When a Lawyer Leaves, Their AI Account Leaves Too: The Gap in Opinion 489's Device List

What Opinion 489 already requires on the way out

Opinion 489 imposes three obligations that bear on AI accounts: departing lawyers must return or delete client confidential information unless the client is transferring with them; firms should have policies requiring deletion or return of client data on personal devices; and firm management should establish procedures protecting client confidentiality from inadvertent disclosure or misuse ^[1].

Most discussion of Opinion 489 focuses on client notification and on what firms may not do to obstruct a departing lawyer. Those are its headline holdings. The confidentiality obligations sit in the same opinion and get far less attention.

The first runs to the departing lawyer personally. The duty of confidentiality requires departing attorneys to return or delete all client confidential information in their possession, with an exception where the client is moving with them ^[1]. That duty does not depend on the firm asking. It attaches to the lawyer.

The second runs to the firm. Opinion 489 says firms should have policies requiring the deletion or return of all electronic and paper client data in a departing lawyer's possession, including on personal electronic devices, where the clients are remaining with the firm ^[1]. The same opinion notes that a departing partner may be required to allow firm data to be deleted from all devices the departing attorney keeps, unless that data is part of client files transferring with them.

The third is structural. Firm management should establish policies and procedures to protect the confidentiality of client information from inadvertent disclosure or misuse ^[1]. That is the obligation a departure checklist is meant to discharge, and it is the one a missing category quietly defeats.

Read together, the duty is not ambiguous and it is not new. What is new is where client information now lives, and a process designed around devices does not naturally look inside an account.

The device list was written before the chatbot

Opinion 489's examples of personal electronic devices are cell phones, laptop computers, tablets, home computers, jump drives, discs, cloud storage, and hard drives ^[1]. It was issued December 4, 2019. The list is expressly illustrative, and it predates the tools that now hold the most client information outside firm control.

Every item on the list is a place where a lawyer might store a file. That was the right mental model in 2019: client information lived in documents, and documents lived on devices or in storage. Recovering client data meant finding the files.

A generative AI account breaks that model in two ways. It holds client information that was never a file, in the form of prompts typed or pasted in to get an answer, and it holds output derived from that information. Neither appears in a file listing, and neither is obviously "on" the phone the firm is asking about. The account lives with the provider and follows the person, not the device.

That is why an otherwise conscientious departure process misses it. The firm asks for the laptop and the phone, confirms the jump drives, perhaps asks about personal cloud storage. Each question is answered honestly. None of them is the question that would surface two years of chat history containing client material.

The honest reading of Opinion 489 is that its principle is broad and its examples are dated. "May include, for instance" is not a closed list ^[1]. A firm that treats it as one is not complying with a narrow rule; it is failing to update a broad one.

We have not found any ethics opinion that addresses a departing lawyer's personal AI account specifically, including the more recent New York City and North Carolina opinions discussed below. The analysis here applies existing confidentiality and file duties to a situation the authorities have not directly reached.

Why an AI account is harder to recover than a laptop

A laptop can be collected, inspected, and wiped. A personal AI account cannot be reached by the firm at all. The firm does not administer it, may not know it exists, cannot see its contents, and depends entirely on the departing lawyer's memory and good faith to identify what client information is in it.

The recovery mechanics for a device are familiar. The firm takes possession, IT reviews it, the data is removed, and there is a record that it happened. Every step is something the firm can do and verify.

None of that applies to a consumer AI account the lawyer opened personally. The firm has no administrative access, no audit trail, and no way to confirm what is there. The only route to its contents is the lawyer, who may have used it casually, across many matters, over a long period.

Memory is a weak control here. A lawyer asked on their last day whether they ever put client information into a personal AI tool may genuinely not recall the extent of it. Chat histories accumulate quietly, and the individual prompts rarely feel significant at the time they are typed.

This is the same dynamic our guide to shadow AI in a small firm describes while the lawyer is still at the firm. Departure is where it becomes permanent. While the lawyer is employed, the firm can still address the account through policy and conversation. After they leave, the firm's leverage is a request, and its visibility is nothing.

The practical conclusion is that departure is the wrong place to discover an account exists. By then the only question left is whether the lawyer will cooperate, and the firm cannot verify the answer either way.

Client files follow the client, and some of the file may be in the chat

Opinion 99-414 states that "Client files and client property must be retained or transferred in accordance with the client's direction" ^[2]. If meaningful work product exists only in a departing lawyer's personal AI history, it does not travel with the client file, and the firm cannot transfer what it does not hold.

The file obligations predate AI by decades. ABA Formal Opinion 99-414, issued September 8, 1999, framed the departing lawyer's and the firm's duties around protecting "client information, files, and other client property," and held that client files and property must be retained or transferred according to the client's direction ^[2]. Rule 1.16(d) supplies the underlying duty to take reasonably practicable steps to protect a client's interests on termination.

Opinion 489 adds the transition mechanics: the firm and departing lawyer must coordinate to ensure that all electronic and paper records for client matters are organized and current, so files can transfer to the new firm or to new counsel at the existing firm depending on the client's choice ^[1].

Now consider where the analysis actually happened on a matter handled with heavy AI assistance. A drafting approach worked out in a long chat, a summary of a deposition generated and refined in conversation, a research thread that shaped the strategy. If any of that exists only in the lawyer's personal account, it is not in the client file. It does not transfer with the client, and the firm cannot produce it later.

That produces an odd asymmetry. The departing lawyer may hold part of the working record of a matter for a client who has chosen to stay with the firm, while the firm holds a file that is complete on paper and incomplete in substance. Our analysis of what happens when a vendor fails reached the same test from a different direction: if the account disappeared tomorrow, what would the firm still have.

Preservation: the departing lawyer and Rule 37(e)

Where a matter is in litigation or litigation is anticipated, prompts and outputs may be discoverable, and Federal Rule of Civil Procedure 37(e) addresses electronically stored information lost because a party failed to take reasonable steps to preserve it. A personal account the firm cannot reach is a preservation problem that surfaces at exactly the wrong time ^[3].

This site's analysis of whether AI prompts are discoverable found the question genuinely split in 2026, with decisions going both ways on work product protection. The practical consequence for departures is simpler than the doctrine: if prompts can be discoverable in some circumstances, they can also be subject to preservation obligations.

Rule 37(e) applies when electronically stored information "that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery" ^[3]. The remedies scale from measures no greater than necessary to cure prejudice, up to adverse inferences or dismissal where the court finds intent to deprive ^[3].

A departure creates two distinct risks. The lawyer may delete the account or its history, which in the ordinary course is exactly what Opinion 489's confidentiality duty points toward. Or the lawyer may keep it, leaving potentially relevant material in the hands of someone no longer subject to the firm's hold instructions.

Those two duties can pull against each other. Confidentiality favors deletion; preservation, where a hold is in place, forbids it. A firm that has not identified which matters are subject to a litigation hold before a departing lawyer's accounts are addressed can end up instructing deletion of material it was obliged to keep.

The sequence therefore matters: identify holds first, preserve what the holds require, then return or delete the rest. That sequence is impossible if the firm does not know the account exists, which is the recurring theme of every section in this article.

The conflicts exception, and what it does not cover

Opinion 489 permits a departing lawyer to retain names and contact information for clients they worked for, to check conflicts at the new firm, under Rule 1.6(b)(7) ^[1]. That exception is narrow. It covers who the clients were, not what the lawyer learned about their matters, and it does not extend to substantive prompt history.

Departing lawyers sometimes assume they may keep a working record of past matters for conflicts purposes. The permission is much narrower than that assumption.

Opinion 489 describes the exception to the return-or-delete duty as allowing a departing lawyer to retain names and contact information for clients they worked for at the firm, in order to identify conflicts at the new firm and meet other legal requirements ^[1]. It ties that to Rule 1.6(b)(7), which permits disclosure "to detect and resolve conflicts of interest arising from the lawyer's change of employment or from changes in the composition or ownership of a firm, but only if the revealed information would not compromise the attorney-client privilege or otherwise prejudice the client" ^[1].

A chat history is nothing like a conflicts list. It contains the substance of matters: facts, strategy, documents, sometimes privileged communications. None of that is needed to run a conflicts check, and all of it falls within the information the return-or-delete duty reaches.

Opinion 99-414 draws a related line for former clients: a departing lawyer who is not continuing a representation may keep copies of documents relating to it, but "must reasonably ensure that the confidential client information they contain is protected in accordance with Model Rules 1.6 and 1.9" ^[2]. A personal consumer AI account is a difficult place to make that assurance, because the lawyer does not control how the provider stores or retains it.

The useful framing for a departing lawyer is that the conflicts exception answers one question, who have I acted for, and nothing else. Anything in an AI account beyond that is subject to the ordinary duty.

What the newer opinions add, and what they still leave open

Two more recent opinions address lawyer departures. New York City Bar Formal Opinion 2023-1, issued June 30, 2023, applies Opinion 489's framework in New York ^[4]. North Carolina's 2025 Formal Ethics Opinion 1, adopted April 25, 2025, addresses notice when a lawyer leaves a firm ^[5]. Neither reaches personal AI accounts.

It would be reasonable to expect the question to have been answered by now. It has not, and the two most recent opinions on departures show why: they are focused, correctly, on the problems that generate disputes between lawyers and firms.

The New York City Bar's Formal Opinion 2023-1, issued June 30, 2023, addresses the ethical obligations of lawyers and firms around departures, including communications with clients, notice, the transition period, and transfer of files ^[4]. It adopts Opinion 489's suggestion that after a departure the firm should set automatic email responses and voicemail messages directing inquiries to an alternative contact, and it treats denying a departing lawyer access to firm systems and resources needed for a representation as a potential restraint on the client's choice of counsel ^[4].

North Carolina's 2025 Formal Ethics Opinion 1, adopted April 25, 2025, is titled Obligations Related to Notice When Lawyer Leaves a Firm, and addresses notification of affected clients and the departing lawyer's access to client contact information for that purpose ^[5]. It does not address electronic data held by the departing lawyer.

Both opinions concern the relationship between the departing lawyer, the firm, and the client's right to choose counsel. The AI account question is a confidentiality and preservation question, and it sits outside that frame. That is not a criticism of either committee; it is a reason not to wait for an opinion that addresses it before changing the checklist.

The line missing from most departure checklists

Add an explicit AI step to the departure process: ask specifically which AI tools the lawyer used, personal and firm-provided; identify litigation holds first; preserve what holds require; then obtain written confirmation that client information in personal accounts has been returned or deleted.

The fix at departure is modest, and its main value is that it forces the question to be asked. A checklist that names AI accounts produces a different conversation from one that asks only about devices.

Ask the question specifically rather than generically. "Did you store client information anywhere personal?" invites a narrow answer framed around files. "Which AI tools did you use for client work, including any on personal accounts or personal devices?" names the category and makes it harder to overlook.

Record the answer, because the firm is otherwise left with nothing but a recollection. Our guide on auditing AI use across a firm covers why a usage record matters while the lawyer is present; at departure, the record is the only evidence the firm addressed the issue at all.

1. Ask by name about AI tools, personal and firmName the category explicitly. A question framed around files and devices will be answered honestly and miss the account entirely, because the account is neither a file nor a device.
2. Check litigation holds before anything is deletedIdentify every matter the lawyer worked on that is subject to a hold or reasonably anticipated litigation. Rule 37(e) addresses information lost through a failure to take reasonable steps to preserve it ^[3].
3. Preserve what the holds requireWhere a hold applies, arrange for relevant prompts and outputs to be exported and retained by the firm before the account is closed or cleared. Confidentiality and preservation must be sequenced, not traded against each other.
4. Move working product into the client fileAnything in the account that forms part of the working record of a matter belongs in the file that follows the client, consistent with the duty that files be retained or transferred according to the client's direction ^[2].
5. Obtain written confirmation of return or deletionOpinion 489 requires departing attorneys to return or delete client confidential information in their possession unless the client is moving with them ^[1]. Written confirmation is the firm's evidence that the duty was addressed.
6. Limit what is kept to the conflicts exceptionNames and contact information for conflicts checking are permitted under Rule 1.6(b)(7) as described in Opinion 489. Substantive matter content is not ^[1].

The real fix is at onboarding, not at exit

A departure checklist can only ask. The control that actually works is ensuring client work happens in firm-administered AI accounts from the start, so that when a lawyer leaves the firm already holds the history, controls retention, and can apply holds without anyone's cooperation.

Everything difficult about a departing lawyer's AI account follows from one fact: the firm does not control it. Every recommendation in the previous section is a workaround for that fact, and workarounds depend on the departing lawyer's memory and willingness.

The durable answer is to remove the fact. If client work runs through accounts the firm administers, the history belongs to the firm, retention is set by firm policy, holds can be applied centrally, and departure becomes an access change rather than a recovery exercise. That is the same conclusion our guide to a defensible firm AI policy reaches for different reasons.

This also resolves the preservation conflict. When the firm holds the records, confidentiality and preservation stop pulling against each other, because the firm can keep what a hold requires and restrict access to everything else without asking a former employee to do either.

It will not eliminate personal use entirely, and a policy that assumes it will is not being honest about how people work. What it does is make personal use the exception that a departure checklist is designed to catch, rather than the default that it cannot see.

The departure is simply the moment the cost of an uncontrolled account becomes visible. The decision that determines that cost is made much earlier, when the firm chooses whether lawyers do client work in accounts it can reach.