Self-hosted AI in a small law office: a confidentiality check against ABA Opinion 512 and state bar guidance

By MV2 of Munim, Inc. Written with AI agents working in his name. Every opinion cited below links to the issuing bar or court; links checked on 13 October 2026. This is technical information about software, not legal advice and not an ethics opinion.

Small firms run Ollama, LM Studio, Open WebUI or AnythingLLM on an office machine for one reason: client text never leaves the building. The bar opinions on generative AI reward that choice. Florida's Opinion 24-1 says informed consent under its Rule 4-1.6 is not needed when an in-house tool discloses nothing to a third party. But the same opinions move the duty onto your setup. North Carolina's 2024 FEO 1 says the lawyer stays responsible for keeping information secure whether the tool is hosted by a vendor or runs on the firm's own servers, and the ABA's Formal Opinion 512 asks about disclosure to people inside the firm who would not know a prompt came from a client. So the questions a self-hosting office has to answer are technical ones. Here they are, with the command or setting that answers each.

What the opinions ask, and what to check

What the guidance asksWhere it says soWhat to check on a self-hosted setup
Will the tool disclose client information to anyone outside the firm? ABA 512; DC Opinion 388 (provider must not see, keep or reuse it); Texas Opinion 705 Who can reach the model server. Ollama has no login of its own, so whatever can reach port 11434 can send prompts and read model names. From another machine on the network run curl http://<office-machine-ip>:11434/api/version; it should fail unless you meant to share it. On the machine itself, Ollama should listen on 127.0.0.1, not 0.0.0.0. How to check and fix.
Does the tool send anything home, or share by default? California Practical Guidance (review terms, retention and training practices); NC 2024 FEO 1 Sharing and community features. Open WebUI ships with community sharing on; set ENABLE_COMMUNITY_SHARING=False unless you use it. Check whether your chat front end has web search, cloud model providers or a shared prompt library switched on; each is a path for client text to leave. Open WebUI settings.
Can people inside the firm read another matter's prompts without knowing they are a client's? ABA 512 (the intra-firm point); ABA 512 and Texas 705 on self-learning tools Users, workspaces and memory. A local model does not learn from prompts, but the front end can keep them. List every account in Open WebUI or AnythingLLM, remove shared logins, and switch off memories or long-term context features unless each user understands they persist. AnythingLLM 1.13.0 up to 1.16.2 handed an owner's private Memories to anonymous visitors of an embedded chat widget (details).
Is the tool kept secure with reasonable efforts? NC 2024 FEO 1 (Rule 1.6(c)); Pennsylvania Joint Formal Opinion 2024-200; NYC Bar Formal Opinion 2024-5 Known vulnerabilities in the version you run. Type your Ollama, Open WebUI, AnythingLLM, vLLM or LiteLLM version into the CVE checker. Several 2026 advisories for these tools have no CVE ID and are missing from the databases that dependency scanners read, so a scanner saying "clean" is not proof.
Do you still paste into a cloud assistant sometimes? Florida 24-1 (informed consent before a third-party tool sees confidential information); DC 388 Mask before you paste. Paste-Safe replaces names, organisations, emails and numbers with placeholders in your browser before text goes to ChatGPT, Claude or Gemini, and restores them in the reply. Nothing is uploaded. It reduces risk; it does not anonymise.
Are citations verified before filing? Pennsylvania 2024-200; Kentucky KBA E-457; New Jersey Preliminary Guidelines Local models hallucinate too. The public database kept by Damien Charlotin listed 2,184 decisions involving hallucinated material on 10 October 2026 (CC BY 4.0). A smaller model on your own GPU is not more reliable than a cloud one, only more private. Check every citation against the court's own text or CourtListener before it leaves the office.
Is there a written policy? New Jersey's 30 March 2026 Notice to the Bar (sample starter AI policy); Kentucky's sample AI use policy (April 2026) Write down what you checked. Which machine, which tools and versions, who has accounts, what listens on the network, the date. A one-page record answers most of the questions above if anyone ever asks.
The opinions are advisory and differ by state. The table paraphrases them; read the one for your jurisdiction. The index MV2 maintains, with the primary link and date for each, is open data: github.com/munimv2/bar-ai-guidance (CC BY 4.0; ABA plus CA, DC, FL, KY, NJ, NY, NC, PA and TX as of 13 October 2026, more as each link is verified).

A ten-minute self check

  1. Run the free, read-only local-ai-checkup script on the machine that hosts the model. It reports what is exposed, risky or slow and prints nothing secret.
  2. From a second machine on the office network, try the curl line above. A refused connection is the right answer unless you share the server on purpose.
  3. Put each tool's version into the CVE checker.
  4. Open the user list of your chat front end. Remove accounts you cannot name. Turn off community sharing and memory features you do not use.
  5. Write the four answers down with today's date.

Want it checked for you?

MV2 of Munim, Inc. does a $49 local AI health check for one machine, or a $199 small-office check for up to 5 machines or one shared Open WebUI or Ollama server: a written report of what is exposed, risky or slow and what to fix first, with exact commands for your OS. See a sample report. Pay $49 or pay $199 on Stripe, then email munimversion2@gmail.com each machine's local-ai-checkup --json output, its OS and what the office uses the AI for. The report comes within 48 hours. It is a technical review of your machines, not a bar-compliance certification; MV2 never asks for passwords, keys, client files or remote access.