Evaluate a task, identify the risks, and preserve human judgment.
Many legal AI products combine retrieval and generation: the product retrieves authority or documents, then an AI model generates a response. That source boundary matters, but generated prose remains fallible. The practical questions are what the system received, what it may invent or omit, and how a human will verify the result.
Start Here
You cannot calibrate a tool you have never used. The way to find out what these tools can and cannot do is to use them on things that do not matter — on a device that is yours, on material that is personal — until you have a feel for where they are strong and where they give way. That takes a few hours, not a semester.
Search retrieves stored material. An AI model generates a response from learned patterns. Many legal products combine the two: the product retrieves authority, then an AI model generates an answer from it. A bounded source lowers risk, but generated prose still requires verification. The useful question is not whether the tool is generally safe. It is whether this task is authorized, source-grounded, checkable, and free of delegated judgment.
Where the tools stand
The question is no longer whether these tools can do legal work. They can. The published record, in order:
Read this as a direction, not a measurement. Each entry is a different study of a different model in a different setting, so the entries cannot be compared point for point. Full notes are under Sources.
Penn Carey Law · Spring 2026 finals
graded exams at or above the class median
graded exams in the top tenth of the class
exams where it outscored every enrolled student
Wagner, Can AI Ace Your Exam? (draft, June 2026). Eleven Penn Carey Law finals from Spring 2026 were answered by one model, Claude Opus 4.7, and graded on the class curve by the faculty who wrote them. Two exams were not graded blind; one of those, graded by the author, is one of the two where the AI outscored every student. Ten of the eleven were returned with grades, so every figure above is out of ten. This is a draft paper, on one model, at one school. Read about the study.
These results show what the tools can do. They do not change whose work it is. More capability, and more plausibility, does not make generated text authoritative. That is the human’s job.
The two objections
Two objections come up more than any others. Both are reasonable. Neither is a reason to stay away entirely, and both point to real limits worth keeping.
The instinct behind this is sound, so start by naming what it is protecting. The judicial function is judgment: deciding what the case is about, weighing the arguments, and taking responsibility for the result. Hand that to a machine and you have given away the thing you were appointed to do.
But that is not what is at stake in most of these tasks. Judges already work with law clerks. A clerk reads the record, drafts, and proposes. The judge reads, revises, disagrees, and signs. Nobody thinks the clerk decided the case. The line is between delegating labor and delegating judgment, and it does not move because the drafter is software.
Where the instinct earns its keep is on the other side of that line. If you cannot say how a document was produced, cannot check it, and would not have written it yourself, then something has gone wrong, and it would have gone wrong with a human ghostwriter too. Keep the objection. Aim it at the right target.
You should be. Lawyers have been sanctioned in federal court for filing briefs containing citations to cases that do not exist. The fear of a fabricated citation appearing under your name in a published opinion is not squeamishness. It is an accurate read of the risk.
The useful thing about that risk is how specific it is. It is the risk of publishing something you did not verify. It has a matching cure: do not publish anything you did not verify. That is not an AI rule. It is the rule you already follow.
And the way to build the instincts that make verification quick rather than laborious is to practice where being wrong costs nothing. Which is the whole point of starting on personal material.
Where to practice
Do your learning on your own device, your own account, and non-professional material. This is partly a confidence-building measure and partly a practical necessity: the Administrative Office has interim guidance in effect, and the list of AI tools authorized for court work is limited today. Chambers experimentation is not a live option for most judges right now. Personal experimentation is.
Start where error is cheap and no protected data is at risk.
What to actually do:
It is not for becoming an expert, and it is not a commitment to anything. It is for developing a working sense of when the tool is reliable, which is a judgment you can only get from use. A judge who has spent five hours on personal material has better intuitions about AI risk than one who has read every article about it.
Plenty of judges will finish this exercise and conclude the tools have no place in their chambers. That is a legitimate result, and an informed one. It is a different thing from never having looked.
The distinction that matters
This is the shortest possible explanation of these tools, and the only technical section on this site. There is no math in it. Everything practical on the other tabs comes out of it.
You type a query. Westlaw searches an index of documents that exist, ranks them, and hands them back. That is retrieval. If it returns a case, the case is real, because the system had to find it somewhere in order to return it. Provenance comes free.
Retrieval has a characteristic failure: it misses things. The case you needed was worded differently and never surfaced. That failure is familiar, and every judge and clerk has developed habits for managing it. You search again, from a different angle.
Nothing gets looked up. The model was trained on an enormous quantity of text, and from that training it learned, in effect, what words tend to follow what other words in what contexts. When you give it a prompt, it produces an answer one piece at a time, each piece being the most plausible continuation of everything so far. That is processing, and it is not a lookup with extra steps. It is a different operation.
Nothing in that process consults a library. The output is not the result of a search. It is a construction, assembled to be plausible.
Now the important part. A fabricated citation is not a malfunction. It is the system working exactly as designed. Asked for authority, the model produces text that has the shape of authority: a plausible case name, a plausible reporter, a plausible year, a plausible pin cite. Producing that shape is the job. Whether the case exists is not a question the architecture ever asks, because the architecture has no mechanism for asking it.
This is why the industry term, hallucination, is misleading. It implies a lapse from an otherwise sound faculty, as though the model normally knows and occasionally slips. There is no faculty to lapse from. The model is doing the same thing when it is right and when it is wrong. You just happen to like one result better.
Which means: the question is not when this gets fixed. Models get better, and error rates fall. But making the text more plausible is what improvement means here, and more plausible fabrications are harder to catch, not easier. The kind of tool it is does not change.
Same architecture, same consequence. The model produces what is probable given the text it was trained on, and that text is the accumulated written output of a society with all of its assumptions in it. Probable is not the same as fair, or accurate, or representative. Patterns that nobody would defend if they were stated out loud are still patterns, and the model reproduces them because reproducing patterns is what it does.
Vendors work hard to suppress the obvious cases, and they largely succeed at the obvious cases. The subtle ones are the ones that matter to a court, and they are not detectable by looking at any single output. This is a structural feature, not a settings problem.
Bias can also enter at more than one stage. It can come in through the training text: what was included, what was missing, and what was repeated. It can come in through the model choices: training, tuning, and safeguards. And it can come in through the tool context: the prompt, the retrieval step, and the defaults. The output is shaped by every prior stage.
Westlaw and Lexis have built AI layers that put a retrieval step in front of the model: find the real documents first, then have the model summarize and synthesize them. That genuinely helps, and it is a meaningfully better risk profile than a general chatbot answering a legal question from memory.
It is not a cure. The retrieval step can miss, and the model still writes the summary, which means it can still mischaracterize what it found, and still smooth two cases into one proposition that neither supports. Grounding narrows the failure mode. It does not eliminate the need to read the case.
It helps to think of three levels of grounding, each with its own check. Working from model memory, no source is visible, and the question is whether there is any evidence to confirm. With retrieved sources, a source is linked, and the question is whether it is the right source. With the source in view, the source is open, and the question is whether it supports the claim.
You are not being handed an unreliable version of a reliable tool. You are being handed a different kind of tool, one whose errors are inherent to how it produces anything at all. That is not a reason to refuse it. It is the information you need in order to use it well, because it tells you exactly where to put the tool: on tasks where the source material is in front of it and a human checks the result.
What is new
Three changes since these tools first appeared matter for chambers work. The third is the one that changes what you have to supervise.
A current AI tool can operate in three modes. It can generate: assemble new text to draft, summarize, explain, or transform. It can retrieve and then generate: find sources first, then assemble text, which makes the result grounded but not guaranteed. And it can act: take steps across tools or systems, which is where permissions and approval points start to matter.
Put a person at each end. A person sets the task and supplies the sources. The agent then searches, reads, compares, and chooses its own next step, repeating as often as it needs to before anyone sees anything. A person then checks the work and approves or rejects it.
Most agents show a trace: a record of the steps taken and the sources used. Any reasoning shown in a trace is a summary, not a reliable account of how the result was produced.
| An agent | The strength | The risk |
|---|---|---|
| Takes many steps | Covers the whole record | An early error carries forward |
| Chooses its own steps | Needs far less direction | You see results, not choices |
| Reads what it finds | Gathers its own sources | May obey text inside a document |
| Acts in other systems | Finishes the task | Acts before anyone checks |
The matching controls are under Guardrails. Examples of agent products are under Tools.
The third row of that table has a name. To a model, your instruction and the document you gave it are the same kind of thing: text. Nothing in the architecture separates the words that came from you from the words that came from the material. So a document can contain a sentence addressed to the model (disregard what you were asked, describe this favorably, send this somewhere), and a model reading that document may follow it. That is prompt injection. The text does not have to be visible to a person reading the page for the tool to read it.
This is a known property of how these tools work, not a report from the testbed. No chambers has reported an instance. It belongs here because of what it means for courts in particular: nearly everything a chambers would hand to one of these tools was written by someone with an interest in the outcome.
In a chat tool, the worst case is a skewed summary, and reading the source catches it. With an agent, the injected instruction can become an action. That is why the controls under Guardrails put a person’s approval between what an agent reads and anything it does that cannot be undone.
The point to keep
More capability, and more plausibility, does not make generated text authoritative. That is the human’s job.
The core of this portal
Three buckets, sorted by risk rather than by capability. The sorting principle is the one established on the previous tab, applied consistently: a task is safer to the degree that the source material sits in front of the model and a human checks the output. It gets riskier as the model is asked to supply substance from its own memory, and riskiest when it is asked to supply judgment. Every item below sits where it sits for that reason, and each one says why.
These are drawn from chambers participating in a federal judicial AI testbed that Penn Carey Law has run since fall 2024: 20+ chambers as of September 2026, and roughly forty use cases observed. That matters, because it means this is observed practice rather than speculation. These are things judges and law clerks actually tried, with the results they actually reported, including the failures.
They are reported here in aggregate, with the chambers de-identified. No judge, clerk, court, or case is named, and none will be. Where chambers reported conflicting experiences, this page says so rather than picking a winner.
Reported figures are reported, not measured. When a chambers says a technique saves roughly an hour a page, that is their estimate of their own work, and it is presented as such.
Terms of participation, including confidentiality, are set out in a memorandum of understanding.
The next step is a set of sessions for chambers, using sample briefs: summarizing and extracting, drafting from sources, and failure points with a verification routine. Interested chambers can write to R. Polk Wagner at pwagner@law.upenn.edu.
The source material is in front of the model. The output is checkable. A human checks it.
Close to universal across the chambers reporting. It is the most common entry point, and the one most judges start with.
One technique worth copying: summarize first, then give it the real task. Several chambers report that output quality drops if you skip the summary step and go straight to the work.
Feed it both parties' briefs and ask what is actually contested, where they agree, and which authorities are carrying the weight. One chambers fed in both briefs and asked for ten questions, and reports getting about three good ones every time.
Why it works: the briefs are the universe. The model is reading, not remembering. Three usable questions out of ten is a fine return when the ten cost you nothing.
From the docket, with a prior opinion supplied as a template. Consistently the highest-reliability drafting task reported anywhere in the record.
Why it works: everything needed is in the documents, the form is fixed, and errors are conspicuous rather than subtle.
From the parties' statements of material facts, with paragraph cites.
The caveat several chambers hit: the fact cites come back over-inclusive. The model reaches for more support than the proposition needs. Budget time to prune, and read what you keep.
"Give me every sentence in these briefs citing ECF #14." This works, and works well.
State the boundary out loud, because it is the whole lesson of this site: finding cites in the record you supplied works. Finding cases in the world does not. Same verb, entirely different operation, opposite risk profiles. One is reading. The other is remembering.
Reported as "very successful." Built from the briefs, aimed at the weak points.
Typos, affect versus effect, and checking the arithmetic in settlement figures. Unglamorous and reliable.
This portal’s advice, not part of the report: recompute any figure you will rely on. A model that says the numbers add up has produced a sentence, not a calculation.
Case parentheticals, plain-English conversion, voir dire questions, remarks to the jury. One chambers rewrites material for self-represented parties at a fifth-grade reading level.
Why it works: you supply the substance and the model supplies the prose. Nothing is being retrieved from memory. Read the rewrite against the original to confirm the legal effect survived.
One chambers uploads prior speeches and tunes the draft for a new audience, and uses AI for nothing else at all. That is a coherent, defensible position.
Holiday-aware, built once and reused. It generates dates, not prose, which is exactly the kind of narrow, checkable output that suits these tools.
This portal’s advice, not part of the report: checkable is the operative word. Count the dates against a calendar before the order issues. What a custom assistant is, in plain terms, is under Tools.
Built from a stack of prior scripts. What a custom assistant is, in plain terms, is under Tools.
The generalization is the useful part: anything with a repetitive script is a good candidate. If your chambers produces the same document with the same bones twenty times a year, that is where to start.
One chambers reports roughly 95% accuracy and real time saved on complicated charts. Reported as good at tables in Word and bad at Excel.
Note what 95% means: reliable enough to save you the assembly, not reliable enough to go out unread. Roughly one cell in twenty is wrong, and the model will not tell you which.
One office's trick: transcribe first, then work from the transcription rather than the original scan.
Competing proposed jury instructions, for instance: where do they agree, and where exactly do they diverge. Both documents are in front of the model, and the answer is checkable line by line.
Ask for many options, then prune. One chambers reports surfacing analogies they had not considered.
Why this is lower risk despite drawing on the model's memory: you are asking for candidates, not authority. Nothing it offers goes anywhere until you have checked it yourself. The model is generating leads, and you are the one deciding whether any of them is real.
The model supplies more, so a human must supply the check. Real value, real failure modes. Use these only if you know what the failure mode is and have a way to catch it.
This is the central finding in the record, and it deserves the space. Done in a closed-universe project, section by section, working from an outline the clerk has already written, opinion drafting works. One chambers reports saving roughly an hour per page. Multiple chambers arrived at the section-by-section approach independently, which is the strongest signal in the entire catalogue.
The working formula reported: "Based on [SOURCE] regarding [TOPIC], draft [LENGTH] concluding [OUTCOME] for use in an opinion." Note how much of that prompt is the human's work. The source, the topic, the length, and above all the outcome are all supplied by the clerk.
The safeguard is the ordering, and it is not optional. The clerk does the reasoning first. The model does the prose second. The human decides what the section concludes and why; the model puts it into sentences. Reverse that order and you are no longer in this bucket. You are asking the model to reason, which is the next bucket down, and it fails there. See "end-to-end opinion drafting" below.
Fast enough to read before the clerks arrive, but reported as less nuanced than the real thing.
Use it as: an orientation, not a work product. It tells you what the case is roughly about so you can ask better questions. It does not replace the memo.
Genuinely mixed, and reported as such. One chambers trained it successfully on prior opinions. Another got output that "sounded snarky."
The honest read: this sometimes works and sometimes embarrasses you, and nobody has reported a reliable way to tell in advance which one you are getting. Nobody should promise you this.
The extended research modes are meaningfully better than a plain query for a first pass at legal research.
And they still return real cases with fabricated quotes. Better is not fixed. Verify on Westlaw or Lexis. Every time. There is no exception to this and no version of the tool that has earned one.
If your circuit has a multi-factor test you apply constantly, one chambers built an assistant loaded with ten cases applying it, deliberately chosen to cut in both directions.
Two rules they stress. First, load the cases going both ways: a lopsided library produces a lopsided analysis, and it will read as authoritative either way. Second, instruct the model not to draw on outside knowledge, which is what keeps it inside the closed universe you built. The cost of even-handed loading is that the analysis sometimes comes back wishy-washy. That is the correct trade, and a wishy-washy answer is a far better failure than a confident wrong one.
What a custom assistant is, and why its attached files are not always read whole, is under Tools.
The chambers disagree, and this page is not going to resolve it for you. One chambers reports that it fails and that they do citation formatting by hand. Two others report success.
What to take from that: test it on your own material before you rely on it, and do not assume another chambers' result transfers to yours. A disagreement in the record is information. Papering over it would not be.
Uneven across tools. One office got nowhere with one product and succeeded with another. A second office made it work by transcribing first and then working from the transcription.
Practical upshot: if this fails, the tool may be the problem rather than the task. It is worth trying a second one before concluding it cannot be done.
Good at catching typos in cover letters and at reading the tone of recommendation letters. But it hallucinated candidates and invented the law schools they attended.
The line: polish only, never screening. A tool that invents an applicant cannot be trusted to evaluate one, and the failure here lands on a real person who applied to your chambers.
The model is asked to supply substance or judgment out of its own memory. This is where the architecture fails, and the record shows it failing.
This is the most consistent failure in the entire record. Seminal cases come back correct roughly half the time. The rest are hallucinations.
But the raw failure rate is not the danger. The recurring pattern, reported by three chambers, is real cases with invented quotes. That is far more dangerous than an obviously fake case, because the case checks out. You look it up, it exists, it is roughly on topic, and the quotation you were handed appears nowhere in it. Every verification habit you have is built to catch the fake case. None of them is built to catch this.
One chambers now explicitly instructs the model not to give cases or statutes at all. On the current evidence that is a reasonable setting, not an excessive one.
Why it fails: exactly as the previous tab predicts. No source in front of it, so it generates what a citation to a case like that would plausibly look like. That is the whole operation. It is not malfunctioning.
One chambers uploaded a long trial transcript and asked whether something appeared in the record. The model fabricated quotations and invented witness names. Summarizing first, which fixes so much else, did not fix this.
Sit with why this one surprises people. The transcript was in front of the model. By the test this site has been giving you, that should have lowered the risk. It did not, and the reason is worth knowing: the document exceeded what the model can actually hold and attend to at once, so it filled the gaps the only way it knows how, by generating.
The lesson, and it is a hard one: "I uploaded it" is not the same as "the model read it." Attaching a document is not a guarantee that the whole document is in play. On a very long record, the source-grounded assumption quietly stops holding, and nothing in the interface tells you it has stopped.
Fails, and fails by hallucinating. Confirmed across chambers, and confirmed again after prompt refinement.
Contrast this with the section-by-section approach above, which works. The difference is not the tool and not the prompt. It is who does the reasoning. Hand the model the whole job and it must supply substance from memory, which is precisely the mode that fails.
One chambers read a recent Supreme Court decision narrowly. The model "covered the field and applied it across the board."
Why: the model is drawn to the conventional reading, because the conventional reading is the probable one. A narrow, careful, contested construction is by definition the less probable text, which is exactly what the model is built not to produce.
"Absolutely no sealed documents." That is the reported practice and it is the right one. Not negotiable, and no version of this gets softened.
Failed technically. And the privacy exposure would rule it out even if it had worked.
Not practice
Read the label. Everything above this line is something a chambers actually did. Everything in this section is an idea someone raised. Nobody has reported doing these, and they carry none of the weight of the catalogue above. They are here because they are worth discussing, not because they are worth copying.
The idea: where a docket is dominated by the same motion over and over, build a narrow tool for it.
Worth noting: the chambers that proposed it also said their own court is poorly suited to it, having "not a huge volume doing repetitive stuff." The proposal came with its own caveat attached.
This is a feature request aimed at the vendors, not a use case. It describes something a judge would like to exist, not something anyone has done. Both terms are explained under Tools.
Feed in the day's briefs, listen to the summary on the way to the courthouse. Possibly the highest-upside idea in the record, and easy to see why it appeals.
Provenance, stated plainly: this is second-hand. It reached the record as "another judge told me," and no chambers in the testbed reported doing it. Treat it as a rumor of a good idea, which is what it is.
Use the output to identify vocabulary and questions, then verify every substantive claim against authoritative sources.
Potentially useful for authorized, public-facing self-help material. It should not become case-specific assistance or an ex parte channel.
Consider only with specific authorization, secure tooling, careful treatment of confidential information, independent review, and appropriate party consent.
Recommendations, not observed practice
Read the label here too. The testbed reports above come mostly from district courts. The two lists below are recommendations for appellate chambers. They apply the same sorting principle to appellate tasks. They are not reports of what appellate chambers have done.
Bounded, sourced, and checkable. The judgment stays with you.
If no one will read the source, the tool should not have the task.
A working test
When something new comes up and it is not on any list, ask these in order. They are the whole framework compressed, and they are what generated the buckets above.
This is advice, not observed practice. The first three techniques come from the chambers reports above. The fourth extends an instruction reported there. Putting them together as a routine is this portal’s suggestion.
This is not a judicial use case, and it is the one AI issue in the record that arrives without being invited. Four chambers independently report receiving AI-generated filings, mostly from self-represented litigants. Some chambers also point to motions for temporary restraining orders and injunctions.
The tells they describe are ordinary human observations: randomly bolded words, uncanny 24-hour turnarounds, legal elements paraphrased rather than quoted. Parties generally admit it when asked at a hearing. One chambers has a clerk verify by reading, and sets a hearing when in doubt.
The problem is not primarily fake citations. It is subtly wrong statements of law: elements restated almost correctly, tests recited with a piece quietly missing. A fabricated case announces itself the moment you look it up. A near-miss statement of the governing standard does not announce anything, and it will sit in the record until someone reads it closely enough to catch it. Plan for that failure, not the flashy one.
One caution, and it matters. The patterns above are things people noticed, not the output of a detector. Detection software has improved, but none of the studies summarized on this site tested legal filings, and a score is not proof. Treat a detector score as a reason to ask, never as a finding, and be careful about acting on a hunch that a self-represented party used a machine. The wrongness of the law in the filing is something you can actually establish. Its authorship usually is not. The research is summarized under What Courts See.
For appellate chambers. These reports come mostly from district courts. Expect similar issues in the record on appeal.
Guardrails
Four of these are settled and you can act on them today. One is genuinely open, and this portal is not going to pretend otherwise.
Every proposition of law, every citation, every factual assertion, every number that leaves chambers is yours. That was true before any of this, and it is the reason none of this is as unfamiliar as it feels.
Two things about verification are worth stating flatly, because AI tools make them easy to blur:
The practical rule: if a document carries your name, you have read every source it cites. If that is impractical for a given task, the task is not one of the lower-risk tasks.
Not to a model, not with verification, not as a first pass:
The distinction that runs through this whole portal: labor can be delegated, judgment cannot. A model that reorganizes your reasoning is doing labor. A model that suggests what your reasoning should conclude is doing something else, and the fact that you retain a veto does not fix it. It anchors you, and anchoring is invisible from the inside.
Assume anything typed into an AI tool may be retained on someone else's servers and may be seen by someone else. Some enterprise agreements say otherwise, but the assumption should be the default, and the exceptions should be documented ones you have actually read.
That means, absent explicit authorization for the specific tool:
This is where the private-device advice on the Start Here tab does double duty. Keeping your experimentation on personal, non-court matters keeps you clear of this entire category while you are learning.
A public October 21, 2025 letter from AO Director Robert J. Conrad Jr. describes interim guidance distributed Judiciary-wide on July 31, 2025. It addresses accountability, confidentiality, security, education, independent verification, core judicial functions, and possible disclosure. Before any AI tool touches court work, confirm what your court and the AO permit.
This is also why the honest advice today is that most judges' learning happens on a private device on non-professional matters. That is not a workaround. It is what the current rules leave available, and it is genuinely the right place to learn anyway.
Your law clerks have these tools on their phones. Some of them have been using them since law school and are considerably better at it than you are. The realistic risk to a chambers is not a judge who experiments deliberately. It is a clerk who used a tool for a draft and did not think to mention it, because in law school it was ordinary.
The fix is a conversation and a stated rule, whatever the rule turns out to be. Prohibition is a coherent choice. Permission with disclosure is a coherent choice. Silence is not a choice, it is just an unexamined policy. Have the conversation in the first week of the clerkship.
Recommendations · AI agents
An agent takes steps on its own between the moments a person looks at its work. These five controls keep those moments in your hands. How agents work is explained under How These Tools Work.
Product labels will not tell you when the controls apply. The test is whether the tool can act without a person approving each step. If it can, treat it as an agent, whatever it is called.
Delegate the steps. Keep the checkpoints.
Whether, when, and how a court should disclose that AI assisted in preparing a document is unsettled. Courts are reaching different answers, and this portal is not going to invent a consensus that does not exist.
Beyond the standing order
Use it as a conversation guide. Answers remain on this device and are not saved.
You sign it. Nothing about these tools changes that, and every guardrail on this page is a consequence of it.
Tools
A short field guide. It is written mainly to inform the personal, low-stakes experimentation described on the Start Here tab, because that is where most judges' learning can happen right now.
The Administrative Office has interim guidance in effect, and the list of AI tools authorized for use in the courts is limited. This page describes what exists in the market. It makes no representation that any of these tools is approved for judicial use, and it is not an endorsement of any vendor. Confirm with your court and the AO before any AI tool touches court work.
These are the frontier chat tools. They are the ones to learn on, because they are the most capable and because everything else in the market is built on the same kind of model. Each has a paid tier at roughly twenty dollars a month, which is the tier that matters.
Anthropic's assistant. Strong at long documents, careful writing, and analysis where following instructions precisely matters. Handles very long inputs, which is the property that matters most for record review.
OpenAI's assistant, and the one most people have heard of. Broadly capable across writing, analysis, and research. The most widely used, which means the most third-party material exists explaining how to work with it.
Google's assistant. Strong on research and on inputs that mix text with images or video. Integrates with Google's own products, which is either useful or irrelevant depending on what you already use.
Microsoft's assistant, embedded in Word, Outlook, and the rest of Office. Convenience is its main argument: it is already where you write. Less capable than the standalone tools above at hard analytical work.
Several use cases on this portal mention a custom assistant. The term sounds more technical than the thing. It is an ordinary chat tool with two things saved in advance: a standing instruction and a fixed set of files. Every conversation then starts with both in place, so nobody retypes the instruction or reattaches the documents. Vendors name this differently, and some call the same arrangement a project or a workspace. Building one takes no programming.
None of this changes authorization. Files attached to a custom assistant go where everything else you type goes.
These retrieve first and then summarize, which is a meaningfully better risk profile than a general assistant answering a legal question from memory. Better is not risk-free. The model still writes the summary, and it can still mischaracterize a case it correctly found.
Thomson Reuters' AI layer over Westlaw. Natural-language questions answered against retrieved authority, with the underlying cases linked.
The habit to keep: click through. The summary is a starting point for reading, not a substitute for it.
LexisNexis's equivalent. Conversational research, summarization, and drafting against retrieved authority.
The habit to keep: the same one. Read the case.
There is also a set of AI platforms built for law firms and legal departments, Harvey and Legora among them. They are aimed at practice workflows rather than judicial ones, and are unlikely to be relevant to chambers, but judges will hear the names from the bar.
Agents are no longer a specialist tool. They now ship inside products many people already use. What an agent is, and what it changes, is explained under How These Tools Work.
| Product | What it does |
|---|---|
| Claude Cowork* (Anthropic) | Works across your files and tools |
| ChatGPT Work (OpenAI) | Runs multi-step projects across your apps |
| Copilot Cowork (Microsoft) | Acts across Outlook, Teams, and Excel |
| Claude Code and Codex | Coding agents that read, write, and run files |
Examples, not endorsements. Check what your court has approved. Product descriptions come from vendor announcements and press coverage in 2026, and these products change quickly. *Anthropic began folding Cowork into the main Claude app in September 2026, so the separate name is on its way out. The controls that belong around any agent are under Guardrails.
Choosing
One goal for this portal is a matrix: for each real judicial use case, which tool actually does it best. That matrix cannot be built until the use-case list is complete, so it is not here yet, and a speculative version would be worse than nothing.
The bar
This tab is context rather than instruction. Nothing here tells you what to do in chambers — that is what Guardrails is for. It is here because the adoption curve outside the courthouse is already shaping what arrives inside it, and that is worth seeing plainly.
of lawyers use these tools for work
8am, 2026
of firms have a written, enforced AI policy
8am, 2026
of lawyers, up from 11% a year earlier
ABA, 2024
Sources. 8am Legal Industry Report 2026, n > 1,300, surveyed September–October 2025; 8am is a legal software vendor, so read its levels with that in mind. ABA Legal Technology Survey Report, 2024 edition. The two disagree on how high the number is. They agree on the direction, and on the gap between use and governance.
Filings reach you built with tools the filer’s own firm does not govern. The sanctions cases are the visible tail of that, not the shape of it. The ordinary case is a brief that was drafted with assistance nobody recorded, nobody disclosed, and nobody had a written rule about.
AI in the filings
Chambers in the testbed are seeing AI-assisted filings, as the Use Cases tab reports. The natural next question is whether software can tell you which filings those are. Here is what the research shows.
A score can prompt a question to the filer or a closer read. It does not establish who or what wrote a document. What a court can establish is whether the law and the record citations in the filing are right, and that is done by reading.
Law schools
Legal education did not get to deliberate. Students arrived in 2023 with these tools already in hand, and a school that waited would have been setting policy for a world that had moved on. The question was never whether to allow them. It was what competence with them looks like, and how to grade it.
At Penn Carey Law, AI lessons and exercises entered the first-year Legal Practice Skills course in 2023. That is not a claim to have gotten it right. It is a claim about the timeline: the schools are two full graduating classes into this, which is why the people arriving in your chambers are not where you are.
Penn Carey Law
AI lessons and exercises entered first-year Legal Practice Skills
1Ls, writing fellows, and teaching assistants received secure ChatGPT EDU accounts
In spring, 2Ls, 3Ls, and LLM students received Harvey access
Penn Carey Law, “Forging the Future,” Jan. 30, 2026. These are dates, not quantities.
| Tool | Who has it | What it is for |
|---|---|---|
| Claude, with Claude Code | Every 1L; faculty and staff | General assistant and agent |
| PennChat, Copilot Chat | Everyone | Secure chat for University data |
| Harvey, Legora | 2Ls, 3Ls, LLM students, faculty, staff | Legal research and drafting |
| Westlaw AI, Lexis+ AI | All students and faculty | AI inside legal research |
Source: Penn Carey Law AI resources guide, updated Oct. 6, 2026. Access terms vary by tool and data sensitivity.
Access comes with instruction, not instead of it. The accounts are institutional ones, deliberately not consumer logins: the data terms and the model quality are both different, and students who learn on a free tier learn the wrong lessons about capability. Legal-specific tools sit beside the general assistants, so students see where a legal-specific tool earns its keep and where it does not. Coursework runs from access to justice through AI in corporate practice, and Advanced Legal Research was expanded to take these tools seriously. The through-line is the same one on this portal: check the source.
Source for the list above: Penn Carey Law AI resources guide, updated Oct. 6, 2026, and 1L guide, updated Sept. 27, 2026.
Some new clerks are arriving having learned alongside these tools. They may not think of using one as a decision worth mentioning, because in law school it was ordinary. That is not a discipline problem and it does not respond to a discipline answer.
A stated rule in the first week, whatever the rule turns out to be, is the point made at the end of Guardrails, arriving here from the other direction.
Evidence and limitations
Each note states what the source supports and where its limits lie.
Supports reported use, attitudes, tasks, and chambers policies among responding federal judges.
Limitation: 112 of 502 sampled judges responded, a 22.3% response rate. Item totals vary, and only six appellate judges responded.
Read the preprintPublicly describes interim guidance distributed July 31, 2025.
Limitation: The letter summarizes the guidance; it is not the full guidance and does not establish a February 2026 update.
Read the letterDocuments federal pro se filing and docket trends during the generative-AI period.
Limitation: This is a working paper. It reports an association, not proof that AI caused the increase.
Read the paperCollects judicial matters involving alleged, implied, or found AI-related fabrication and misrepresentation.
Limitation: It changes continually, uses inclusion judgments, and does not measure incidence across all filings.
Open the trackerProvides public judicial use cases and guidance on verification, confidentiality, bias, and responsibility.
Limitation: Professional guidance is not binding federal policy or product authorization.
Read the guidelinesProvides cross-sector adoption and use-case context.
Limitation: Toplines combine legal, tax, accounting, risk, fraud, and government respondents; they are not lawyer-only statistics.
Read the reportSupports the Penn exam results on the Start Here tab: eleven Penn Carey Law finals from Spring 2026, one model (Claude Opus 4.7), graded on the class curve by the faculty who wrote the exams.
Limitation: A draft paper on one model at one school. Two exams were not graded blind, one of them graded by the author. Ten of the eleven exams were returned with grades, so the reported figures are out of ten.
Read about the studySupports the statement that ChatGPT passed four law school final exams in 2023, at about a C+.
Limitation: An early result on an early model. It marks the starting point of the trajectory, not current performance.
Together support the statement that GPT-4 passed a simulated bar exam in 2023.
Limitation: The two are cited as a pair because how far above the passing line GPT-4 scored is disputed.
Supports the statement that contracts professors, reading blind, preferred AI answers to other professors’ answers about 75% of the time.
Limitation: One subject and one study design. It is a different model and a different setting from the earlier entries, so it is not a like-for-like comparison.
Supports the statement that leading legal research AI tools gave answers that were wrong, or unsupported by the cited source, in 17 to 33 percent of cases.
Limitation: Published in 2025 on tools tested in 2024; these products change often. It does not measure any tool as it performs today.
Supports the statement that the best detector tested, Pangram, was near-perfect on unedited text in a study of 1,992 passages, and that it was largely robust to the humanizer the study tested.
Limitation: A working paper. It did not test legal filings, and the result reported here is for unedited text.
Read the working paperSupports the statement that seven earlier detectors flagged, on average, 61% of essays by non-native English writers.
Limitation: Tested 2023 detectors on essays, not current detectors and not legal filings. The non-native sample was 91 TOEFL essays.
Read the paperSupports the statement that a majority vote of five people who use AI tools often made one error in 300 articles.
Limitation: Tested articles, not legal filings, and the readers were practiced users of AI tools rather than typical readers.
Read the paperSupports the statement that, across 642 published academic abstracts, Pangram and GPTZero flagged lightly AI-refined abstracts 38 to 80 percent of the time, and that fewer than 4 percent of AI rewrites were still flagged after a commercial humanizer.
Limitation: A recent conference paper on academic abstracts, not legal filings. Its human and AI labels are proxies, the figures are at a single score threshold, and it tested one humanizer.
Read the paperSupports the observed use cases, the failure reports, and the chambers reports of AI-assisted filings: 20+ chambers as of September 2026, reporting since fall 2024.
Limitation: Chambers reports are self-reported, not measured, and are published only in aggregate with chambers de-identified. Some items come from a single chambers, and the page says so where that is the case. The reports come mostly from district courts.
Supports the dates on which AI instruction and tool access reached Penn Carey Law students.
Limitation: A school’s account of its own program. It supplies dates, not quantities.
Supports the list of AI tools available at Penn Carey Law in fall 2026 and the description of what is taught alongside them.
Limitation: Describes one school at one date. Access terms vary by tool and data sensitivity.
Written and maintained by R. Polk Wagner, with support from the Penn Carey Law AI Project. It was first built for a panel at the August 2026 Judicial Conference of the Sixth Circuit and is now kept as a standing resource for judicial education programs. It is the author’s work. It does not speak for any court, the Federal Judicial Center, the Judicial Conference, or the Administrative Office of the U.S. Courts.