How can a small law firm use AI without exposing client data?
Keep the AI workspace on a server your firm controls, and decide which model sees which documents: a local model keeps processing on the firm's machine; if a task uses an outside AI model, we tell you which one and what data it sees. We install the workspace, set up the sign-in and train your team; this entry step, AI agent setup and training, is $1,999 fixed. Search across the firm's documents, with each answer linked to its source, is scoped on top.
IG Digital Lab is a technology provider, not a law firm or compliance auditor; confirm requirements with your counsel.
What does California's new AI law say about client data?
Quoted from the primary texts and checked on 2026-11-07.
California SB 574 (Chapter 858, Statutes of 2026) adds section 6068.1 to the Business and Professions Code, effective January 1, 2027. Under subparagraph (a)(3)(A), an attorney who uses generative AI shall “Not enter confidential, personal identifying, and other nonpublic information into a generative artificial intelligence system for which access to confidential, personal identifying, or other nonpublic information the attorney inputs into the system is not restricted to the attorney and persons authorized by the attorney under obligations to protect the confidentiality of the information.” Source: SB 574, chaptered text on leginfo.legislature.ca.gov.
The State Bar of California's 2026 Practical Guidance on generative AI, which replaced the 2023 version, says a lawyer “must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent.” It adds that a lawyer should take reasonable steps to understand how a generative AI product “collects, uses, stores, and discloses information provided by the user,” and that this may include consulting qualified IT professionals or cybersecurity experts.
What the text does not say
Section 6068.1 does not mention servers, cloud services or named products. It sets a condition on who can reach what the attorney enters. Where a tool runs is one input to that condition. The vendor's terms, the accounts and the records of use are others. For ChatGPT and Claude, the vendors' own statements on training, retention and admin access are laid out plan by plan in our guide to putting client data into ChatGPT or Claude. Whether a particular setup meets the condition is a question for your counsel, not for us.
The full text, the effective date and a question list for your IT provider are on California SB 574 explained.
What do we set up for a law firm, and what does it cost?
Prices are the published ones. The entry step is a fixed price; the rest is quoted after a free audit, a written review sent by email within two business days.
| What the firm needs | What we do | Price or model |
|---|---|---|
| A place for AI that the firm controls | We install the workspace on a server or office computer the firm owns, on a machine of its own apart from the lawyers' work computers. Sign-in is a password plus a code from the phone, at an address in the firm's name. | AI agent setup and training: $1,999 fixed. Hardware or hosting is separate. |
| A decision about which model sees which data | A local model on the firm's machine for confidential material, an outside model for the rest, or outside models only. We write down each provider and what it sees. | Part of the setup scope. A setup that works fully offline is quoted separately. |
| A lawyer's review of every output | With Claude as the engine, Ask mode has the agent propose and a person approve each step, including any email. Training uses the firm's own documents and covers how to check a draft against its sources. | Part of setup and training. |
| Search and drafting over the firm's whole archive | We index the firm's files on its own server. Each answer names the document and the passage it came from. | Quoted after a free audit. Most builds run $6,000 to $15,000, set by the number of sources and the cleanup they need. |
| Separate access for each lawyer and matter | The $1,999 workspace is built for a single user, or a small group that already sees the same files. It has one sign-in and no separate accounts or per-person records inside it. Roles per person and per matter, with a record of access, are a custom build, like the five per-center roles and the full audit log in the case-management platform we built for Healing Hands Ukraine, a humanitarian nonprofit. | Quoted after a free audit, in the same $6,000 to $15,000 band. |
| Backups, patching and accounts | Monitoring, patching, backups with restores tested, multi-factor sign-in across the firm's systems, and the same-day removal of access when someone leaves. | Care $300 to $500 a month. Active $750 to $1,500 a month. One-off help $150 to $200 an hour. |
| Connection to practice software | Through the vendor's own interface, where your plan has one. | Agreed in the scope before work starts. |
The workspace is Cardloop, an open-source (MIT) platform for AI agents built by our team. You pay for our work around it: preparing the machine, installing and configuring, connecting your services, testing on your own work and training. Details are on AI agent setup and training and private AI on your documents.
Where does the firm's data go?
Your data can live on your own server; if a system uses an outside AI model, we tell you which one and what data it sees.
The workspace runs on the firm's machine
Documents and the workspace sit on the server you own. The agents work on a machine of their own, apart from the lawyers' work computers, and have full access to it. They can also reach the services you connect to it, so it holds only the files and connections you choose.
A model reads what a task needs
A local model keeps the processing on your machine. An outside model receives the text the task includes, under that provider's terms for your plan. We write down which one is used and what it sees.
A lawyer reviews and decides
A lawyer checks the draft, corrects it and decides what leaves the firm. With document search, each passage links to its source file.
Local models need a computer with enough memory and can fall short of the largest outside models on hard tasks. We test them on your own documents before you rely on them.
How many law offices are there around Sacramento?
U.S. Census Bureau, County Business Patterns 2023, offices of lawyers (NAICS 541110) with paid employees.
1,194 law offices
In Sacramento, Placer, El Dorado and Yolo counties: 869 in Sacramento County, 223 in Placer, 53 in Yolo and 49 in El Dorado.
About 390 have five or more employees
About two in three have fewer than five employees.
246 more in six nearby counties
San Joaquin, Amador, Sutter, Yuba, Nevada and Calaveras counties together.
Source: County Business Patterns 2023, county file, checked 2026-11-07. Lawyers who work alone without employees are not counted, so the real number of practices is higher.
Which law practice software can the AI connect to?
We can connect to Clio, MyCase, LawPay and NetDocuments where your edition offers a connection.
What exists depends on the vendor and your plan, so before you pay we tell you which of your tools connect and which need a file export instead. Vendor statements, checked 2026-11-07:
- Clio publishes API documentation for Clio Manage.
- MyCase offers an Open API on its Advanced tier only. MyCase support issues the credentials on request (MyCase help center).
- LawPay lists a public REST API and webhooks for payment events for developers (LawPay).
- NetDocuments connects approved AI tools through its ndConnect program and names Claude, ChatGPT and Microsoft Copilot as approved today. The firm's administrators switch it on, and the agent-driven tier is limited to ndMAX Enterprise customers (NetDocuments).
What we do not do
The free audit tells you which of these apply to your firm.
- Tell you whether a setup satisfies section 6068.1 or any other rule. That is for your counsel. We are a technology provider, not a law firm or compliance auditor.
- Act as the firm's security program or write its AI-use policy. We set up the technology the plan calls for.
- Give legal advice, or let the AI give it. Drafts are for a lawyer to review, correct and sign.
- Promise that a model never invents a citation. A source link shows where a passage came from in the firm's file. It does not check case law.
- Sign a HIPAA business associate agreement, or receive patients' medical records. If your firm works as a business associate of a hospital, clinic or health plan, this setup is not for that work. Medical records in your own clients' case files can stay in the matter files on the firm's machine: we set up and test on documents you choose without them, your staff point the AI at them after launch, and if a task sends text to an outside model, we write down which one and what it sees. What extra duties those records carry is for your counsel.
- Run cable, mount cameras or do physical installation. We configure the equipment the firm already owns.
Common questions
What partners ask before they let AI near client files.
Do we need to buy a server?
The workspace needs its own machine: a small computer in your office or a hosted server in the firm's name. We help you choose before you buy anything, and we set it up on-site around Sacramento or remotely anywhere in the US.
Does the AI send client files to an outside company?
That depends on the model you choose. A local model keeps the processing on the firm's own machine. An outside model (Claude, OpenAI Codex with the firm's ChatGPT plan, or Grok, through the firm's own accounts) receives the text a task includes, under that provider's terms for your plan. Before launch we write down which model, which provider and what data it sees.
Can the AI draft pleadings and letters?
It prepares drafts from documents the firm gives it, and a lawyer reviews, corrects and signs. Section 6068.1(a)(2) says an attorney shall not delegate the practice of law to generative AI, and (a)(3)(B) requires reasonable steps to verify accuracy, including all case and statutory citations. With document search, a source link shows which of the firm's own files a passage came from, so the check is faster. Case law is still verified in a research database.
What does it cost to start?
AI agent setup and training is $1,999, a fixed price for the scope we agree before starting. Hardware or hosting, AI plans and API usage, third-party services and custom development are separate. Search across the firm's whole archive, or separate access for each lawyer and matter, is a custom build quoted after a free audit; most builds run $6,000 to $15,000. Ongoing support is optional and quoted separately.
Which practice management software can it connect to?
Clio, MyCase, LawPay and NetDocuments each offer some way for outside software to connect. What exists depends on the vendor and your plan, so before you pay we tell you which of your tools connect and which need a file export instead.
Does hiring you mean my firm meets the law?
No. IG Digital Lab is a technology provider, not a law firm or compliance auditor. We set up the technical side: where the system runs, how people sign in, what is backed up and what each model sees. What the law requires of your firm, and whether a setup meets it, is for your counsel.
Start with the $1,999 step.
Tell us which tools your firm uses and which documents you want the AI to work from. You get a free written review by email within two business days, and a fixed quote for the setup.
Tell us what's slowing you down.
You get a free written review by email within two business days.