Law firms now use AI tools to draft documents, review files, and speed up research. But these tools send data to outside servers, and that puts client information at risk. This article explains the main risks, including vendors training on prompts, long data retention, and staff using unapproved tools. It covers what ABA Formal Opinion 512 and Florida Bar Ethics Opinion 24-1 expect from lawyers, especially on confidentiality and informed client consent. It then lays out practical steps: vetting AI vendors with clear questions, keeping identifying details out of prompts, writing a short AI use policy, training staff, and adding technical controls like multi-factor authentication, audit logs, and data loss prevention. It also explains how to talk to clients about AI use and how to respond if data is exposed. The goal is to help firms use AI while still meeting their duty to protect client data.