FortiGate CLI - Initial Network Configuration
config system interface
  edit wan1
    set mode static
    set ip <ISP_STATIC_IP> <SUBNET_MASK>
    set allowaccess ping https ssh
  next
  edit internal
    set vdom root
  next
end

# Create VLANs
config system interface
  edit VLAN10-Attorney
    set vdom root
    set interface internal
    set vlanid 10
    set ip 192.168.10.1 255.255.255.0
    set allowaccess ping https ssh
    set role lan
  next
  edit VLAN20-Guest
    set vdom root
    set interface internal
    set vlanid 20
    set ip 192.168.20.1 255.255.255.0
    set allowaccess ping
    set role lan
  next
  edit VLAN30-IoT
    set vdom root
    set interface internal
    set vlanid 30
    set ip 192.168.30.1 255.255.255.0
    set allowaccess ping
    set role lan
  next
end

# Configure DHCP for Attorney VLAN
config system dhcp server
  edit 1
    set interface VLAN10-Attorney
    config ip-range
      edit 1
        set start-ip 192.168.10.100
        set end-ip 192.168.10.200
      next
    end
    set dns-server1 103.247.36.36
    set dns-server2 103.247.37.37
    set default-gateway 192.168.10.1
    set netmask 255.255.255.0
  next
end

# Enable FortiGuard UTM
config utm
end
# Apply web filter, AV, IPS profiles to firewall policies via GUI for accuracy

Step 3: Deploy Ubiquiti UniFi Wireless and Switching

Install the UniFi USW-24-PoE switch in the network closet connected to the FortiGate LAN interface. Mount two UniFi U6 Pro access points in optimal locations (use UniFi Design Center for heat mapping if needed). Adopt all devices into UniFi Network Controller (hosted on UniFi Cloud or MSP-hosted controller). Configure SSIDs: 'FirmName-Secure' (WPA3-Enterprise with RADIUS via Entra ID or WPA3-Personal with strong PSK, mapped to VLAN 10), 'FirmName-Guest' (WPA2-Personal, isolated, mapped to VLAN 20, bandwidth-limited to 25 Mbps). Configure switch port profiles to assign appropriate VLANs to wired ports.

UniFi Controller — Network, SSID, and Switch Port Configuration Reference

Step 4: Microsoft 365 Business Premium Deployment and Hardening

Provision or verify Microsoft 365 Business Premium licenses for all users via the MSP's CSP partner portal (e.g., Pax8, Sherweb, AppDirect). If migrating from another email platform, plan and execute email migration (BitTitan MigrationWiz recommended). Configure Entra ID (Azure AD) with the firm's custom domain. Enable Security Defaults or, preferably, configure Conditional Access policies for granular control. Enforce MFA for all users using Microsoft Authenticator (phishing-resistant FIDO2 keys recommended for partners/senior attorneys). Configure Intune device enrollment for all firm-owned laptops. Deploy Microsoft Purview sensitivity labels for client matter classification.

# PowerShell - Connect to Microsoft Graph (run from MSP admin workstation)
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes 'User.ReadWrite.All','Policy.ReadWrite.ConditionalAccess','DeviceManagementConfiguration.ReadWrite.All'

# Verify all users have M365 Business Premium licenses
Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, @{N='Licenses';E={(Get-MgUserLicenseDetail -UserId $_.Id).SkuPartNumber -join ', '}}

Best configured via Entra Admin Center > Protection > Conditional Access > New Policy

# Enable Unified Audit Logging
Connect-ExchangeOnline
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

# create Client Matters site

# Configure SharePoint as basic DMS
# Create SharePoint site: 'Client Matters'
# Structure: Site > Document Library per Practice Area > Folder per Matter Number
Connect-SPOService -Url https://firmname-admin.sharepoint.com
New-SPOSite -Url https://firmname.sharepoint.com/sites/ClientMatters -Title 'Client Matters' -Owner admin@firmname.com -Template STS#3 -StorageQuota 1048576

Step 5: Deploy Endpoint Security Stack

Deploy SentinelOne Singularity Control agent and Huntress agent to all firm workstations and any servers. Use Intune to push the SentinelOne MSI package as a Win32 app deployment. Configure SentinelOne policies: Detect+Protect mode, enable Ranger network visibility, configure exclusions for legal software (Clio desktop agent if any, document scanners, legal-specific applications). Deploy Huntress agent alongside SentinelOne. Verify both agents are reporting to their respective MSP consoles. Remove any existing consumer-grade antivirus (Norton, McAfee, etc.) before deploying SentinelOne.

IntuneWinAppUtil.exe -c .\SentinelOne -s SentinelOneInstaller.msi -o .\Output

# Install command:
msiexec /i SentinelOneInstaller.msi SITE_TOKEN=<YOUR_SITE_TOKEN> /q /norestart

# Uninstall command:
msiexec /x SentinelOneInstaller.msi PASSPHRASE=<YOUR_PASSPHRASE> /q

# Detection rule: File exists - C:\Program Files\SentinelOne\Sentinel Agent\SentinelAgent.exe

powershell -ExecutionPolicy Bypass -File .\InstallHuntress.powershellv2.ps1 -acctkey <ACCOUNT_KEY> -orgkey <ORG_KEY>

Get-Service SentinelAgent | Select-Object Name, Status
Get-Service HuntressAgent | Select-Object Name, Status

Step 6: Configure DNS Filtering and Email Security

Configure DNSFilter at two levels: (1) at the FortiGate as the upstream DNS resolver for all DHCP-served clients, and (2) via the DNSFilter roaming agent on each endpoint for off-network protection. Create a DNSFilter policy blocking: malware, phishing, botnet C2, newly registered domains, and optionally adult/gambling content. Deploy Proofpoint Essentials for inbound/outbound email security — update MX records to point to Proofpoint, configure connection to Exchange Online, enable URL defense, attachment sandboxing, and impersonation protection (critical for wire fraud prevention in real estate closings and trust account management).

# Set DNSFilter as DNS servers in FortiGate DHCP scope:
config system dhcp server
  edit 1
    set dns-server1 103.247.36.36
    set dns-server2 103.247.37.37
  next
end

# Deploy via Intune. Download MSI from DNSFilter management console.

msiexec /i DNSFilter_Agent.msi AGENT_KEY=<YOUR_AGENT_KEY> /q /norestart

• Proofpoint Essentials - Update DNS MX records at domain registrar:
• Priority 10: mx1-us1.ppe-hosted.com
• Priority 20: mx2-us1.ppe-hosted.com
• Remove old MX records pointing to Microsoft 365 directly

Step 7: Configure Backup and Disaster Recovery

Deploy Axcient x360Recover for comprehensive backup coverage. Configure cloud-to-cloud backup for Microsoft 365 (Exchange Online mailboxes, SharePoint/OneDrive document libraries, Teams data) — this protects against accidental deletion, ransomware, and Microsoft outages. For any on-premise file servers or NAS devices, deploy an Axcient BDR appliance or use x360Recover Direct-to-Cloud. Configure backup policies: hourly backups during business hours, 90-day retention minimum (check with firm for any matter-specific retention requirements — many jurisdictions require 7+ year retention of closed matter files). Test backup restoration monthly.

# Verify backup status and perform monthly test restore

# Verify backup via Axcient portal:
# x360Recover > Organization > Protected Items > Verify last successful backup timestamp
# Perform test restore of a single mailbox item and SharePoint file monthly

Step 8: Deploy Clio Manage Practice Management Platform

If the firm is not already on Clio Manage, provision the Clio Manage Complete plan for all users. Configure the firm's practice areas, matter types, custom fields, billing rates, and trust accounting settings. Set up the matter numbering convention (e.g., YYYY-NNNN format). Import existing matters, contacts, and calendar entries from the prior PM system (Clio provides migration tools and services). Configure SSO via Microsoft Entra ID for seamless authentication. Enable Clio's API access for future integrations. Set up user roles and permissions ensuring attorneys only see matters they are assigned to (ethical wall support for conflict checks).

Step 9: Deploy Clio Work with Vincent AI - Primary Research Platform

Provision Clio Work licenses for all attorneys and paralegals who will conduct legal research. Clio Work includes Vincent AI (powered by vLex's comprehensive legal database) and Clio Library. Link Clio Work to the existing Clio Manage instance so that research is automatically associated with the correct client matter. Configure default jurisdiction settings (e.g., state-specific case law databases for the firm's primary practice jurisdictions). Set up user preferences for research output format (memo style, summary style, citation format). Create shared 'Research Collections' for common practice areas so attorneys can access prior research on similar topics.

Step 10: Deploy Clearbrief Citation Verification Add-in

Install the Clearbrief Microsoft Word add-in for all litigation attorneys and paralegals. Clearbrief operates within the existing Word environment, requiring no new application learning. Configure SSO via Microsoft Entra ID (Clearbrief supports SAML). Provision user licenses via the Clearbrief admin portal. After installation, each user authorizes the add-in within Word and can immediately begin analyzing briefs for citation accuracy — Clearbrief highlights citations, checks quoted language against source documents, and flags unsupported assertions. This is the critical verification layer required by ABA Formal Opinion 512 for any AI-assisted legal writing.

# Clearbrief Admin Configuration
# https://app.clearbrief.com/admin

Step 11: Deploy Microsoft 365 Copilot

Activate Microsoft 365 Copilot licenses for all users via the CSP partner portal. Copilot requires Microsoft 365 Business Premium as a prerequisite (already deployed in Step 4). Before enabling Copilot, review and restrict SharePoint permissions to ensure proper ethical wall enforcement — Copilot can surface content from any SharePoint site the user has access to, which could breach client confidentiality between matters. Configure Copilot sensitivity label awareness so it respects Microsoft Purview sensitivity labels. Enable Copilot in Word, Outlook, Teams, and Excel. Disable Copilot in any applications where it's not appropriate (e.g., restrict access to certain SharePoint sites containing highly sensitive matters).

Connect-MgGraph -Scopes 'User.ReadWrite.All'
$copilotSku = Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq 'Microsoft_365_Copilot' }
$usersToAssign = Get-MgUser -Filter "department eq 'Legal'" -All
foreach ($user in $usersToAssign) {
    Set-MgUserLicense -UserId $user.Id -AddLicenses @{SkuId = $copilotSku.SkuId} -RemoveLicenses @()
    Write-Host "Assigned Copilot to $($user.DisplayName)"
}

Step 12: Create and Deploy Firm AI Usage Policy

Draft a comprehensive AI Usage Policy tailored to the firm's practice areas and jurisdictions. This policy is required by ABA Formal Opinion 512 and various state bar guidelines. The policy should cover: approved AI tools (whitelist approach), prohibited uses (no client data in unapproved AI tools like ChatGPT), mandatory human review requirements, citation verification procedures, client disclosure requirements, and incident reporting procedures. Have the policy reviewed by the firm's managing partner and ethics partner. Distribute to all attorneys and staff, require signed acknowledgment, and file in the firm's policy repository.

• Deliverable: AI Usage Policy document (see Custom AI Components section for template)
• Distribution: Upload to SharePoint > Firm Policies library
• Acknowledgment: Use Microsoft Forms or DocuSign for signed acknowledgment
• Tracking: Create a SharePoint list to track which users have signed

Microsoft Forms – Create Acknowledgment Form

Step 13: Conduct Attorney and Staff Training

Deliver a structured training program over 2–4 weeks. Training should be conducted in small groups (3–5 people) organized by role and practice area.

Step 14: Post-Deployment Monitoring and Optimization Setup

Configure ongoing monitoring for all deployed systems. Set up MSP dashboard views for: Clio Work usage metrics (queries per user, research sessions per matter), SentinelOne threat detection summary, Huntress incident feed, DNSFilter block statistics, Axcient backup status, FortiGate UTM alerts, and M365 security score. Configure automated alerting for: failed backups, security incidents, license compliance issues, and system outages. Set up monthly reporting template for the firm that includes: AI tool utilization metrics, security posture summary, backup compliance, and recommendations for optimization.

Custom AI Components

Legal Research Prompt Library

Type: prompt

A curated collection of optimized prompts for Vincent AI / Clio Work research queries, organized by practice area. These prompts are designed to maximize the quality and relevance of AI-generated case law research and precedent synthesis. Each prompt includes jurisdiction parameters, temporal constraints, and specificity markers that guide the AI to return the most relevant precedents. This library should be stored in the firm's shared SharePoint and maintained as a living document.

Implementation:

# Legal Research Prompt Library for Vincent AI / Clio Work

Version 1.0 | [Firm Name] | [Date]

GENERAL LITIGATION

Prompt GL-01: Case Law Survey on a Legal Issue

Research and synthesize all significant [State] case law addressing [LEGAL ISSUE] within the last [10/15/20] years.

Jurisdiction: [State] state courts and [Federal Circuit] federal courts

Prompt GL-02: Opposing Argument Anticipation

I am representing the [plaintiff/defendant] in a [TYPE] case involving [BRIEF FACTS]. Identify the strongest case law arguments the opposing side is likely to raise regarding [SPECIFIC ISSUE]. For each potential argument:

Jurisdiction: [State] and federal courts in the [Circuit]

Prompt GL-03: Standard of Review Research

What is the applicable standard of review for [SPECIFIC LEGAL ISSUE] on appeal in [State/Federal Circuit]? Provide:

CONTRACT LAW

Prompt CL-01: Contract Interpretation Precedents

Research [State] case law on the interpretation of [SPECIFIC CONTRACT PROVISION TYPE, e.g., 'non-compete clauses', 'indemnification provisions', 'force majeure clauses']. Focus on:

Provide full Bluebook citations and brief parenthetical descriptions for each case.

EMPLOYMENT LAW

Prompt EL-01: Employment Discrimination Standards

Synthesize the current legal framework for [TYPE OF DISCRIMINATION, e.g., 'age discrimination under ADEA'] claims in the [Federal Circuit]. Include:

All citations in Bluebook format with parenthetical descriptions.

PERSONAL INJURY

Prompt PI-01: Negligence Elements Research

Provide a comprehensive analysis of the current state of [State] law on [SPECIFIC NEGLIGENCE ISSUE, e.g., 'premises liability for commercial property owners', 'medical malpractice standard of care']. Address:

Focus on [State] Supreme Court and appellate decisions. Include Bluebook citations.

FAMILY LAW

Prompt FL-01: Custody Standard Research

Research the current legal standard for [SPECIFIC CUSTODY ISSUE, e.g., 'modification of custody orders', 'relocation with a minor child'] in [State]. Include:

All citations in Bluebook format.

META-PROMPTS (For Any Practice Area)

Prompt MP-01: Verify and Expand AI Research

I previously found the case [CASE NAME, CITATION]. Please:

Prompt MP-02: Research Memo Draft

Based on my research query about [TOPIC], draft a legal research memorandum with the following structure:

Use Bluebook citation format throughout. Flag any areas where the law is unsettled or where additional research may be needed.

USAGE GUIDELINES

• Always replace bracketed [PLACEHOLDERS] with matter-specific information
• Always specify the jurisdiction — never rely on AI to guess
• Always verify citations using Clearbrief before filing any document
• Review AI output for hallucinated cases — check that every cited case actually exists
• Save completed research to the matter in Clio Manage for billing and knowledge management
• Update this library quarterly with new prompts that prove effective

AI Research Verification Checklist

Type: workflow

A mandatory verification workflow that attorneys must follow before relying on any AI-generated legal research in a client matter. This checklist implements the requirements of ABA Formal Opinion 512 and provides a documented audit trail showing that human review was conducted on all AI-assisted research. The checklist should be implemented as a Microsoft Forms checklist that attorneys complete and attach to the matter in Clio Manage.

Implementation:

Required for all AI-assisted legal research per ABA Formal Opinion 512

Implement as a Microsoft Form linked in Clio Manage matter notes

Microsoft Form Configuration:

• Form Title: 'AI Research Verification Checklist'
• Form URL: Create at forms.office.com and share firm-wide
• Responses: Store in SharePoint > ClientMatters > AI-Verification-Logs

Form Fields:

Section 1: Matter Identification

• Matter Number (Short text, required)
• Matter Name (Short text, required)
• Attorney Name (Short text, required)
• Date of Research (Date, required)
• AI Tool Used (Choice: Vincent AI/Clio Work | Westlaw CoCounsel | Lexis+ AI | Copilot | Other)

Section 2: Research Query Documentation

• Research Question/Query Submitted to AI (Long text, required) — Instruction: 'Paste the exact query you submitted to the AI tool'
• AI Output Summary (Long text, required) — Instruction: 'Briefly summarize what the AI returned'

Section 3: Citation Verification (Complete for EACH cited case)

• Number of cases cited in AI output (Number, required)

• Cases that required correction or were removed (Long text, optional) — Instruction: 'List any cases the AI cited incorrectly or that did not exist'

Section 4: Confidentiality Confirmation

Section 5: Professional Judgment

• Additional research needed (Long text, optional)

Section 6: Attestation

• Electronic Signature (Short text, required) — Instruction: 'Type your full name as electronic signature'

Power Automate Workflow:

Implementation Steps:

Clio Manage to SharePoint Research Archival Integration

Type: integration

A Power Automate workflow that automatically archives completed AI legal research sessions from Clio Work into the firm's SharePoint document management structure, tagged by matter number and practice area. This ensures all AI-generated research is preserved as part of the client file for malpractice protection, knowledge management, and regulatory compliance.

Implementation:

# Archive Clio Research to SharePoint

# Power Automate Cloud Flow: Archive Clio Research to SharePoint
# Trigger: Scheduled (daily at 11:00 PM) or Manual
# This flow uses the Clio API to retrieve recent research activity and archives it to SharePoint

Prerequisites:

Flow Definition (Power Automate):

Step 1: Get Clio Access Token

• Action: HTTP
• Method: POST
• URI: https://app.clio.com/oauth/token
• Headers: Content-Type: application/x-www-form-urlencoded
• Store: Parse JSON > access_token

grant_type=client_credentials&client_id={CLIO_CLIENT_ID}&client_secret={CLIO_CLIENT_SECRET}

Step 2: Get Recent Matters with Activity

• Action: HTTP
• Method: GET
• Headers: Authorization: Bearer {access_token}
• Store: Parse JSON > matters array

https://app.clio.com/api/v4/matters.json?fields=id,display_number,description,practice_area,status&updated_since=@{addDays(utcNow(),-1)}&status=Open

Step 3: For Each Matter with Research Activity

• Action: Apply to each (matters array)

Step 3a: Get Research Notes for Matter

• Action: HTTP
• Method: GET
• URI: https://app.clio.com/api/v4/notes.json?fields=id,subject,detail,date,type&matter_id=@{items('Apply_to_each')?['id']}&type=research&created_since=@{addDays(utcNow(),-1)}
• Headers: Authorization: Bearer {access_token}

Step 3b: Create or Get SharePoint Folder

• Action: SharePoint - Create folder (ignore if exists)
• Site: ClientMatters
• Library: AI-Research-Archive
• Folder Path: /@{items('Apply_to_each')?['practice_area']}/@{items('Apply_to_each')?['display_number']}

Step 3c: For Each Research Note

• Action: Apply to each (notes array)

Step 3d: Create Archive Document

• Action: SharePoint - Create file
• Site: ClientMatters
• Library: AI-Research-Archive
• Folder: /@{items('Apply_to_each')?['practice_area']}/@{items('Apply_to_each_2')?['display_number']}
• File Name: Research_@{formatDateTime(utcNow(),'yyyy-MM-dd')}_@{items('Apply_to_each_2')?['id']}.html
• Content: HTML formatted version of the research note with metadata header

Step 3e: Update SharePoint Metadata

• Action: SharePoint - Update file properties
• Matter Number: @{items('Apply_to_each')?['display_number']}
• Practice Area: @{items('Apply_to_each')?['practice_area']}
• Research Date: @{items('Apply_to_each_2')?['date']}
• Attorney: (extracted from note author)
• AI Tool Used: Vincent AI

Error Handling:

• Configure 'Run after' on each action to handle failures
• Send Teams notification to MSP channel on any flow failure
• Log all successful archives to a SharePoint list for audit trail

SharePoint Library Structure:

AI-Research-Archive/
├── Civil Litigation/
│   ├── 2025-0001/
│   │   ├── Research_2025-07-15_12345.html
│   │   └── Research_2025-07-18_12348.html
│   └── 2025-0003/
├── Employment Law/
│   └── 2025-0002/
└── Family Law/
    └── 2025-0004/

Notes:

• This flow requires Power Automate Premium ($15/user/month) for the HTTP connector
• Alternative: Use the Clio connector in Power Automate if available (check current connector catalog)
• The Clio API rate limit is 600 requests per hour per application — sufficient for nightly archival
• All archived documents inherit SharePoint permissions from the parent site
• Configure SharePoint retention policies to match the firm's document retention policy (typically 7+ years)

AI Usage Analytics Dashboard

Type: workflow

A Power BI dashboard that aggregates AI tool usage metrics across the firm, providing the managing partner and MSP with visibility into adoption rates, research patterns, cost-per-query efficiency, and ROI metrics. This dashboard pulls data from Clio Work API, Microsoft 365 usage reports, and Clearbrief admin reports to create a unified view of the firm's AI investment performance.

Implementation:

Dashboard Pages:

Page 1: Executive Summary

• KPIs (Card Visuals):
• Total AI Research Queries (MTD / QTD / YTD)
• Average Queries per Attorney per Week
• Estimated Hours Saved (queries × 1.5 hours avg traditional research time)
• Estimated Revenue Recovered (hours saved × avg billing rate)
• AI Tool Spend (MTD)
• ROI Ratio (revenue recovered ÷ AI tool spend)

Page 2: Adoption by Attorney

• Bar Chart: Queries per attorney (descending)
• Line Chart: Weekly query trend per attorney
• Table: Attorney | Role | Queries This Month | Queries Last Month | Trend
• Conditional Formatting: Flag attorneys with <5 queries/month as 'Low Adoption'

Page 3: Research by Practice Area

• Pie Chart: Query distribution by practice area
• Bar Chart: Most researched legal topics (extracted from query keywords)
• Table: Practice Area | Queries | Avg Time to Complete | Matters Served

Page 4: Quality and Compliance

• KPI: Verification Checklists Completed vs Research Sessions (compliance rate)
• Bar Chart: Citation corrections identified per month (from checklist data)
• Table: Matters with unverified AI research (flagged for review)

Page 5: Cost Analysis

• Stacked Bar: Monthly cost by tool (Clio Work, Clearbrief, Copilot)
• Line Chart: Cost per query trend (total spend ÷ total queries)
• Gauge: Current month spend vs budget

Data Refresh:

• Clio API: Daily refresh via Power Automate dataflow
• M365 Usage Reports: Weekly via Graph API
• Clearbrief: Monthly CSV upload (until API available)

Power BI Implementation:

DAX Measures:

Hours Saved = [Total Queries] * 1.5
Revenue Recovered = [Hours Saved] * AVERAGE(Attorneys[BillingRate])
ROI Ratio = [Revenue Recovered] / [Total AI Spend]
Adoption Rate = DISTINCTCOUNT(Queries[AttorneyID]) / COUNTROWS(Attorneys)
Compliance Rate = [Verified Research Sessions] / [Total Research Sessions]

Notes:

• Power BI Pro license required ($10/user/month) for Managing Partner and MSP users
• Alternatively, use Power BI Embedded in a SharePoint page for view-only access
• The 1.5 hours saved per query is a conservative baseline from vLex benchmarking studies
• Adjust this multiplier after 90 days based on actual attorney feedback
• This dashboard is a key deliverable for QBR meetings with the firm

Firm AI Usage Policy Template

Type: prompt

A comprehensive AI usage policy template customized for law firms, covering all requirements from ABA Formal Opinion 512 and state bar guidelines. This policy should be reviewed by the firm's attorneys for legal accuracy, then adopted as a binding firm policy. The MSP provides this as a value-added deliverable during implementation.

Implementation:

# [FIRM NAME] ARTIFICIAL INTELLIGENCE USAGE POLICY

Effective Date: [DATE] | Version 1.0

Approved by: [Managing Partner Name]

1. PURPOSE AND SCOPE

This policy governs the use of artificial intelligence (AI) tools, including generative AI, large language models, and AI-assisted legal research platforms, by all attorneys, paralegals, staff, and contractors of [FIRM NAME]. This policy implements the requirements of ABA Formal Opinion 512 (July 2024), ABA Model Rules 1.1 (Competence), 1.4 (Communication), 1.6 (Confidentiality), 5.1 and 5.3 (Supervision), and applicable [STATE] bar guidance.

2. APPROVED AI TOOLS

The following AI tools are approved for use with client matter information:

• Clio Work with Vincent AI — Legal research and precedent synthesis
• Clearbrief — Citation verification and brief analysis
• Microsoft 365 Copilot — Document drafting, email summarization, meeting notes (within M365 environment only)
• [Add any additional approved tools]

3. MANDATORY HUMAN REVIEW

3.1. All AI-generated legal research, analysis, and drafted content MUST be reviewed by a licensed attorney before:

• Inclusion in any document filed with a court or tribunal
• Delivery to a client
• Reliance upon for legal advice
• Inclusion in any legal memorandum or opinion letter

3.2. All case citations generated by AI MUST be independently verified by:

• Confirming the case exists in an authoritative database
• Reading the relevant portions of the cited case
• Verifying the AI's characterization of the holding is accurate
• Checking that the case has not been overruled or negatively treated
• Running Clearbrief analysis on any brief or motion before filing

3.3. The AI Research Verification Checklist MUST be completed for every matter where AI-assisted research is used. Completed checklists are stored in the matter file.

4. CONFIDENTIALITY REQUIREMENTS

4.1. Client names, case numbers, and identifying information should be minimized in AI queries where possible. Use matter numbers rather than client names.

4.3. All approved AI tools have been vetted by the firm to confirm:

• SOC 2 Type II certification (or equivalent)
• Contractual prohibition on using client data for AI model training
• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Data residency within the United States
• Incident notification obligations

5. CLIENT DISCLOSURE

5.1. [FIRM NAME] [will/will not] proactively disclose the use of AI tools to clients. [Choose one based on firm preference and jurisdiction requirements.]

5.2. If a client asks whether AI was used in their matter, attorneys MUST respond truthfully.

5.3. If required by a court order, local rule, or jurisdiction-specific requirement, attorneys MUST disclose AI usage as directed.

6. BILLING

6.1. Time spent using AI tools is billable to the extent it reflects the exercise of professional judgment, including formulating research queries, reviewing and verifying AI output, and synthesizing results.

6.3. AI tool subscription costs [are/are not] passed through to clients as a disbursement. [Choose based on firm billing policy.]

7. SUPERVISION

7.1. Partners and supervising attorneys are responsible for ensuring that associates and paralegals under their supervision comply with this policy (Model Rules 5.1, 5.3).

7.2. Paralegals may use approved AI tools for research but all AI-generated work product must be reviewed by a supervising attorney before use.

8. TRAINING

8.1. All attorneys and paralegals must complete the firm's AI tools training program before using AI tools on client matters.

8.2. Continuing education on AI tools and ethics will be provided [quarterly/annually].

8.3. New hires must complete AI training within their first [30] days.

9. INCIDENT REPORTING

9.1. Any suspected AI-related incident must be reported immediately to [Managing Partner / IT Contact / MSP], including:

• AI-generated citation that was discovered to be fabricated after filing
• Client data inadvertently input into an unapproved AI tool
• AI tool security breach or suspicious activity
• Ethical complaint related to AI usage

10. POLICY REVIEW

This policy will be reviewed and updated [quarterly] by [Managing Partner / Ethics Committee] in consultation with the firm's managed IT provider. Updates will be communicated to all personnel and require renewed acknowledgment.

ACKNOWLEDGMENT

I, [NAME], have read, understand, and agree to comply with the [FIRM NAME] Artificial Intelligence Usage Policy. I understand that violation of this policy may result in disciplinary action and may constitute a violation of my professional ethical obligations.

• Signature: ___________________________
• Date: ___________________________
• Bar Number: ___________________________

Testing & Validation

NETWORK

• Run iperf3 speed test from 3 different workstations to verify minimum 100 Mbps symmetrical throughput through the FortiGate.
• Verify latency to Azure East US (login.microsoftonline.com) is under 50ms.
• Confirm VLAN isolation by attempting to ping a device on VLAN 10 from a device on VLAN 20 — ping should fail.

iperf3 -c <server_ip> -t 30
ping login.microsoftonline.com

FIREWALL

• Attempt to access a known malicious test URL (e.g., EICAR test page at eicar.org) from an attorney workstation and verify FortiGuard web filtering blocks it.
• Verify SSL inspection is working by checking the certificate chain on HTTPS sites shows the FortiGate CA certificate.

DNS FILTERING

• From an attorney workstation, attempt to resolve a known malicious domain and verify DNSFilter blocks the resolution.
• Check DNSFilter dashboard to confirm the workstation appears as a managed endpoint.
• Test from a laptop off-network (on cellular) to verify the roaming agent is active.

MICROSOFT 365

• Verify all users can sign in with MFA enforced.
• Test Conditional Access by attempting to access SharePoint from an unmanaged personal device — access should be blocked or restricted per policy.
• Verify audit logging is enabled by performing a test action and checking the unified audit log within 30 minutes.

ENDPOINT SECURITY

• Verify SentinelOne agent is active on all workstations by checking the SentinelOne console agent count matches deployed endpoint count.
• Run the EICAR test file to verify SentinelOne detects and quarantines it.
• Verify Huntress agent is reporting by checking the Huntress dashboard.

EMAIL SECURITY

• Send a test phishing simulation email (via Proofpoint's built-in phishing simulator or KnowBe4) and verify it is quarantined.
• Confirm MX records point to Proofpoint by running 'nslookup -type=MX firmname.com' and verifying Proofpoint addresses.
• Test that legitimate email delivery is working by sending test messages to and from external addresses.

nslookup -type=MX firmname.com

BACKUP

• Trigger a manual backup via Axcient x360Recover and verify it completes successfully.
• Perform a test restore of a single mailbox item (email) from backup to confirm recoverability.
• Verify SharePoint site backup by restoring a test document.
• Document restore time for SLA benchmarking.

CLIO MANAGE

• Log in as each user role (partner, associate, paralegal, admin) and verify appropriate access permissions.
• Create a test matter and verify matter numbering follows the configured format.
• Test SSO by signing in via Microsoft Entra ID and confirming seamless access without separate Clio password.

CLIO WORK / VINCENT AI

• Log in as an attorney user and run the test query: 'What are the key elements of a breach of contract claim in [firm's primary state]?'
• Verify the response includes: (1) specific case citations with full Bluebook format, (2) links to full-text opinions in Clio Library, (3) jurisdiction-appropriate results.
• Time the query and document baseline response time.

CLEARBRIEF

• Open a sample brief in Microsoft Word with known citation errors (create a test document with one fabricated case citation and one real but incorrectly quoted case).
• Run Clearbrief analysis and verify it flags the fabricated citation and identifies the misquoted language.
• Verify Clearbrief SSO works via Entra ID.

MICROSOFT COPILOT

• Open Word and verify Copilot icon appears in the ribbon.
• Test by asking Copilot to draft a sample client engagement letter.
• Open Outlook and test email summarization on a thread with 5+ messages.
• In Teams, verify Copilot can generate meeting notes.

SHAREPOINT DMS

• Verify the ClientMatters site structure is correct with appropriate folders.
• Upload a test document and verify metadata columns are populated.
• Test that permissions restrict access appropriately — Attorney A should not see Attorney B's matters unless both are assigned.
• Verify the AI-Research-Archive library exists and the Power Automate archival flow runs successfully.

AI VERIFICATION CHECKLIST

• Submit a test AI Research Verification Checklist via Microsoft Forms.
• Verify the Power Automate flow triggers, creates a PDF, saves it to the correct SharePoint matter folder, and creates a note in Clio Manage attached to the test matter.

END-TO-END WORKFLOW

Simulate a complete legal research workflow. The entire workflow should complete in under 30 minutes.

PERFORMANCE BASELINE

Document baseline metrics for future comparison. These baselines will be compared at 30/60/90 day reviews.

Client Handoff

The client handoff meeting should be scheduled as a 2-hour session with the managing partner, all attorneys, and the office manager. Begin by reviewing the project scope and confirming all deliverables are complete.

Walk through each deployed system with a live demonstration:

Provide the following documentation package (printed and in a shared SharePoint folder):

Review success criteria with the managing partner:

Schedule the first monthly review meeting and the 90-day QBR. Confirm the weekly AI Office Hours schedule for the first 2 months of post-deployment support.

Maintenance

Monthly Maintenance Tasks (MSP Responsibility)

• Review AI tool usage metrics in the Power BI dashboard; prepare monthly report for managing partner showing adoption rates, queries per attorney, estimated time saved, and ROI calculations
• Verify all backup jobs completed successfully for the month; perform one test restore of a random mailbox item and SharePoint document
• Review SentinelOne and Huntress dashboards for any security incidents or anomalies; address any open alerts
• Check FortiGate firmware and FortiGuard signature updates; apply patches during maintenance window (Saturday 2-6 AM)
• Review Microsoft 365 Secure Score and address any regression; target continuous improvement
• Review DNSFilter block logs for any false positives reported by attorneys
• Verify all Clio Work and Clearbrief licenses are properly assigned and active
• Check Power Automate flows (research archival, verification checklist) for failures; remediate any failed runs

Quarterly Maintenance Tasks

• Conduct Quarterly Business Review (QBR) with managing partner: review AI ROI metrics, discuss any new AI tools or capabilities, plan any expansion, address any concerns
• Update the Legal Research Prompt Library based on attorney feedback and new prompt patterns discovered
• Review and update the AI Usage Policy to reflect any changes in ABA guidance, state bar rules, or firm practice
• Rotate WiFi PSK if using WPA3-Personal; update on all managed devices via Intune
• Review Clio Work/Vincent AI platform updates and new features; communicate changes to attorneys
• Conduct vendor risk assessment review — verify SOC 2 certifications are current for all AI vendors
• Review cyber insurance policy to ensure continued coverage of AI tool usage
• Test disaster recovery: simulate complete workstation failure and verify attorney can be productive on a replacement device within 4 hours

Annual Maintenance Tasks

• Full security audit of all deployed systems; generate compliance report for firm records
• Renew all software licenses and hardware support contracts; negotiate pricing based on usage data
• Review and refresh endpoint hardware if approaching 4-year lifecycle
• Conduct mandatory AI ethics refresher training for all attorneys (can count toward CLE credits in many jurisdictions)
• Review FortiGate hardware lifecycle — plan replacement at 5-year mark
• Comprehensive backup restore test — full matter file recovery simulation

Escalation Path

• Tier 1 (MSP Helpdesk): Password resets, basic application issues, connectivity problems — 30 min response SLA
• Tier 2 (MSP Senior Engineer): SSO/integration issues, Clio configuration changes, security incidents — 2 hour response SLA
• Tier 3 (Vendor Support): Clio Work/Vincent AI platform issues → Clio Support; Clearbrief issues → Clearbrief Support; M365/Copilot → Microsoft Support. MSP opens vendor tickets on behalf of firm
• Critical (Security Incident): SentinelOne/Huntress alert indicating active threat → MSP SOC immediate response; isolate affected endpoint; notify managing partner within 1 hour; engage incident response plan

SLA Targets

• AI tool availability: 99.9% (dependent on vendor SLAs)
• MSP helpdesk response: 30 minutes during business hours
• Critical security incident response: 15 minutes 24/7
• Backup RTO: 4 hours for full workstation recovery; 1 hour for individual file/email restore
• Backup RPO: Maximum 24 hours data loss (hourly backups during business hours reduce this to ~1 hour in practice)

Model/Platform Update Monitoring

• Subscribe to Clio, Clearbrief, and Microsoft product update blogs/newsletters
• Review major platform updates before they auto-deploy; test in pilot group if possible
• Monitor legal AI industry news for new tools, regulatory changes, or security incidents affecting legal AI platforms
• Reassess vendor landscape annually — the legal AI market is evolving rapidly and better/cheaper options may emerge

Alternatives

Westlaw Precision + CoCounsel (Thomson Reuters)

Replace Clio Work + Vincent AI with Thomson Reuters Westlaw Precision and CoCounsel as the primary AI research platform. CoCounsel is Thomson Reuters' most advanced AI offering, featuring agentic workflows that handle multi-step legal research tasks. Westlaw Precision provides the industry-leading case law database with KeyCite citation verification. Available in tiered plans from On Demand ($75/user/month) to All Access ($500/user/month), with the Westlaw Precision + CoCounsel bundle at approximately $428/user/month.

• Cost: Significantly more expensive — $428/user/month vs $199/user/month for Clio Work, resulting in ~$2,290/month additional cost for 10 users.
• Integration: Does not integrate natively with Clio Manage practice management; attorneys must context-switch between platforms. Better fit for firms already in the Thomson Reuters ecosystem or those using HighQ as their DMS.
• Capability: Arguably deeper case law database and more mature AI features than Vincent AI as of mid-2025; KeyCite is considered by many to be superior to Shepard's.
• Recommendation: Choose Westlaw + CoCounsel when the firm is already a Westlaw subscriber, has budget for premium tools, practices primarily in complex litigation requiring the deepest possible case law coverage, or is dissatisfied with Vincent AI's comprehensiveness after a trial period.

Lexis+ with Protégé AI (LexisNexis)

Replace Clio Work + Vincent AI with LexisNexis Lexis+ featuring Protégé AI as the primary research platform. Protégé uses retrieval-augmented generation grounded in the full LexisNexis case law database with Shepard's Citations integration. Unique advantage: Protégé can connect to iManage, SharePoint, NetDocuments, and other DMS platforms to query and draft from the firm's internal knowledge alongside published case law. Pricing approximately $1,458/user/month at enterprise level, with basic Lexis+ plans starting around $171/month.

Tradeoffs

Integration: Strongest DMS integration story — direct connections to iManage, NetDocuments, and SharePoint allow attorneys to search both published case law and their own firm documents simultaneously. Does not integrate natively with Clio Manage.

Capability: Shepard's Citations is the gold standard for citation treatment analysis. Protégé's ability to search internal firm documents alongside case law is a unique differentiator.

Budget-Conscious Approach: Paxton AI + Fastcase

For solo practitioners or small firms (1–3 attorneys) with tight budgets, use Paxton AI ($159/user/month) as the primary AI research tool with Fastcase (free via bar membership) as the supplemental case law database. Skip Microsoft 365 Copilot and Clearbrief to minimize costs. Use free Fastcase/vLex bar membership access for basic case retrieval and Paxton AI for AI-powered research synthesis and analysis. Maintain the full security stack (endpoint protection, backup, email security) as these are non-negotiable.

• Cost: Dramatically lower — approximately $159/user/month for AI research vs $199–$428/user/month for primary recommendations. Eliminating Copilot saves $30/user/month and Clearbrief saves $142/user/month. Total savings of approximately $212–$441/user/month.
• Capability: Paxton AI covers all 50 states with SOC 2 + HIPAA certifications, but its case law database depth may not match Westlaw/Lexis/vLex for obscure or historical cases. No integrated citation verification tool (Clearbrief) — attorneys must manually verify all citations, increasing research time. No DMS integration capabilities.
• Risk: Without Clearbrief, the citation verification burden falls entirely on the attorney, increasing the risk of AI hallucination-related errors reaching filed documents.
• Recommendation: Choose this approach for solo practitioners, new practices with limited capital, or practices focused on transactional work (where case law research is less critical than contract analysis). Not recommended for litigation-heavy practices where citation accuracy is paramount.

Enterprise Approach: Harvey AI

For large firms (20+ attorneys), consider Harvey AI as the primary AI research and drafting platform. Harvey is an enterprise-grade GPT-powered platform trusted by top Am Law firms, offering the most advanced AI capabilities in legal tech. However, it requires a minimum of 20 seats at approximately $1,200/user/month, with an annual entry point of approximately $288,000.

• Cost: Extremely expensive — $288,000+/year minimum entry point. Only viable for firms with 20+ attorneys and substantial technology budgets.
• Capability: Most advanced AI capabilities available, including complex multi-step legal reasoning, document analysis, and drafting. Backed by $300M Series D funding (February 2025) at $3B valuation, indicating strong vendor viability.
• Access: Not available to SMB firms — enterprise sales process with 20-seat minimums.
• Recommendation: Only recommend to Am Law 200 or equivalent firms with substantial budgets and a commitment to AI-first legal practice. Not appropriate for the typical MSP client in the 5–15 attorney range. MSPs serving larger firms should explore Harvey's partner program opportunities.

Self-Hosted Open Source RAG Approach

Build a custom legal research tool using open-source components: LawGlance or similar open-source legal AI framework, combined with a self-hosted RAG (Retrieval-Augmented Generation) pipeline using LangChain or LlamaIndex, an open-source LLM (Llama 3, Mistral), and a vector database (Weaviate, ChromaDB) indexed against freely available case law from CourtListener/RECAP or free Fastcase access.