For two years defender offices asked whether it was ethical to use AI at all. In 2026 the National Association of Criminal Defense Lawyers turned the question round. Its white paper Parity in Practice: The Defender’s Duty to Ethically Use AI starts from a fact, not a fear: “AI is already in the courtroom, and prosecutors’ offices are using it to manage evidence.” On that view, AI for criminal defense lawyers is not a risk to be managed but a capability the other side already has. A defender who cannot match it is not being cautious. They are being outgunned.
On 9 September 2026 the New Mexico Supreme Court fined a Santa Fe lawyer who had fed a trial transcript to ChatGPT expecting “a bulletproof summary” and filed a murder-appeal brief containing “false testimony from wholly fabricated witnesses”. The gap between those two stories is the whole subject here: which tasks a model does better than an overloaded office, which duties stay personal, and where a client’s own chatbot history ends up.
The flip: NACDL’s defender’s duty to use AI
NACDL’s AI Task Force lists the work it expects defenders to do with AI: evidence management and discovery organisation, case-theory testing, witness-prep materials, motion drafting and cross-examination development, trial strategy, and collateral-consequence mitigation.
The duty argument is not a defender’s invention. ABA Formal Opinion 512 says “it is conceivable that lawyers will eventually have to use them to competently complete certain tasks for clients”, and the UK Jurisdiction Taskforce said in July 2026 that a professional could be liable for failing to use AI where a professional exercising reasonable care and skill would have used it.
One correction before you quote NACDL’s risk numbers. Its “17-33% error rates” refer, on the page itself, to the legal-research products Lexis+ AI, Westlaw AI-Assisted Research and Ask Practical Law AI as measured by Stanford (more than 17% and more than 34%), not to general chatbots, which did far worse.
What 511 defence professionals said, and what they left out
A Rev/Centiment survey of 511 criminal-defence professionals (September 2025) is the best adoption data the field has; an 8am report on criminal-law professionals fills in which tools they use:
| Finding | Figure |
|---|---|
| Have used AI in criminal-defence work (Rev) | 71% |
| Say AI outperforms traditional methods for evidence analysis (Rev) | 56% |
| Used AI to identify witness-statement inconsistencies (Rev) | 26% |
| Use general-purpose AI such as ChatGPT or Copilot (8am) | 64% |
| Have a legal-specific AI tool (8am) | 29% |
| Use AI to summarise police reports, discovery, witness statements and body-cam transcripts (8am) | 49% |
| Cite trust as a barrier / privilege as a barrier (8am) | 87% / 73% |
Read the last four rows together: half the profession summarising witness statements, two-thirds in general-purpose tools, three-quarters worried about privilege. Robert Southwell of Southwell Law calls AI “a massive time-saver for the whole team”. The survey does not say where the witness statements went.
Five workflows, from custody triage to cross-examination
A 2026 practitioner guide to running a defence practice on AI documents five workflows. Here they are with prompts, assuming the material sits in a no-training or on-premises environment (see the table below) and that you have OCR’d everything first, because otherwise “you get hallucinated dates, mangled drug names, and unusable citations”.
1. Intake and custody triage with collateral-consequence flags
The first hour of a new file is a charge summary, bail status and collateral consequences. A model is good at the checklist and bad at the advice, so the prompt stops at flags.
From the charging document and booking sheet below (anonymised), produce: (1) each count with statute, classification and maximum exposure, tagged [VERIFY]; (2) custody and bail status with the next date; (3) collateral-consequence flags for immigration, sex-offender registration, firearms, driving and professional licences, stating only "POSSIBLE - LAWYER TO ADVISE", never the advice itself; (4) the three documents to request first. Jurisdiction: [state / federal district].2. Discovery and body-cam timelines with Bates numbers and timecodes
The workflow with the best evidence behind it: one timeline across police reports, body-cam transcripts and witness statements, with Brady/Giglio flags and a chain-of-custody column. The case chronology guide covers the general technique; the criminal version adds timecodes and flags transcript-derived entries for footage review.
From the attached discovery (police reports, body-cam transcripts with timecodes, witness statements), build a chronological timeline with columns: Timecode or Bates | Source | Event | Officers and witnesses present | Statement quoted verbatim | Potential suppression issue (4th/5th/6th Amendment trigger, one line) | Potential Brady/Giglio material (describe, do not conclude) | Chain-of-custody note. Mark anything derived from a transcript rather than video as TRANSCRIPT ONLY - REVIEW FOOTAGE. Quote; do not paraphrase.3. Suppression-issue matrix by constitutional trigger
From the timeline, ask for a matrix grouped by trigger: the stop, the search, the statement, the identification, the delay in counsel. After you have watched the footage, ask for a motion skeleton on verified facts with placeholders where authority belongs, then add the cases yourself from a citator, following the citation verification protocol.
From the facts below, which I have verified against the video, and the constitutional triggers I have identified, draft the skeleton of a motion to suppress in [court]: a statement of facts with timecode cites; the legal standard for each trigger as a heading with [VERIFY] placeholders for authority; argument headings only, each naming the two facts it depends on; and the exhibits needed. Do not insert any case or statute; I will add authority myself.
Facts: [paste]
Triggers: [list]4. Sentencing memos sourced from client records
The guide’s phrase for the mitigation narrative is the whole rule: “sourced from client records (not fabricated)”. The model organises the § 3553(a) factors and PSR objections; every biographical fact comes from a document you supply.
Using only the records below (PSR, letters of support, treatment and employment records, anonymised), outline a sentencing memorandum for [court]: PSR objections with the paragraph number and the record page that contradicts it; the § 3553(a) factors with supporting facts, each footnoted to a record page; a plain-English mitigation narrative drawn only from those records; and the facts a judge would expect that the records lack. Invent nothing. Cite no case law.5. Cross-examination outlines with an impeachment matrix
Transcript analysis is where the benchmarks favour the tools: in the February 2025 Vals Legal AI Report, Harvey scored 77.8% on transcript analysis against a lawyer baseline of 53.7%. The deposition summary guide shows the page-line method; for trial, add an impeachment matrix keyed to FRE 608 and 609.
Using the attached prior statements, hearing transcript and police reports for [witness], build an impeachment matrix: Topic | Prior statement (quoted, with page:line or Bates) | Expected trial testimony | Inconsistency | Impeachment route (prior inconsistent statement / FRE 608 / FRE 609, tagged [VERIFY]). Then draft closed, leading questions for each row, none without a quoted source.Which environment for which document
Most defenders use general tools; most defence material cannot go into the consumer versions of them. The reconciliation is a tiering rule, and the practitioner guide’s line for the top tier is that client statements, plea discussions and protective-order material “never leave a BAA / DPA / on-prem endpoint”.
| Material | Where it may go | Why |
|---|---|---|
| Statutes, procedure questions, your own learning | Any tool, including consumer accounts | Nothing identifies a client |
| Anonymised police-report excerpts, redacted discovery summaries | A no-training tier (ChatGPT Business, Claude Team, Gemini in Workspace) with anonymisation | ABA 512 consent duty; not privileged on the Heppner reasoning |
| Body-cam, witness statements, client statements, plea discussions, protective-order material | Enterprise zero-data-retention terms, an e-discovery platform (Relativity aiR, Everlaw, DISCO) or a local model | Jeffries v. Harcros (D. Kan., 25 March 2026) banned public AI for all discovery material |
| Anything filed with the court | Whatever drafted it, plus a lawyer who opened every citation | Lnu v. Blanche; State v. Sandoval |
Two 2026 orders make the third row a court rule. Jeffries barred public AI for every discovery document; Morgan v. V2X (D. Colo., 30 March 2026) wrote a vendor test into its protective order that, in Akin Gump’s summary, “practically bars the use of most ‘low-to-no-cost’ AI tools”.
Non-delegable: Padilla, plea advice and watching the footage yourself
Two duties stay with the lawyer whatever the tool. Padilla advice on immigration consequences cannot be delegated to a model, and neither can plea advice; the triage prompt above deliberately refuses to give it. And body-cam summaries “miss context, tone, and visual detail”, so the guide’s rule is that the attorney watches key segments personally.
Fabricated testimony can only be checked against the record, which is why every prompt above demands a quotation with a page, line, Bates number or timecode.
Privilege: what the Heppner seizure means for your client’s chats
United States v. Heppner is a criminal case, a fact the corporate commentary tends to forget. The defendant in a securities-fraud prosecution had used consumer Claude to research his own situation; the FBI seized roughly 31 documents memorialising those exchanges from his home. Judge Rakoff ruled from the bench on 10 February 2026 and in a memorandum filed 17 February 2026 held the documents were protected by neither the attorney-client privilege nor the work product doctrine. “Because Claude is not an attorney, that alone disposes of Heppner’s claim of privilege.” The privacy policy allowed retention and third-party access; counsel had not directed the use.
That last point is the opening. Had counsel directed the use, the court said, Claude “might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent”. Untested, but a lawyer-directed task on lawyer-controlled terms may be the difference between an exhibit and a privileged document. The privilege guide covers the civil cases that went the other way.
CJA billing and AI-saved time
The practitioner guide’s rule, “No billing for AI-saved time”, follows from ABA Formal Opinion 512: a lawyer who “expends 15 minutes to input the relevant information into the program … may charge for that time as well as for the time necessary to review the resulting draft”, but “A fee charged for which little or no work was performed is an unreasonable fee.” On a CJA voucher the entry is the review: checking the timeline against the footage, not producing it.
The other side of that ledger: in United States v. Farris (3 April 2026) appointed counsel who filed AI-fabricated authority was removed from the case, denied CJA compensation and referred for discipline. The billing guide works through the same rule for private clients.
Where to go next: the immigration guide covers the Padilla side of any plea, the personal injury guide the medical-record chronologies mixed practices also run, and the practice-area hub applies the same evidence standard to every field. The prompts above come from the prompt library; the body-cam timeline workflow is one of the exercises defence lawyers build in AI Lab for Lawyers, on anonymised material.
Frequently asked questions
Do criminal defense lawyers have a duty to use AI?
NACDL's white paper 'Parity in Practice: The Defender's Duty to Ethically Use AI' argues yes, because prosecutors' offices already use AI to manage evidence and a defender who cannot match that capability is at a disadvantage. No court has imposed such a duty, but ABA Formal Opinion 512 says it is 'conceivable' lawyers will eventually have to use AI to act competently, and the UK Jurisdiction Taskforce has said a professional could be liable for failing to use it.
Can AI review body-cam footage?
Partly. Transcription tools (Rev, Trint, Otter, Axon, Veritone, Truleo) and review platforms (Relativity aiR, Everlaw, DISCO Cecilia) can turn hours of footage into a timecoded, searchable transcript and flag statements, officers present and possible suppression triggers. What they cannot do is see tone, context or what happens off-mic. The working rule is that the model builds the timeline and the lawyer watches every segment that matters, personally.
Can I bill CJA hours for AI-saved time?
No. CJA vouchers, like any fee under ABA Formal Opinion 512 and Texas Opinion 705, cover actual time: the minutes spent preparing the input and the hours spent reviewing the output, never the hours the tool saved. In United States v. Farris (6th Cir., April 2026) counsel who filed AI-fabricated citations was removed from the case, denied CJA compensation and referred for discipline.
Is a defendant's ChatGPT conversation privileged?
Not on the current authority. In United States v. Heppner (S.D.N.Y., February 2026) Judge Rakoff held that roughly 31 documents recording a defendant's consumer-Claude exchanges, seized by the FBI, were protected by neither the attorney-client privilege nor the work product doctrine: 'Because Claude is not an attorney, that alone disposes of Heppner's claim of privilege.' The court left open whether counsel-directed use might be treated as a lawyer's agent.
What AI tools do public defenders use?
Mostly general-purpose ones: an 8am report found 64% of criminal-law professionals use general AI such as ChatGPT or Copilot and only 29% have a legal-specific tool, with 49% using AI to summarise police reports, discovery, witness statements and body-cam transcripts. Named defender-side tools include Relativity aiR, Everlaw, DISCO Cecilia, Rev, Trint and Otter for transcription, and Westlaw Precision AI, Lexis+ AI and CoCounsel for research.