AI Learning Hub › Learn AI › Self-Paced Courses › Introduction to AI › Beginner › Using AI at Stanford Law

Level 2 of 4 · Beginner · Lesson 5 of 6

Using AI at Stanford Law

The institutional responsibilities that come with using AI at Stanford Law School, and where to find current guidance.

About 15 minutes

Skip to lesson

By the end of this lesson you should be able to

  • Separate three questions: whether a use is permitted, whether a service is approved for the information, and what else is required
  • Apply the Stanford Law School default rule for courses without their own AI policy
  • Find the current Stanford sources for data classification and approved AI services

Why this matters

The rules for using AI at Stanford Law depend on what you are doing, for which course or office, and with what information. They also change. Rather than a list of dos and don’ts, this lesson gives you three questions to ask every time, and tells you where the governing answers live.

The policies below were checked against their official pages on September 24, 2026. The links go to the live versions, which govern if anything here differs. This lesson is an orientation, not legal advice or an ethics opinion.

Three questions, asked separately

1. Is this use permitted here?

For coursework, that is your instructor’s policy, or the school’s default. For faculty and staff work outside coursework, it is your office’s or supervisor’s guidance and the obligations that come with the activity itself.

2. Is this service approved for this information?

That depends on how the information is classified, which service you use, and which account you are signed in with.

3. What else is required?

Disclosure or written authorization, attribution, a data owner’s restrictions, research approvals or reviews, or professional rules.

A yes to one question does not answer the others. An approved service does not make a use permitted in your course, and a permitted use does not make it acceptable to paste in restricted information. Accuracy and human review apply whatever the answers: you still check the output.

Question 1 for coursework: the SLS policy

Stanford Law School’s Use of Generative AI Technology (opens in a new tab) policy, from the Office of Student Affairs, applies to all SLS courses, including clinics. In brief (a paraphrase; the linked policy governs):

Your instructor’s policy comes first

Instructors may set their own AI policy for a course, allowing or disallowing some or all uses, and must state it in the syllabus. If you are unsure what a course policy allows, ask the instructor. Even an instructor’s permission cannot authorize breaking standard academic norms on plagiarism and accuracy.

The default, when a course has no AI policy

You may use generative AI to support your learning and to develop or refine your own ideas, but not to generate content that you then present as your own work. The policy’s examples of uses that are not prohibited: organizing a study outline before an exam, and preparing to be on panel in class.

Using AI during an exam, or to draft or revise any part of submitted work, is not permitted unless it is (1) fully disclosed to the instructor in advance and (2) explicitly authorized by the instructor in writing before you use the tool. Drafting or revising includes writing or revising the text of a paper or clinic work product, generating citations, and fixing citation format.

What permission does not change

  • Disclosing afterward is not permission. Both the disclosure and the written authorization come before use.
  • Attribution and accuracy still apply. The policy defines plagiarism to include “using an idea obtained from AI without attribution or submitting AI-generated text verbatim without quotation marks,” and says accuracy norms “require verifying assertions in submitted work.”
  • Practice-of-law coursework has more rules. Where coursework involves representing clients, giving legal advice or services, or otherwise practicing law, AI use must meet all applicable rules of professional responsibility.
  • When unsure, ask and disclose. The policy tells students who are unsure whether a use is permitted to ask the instructor and disclose the use.
Optional: what the policy says about enforcement

Citations to sources that do not exist “will raise a presumption of generative AI use.” Unauthorized use may result in a lower grade, including an F, and/or a referral to Stanford’s Office of Community Standards. The policy’s examples say that using AI to write a paper or clinic work product without disclosing in advance, or using AI during an exam without disclosing, violates the policy.

For faculty and staff. Work outside coursework, such as scholarship, research, and administration, carries its own obligations: your office’s or supervisor’s guidance, research and data requirements, and, for scholarship, the policies of journals, publishers, and professional groups, which UIT’s guidance says to consult. Being faculty or staff is not a blanket exemption, though: if you take a course, or an activity is part of one, the rules for that course apply to it.

Question 2: the information and the service

Classify the information

Stanford classifies data as Low, Moderate, or High Risk. UIT’s Risk Classifications page (opens in a new tab) gives the definitions and examples. A few to calibrate: public information is Low Risk; student records and university ID numbers are Moderate Risk; health information and Social Security numbers are High Risk. When material mixes classifications, use the highest one. UIT notes that most research data is Low Risk, apart from regulated data, but lists unpublished research data as Moderate Risk at the data owner’s discretion.

Use a service approved for that classification

UIT maintains a live list of Approved AI Services (opens in a new tab), showing which Stanford-provided services are approved for which classifications. It changes as services are added and reviewed, so check it each time rather than relying on a copied list—including older pages elsewhere on this site.

Use the Stanford-provided account

Approval attaches to a service as Stanford provides it, not to a product name. For several of the listed services, the approved-services page notes that a Stanford email address alone does not make an account approved for Stanford data: the account must have been provisioned as part of the UIT-managed workspace. A personal account, or one you set up yourself with your Stanford email, is not the same thing. Follow the approval and account conditions listed for the particular service you use.

UIT’s Responsible AI guidance (opens in a new tab) also cautions against entering Moderate or High Risk data into third-party AI tools, whether through a personal or a Stanford account, unless they are appropriately covered, and points back to the approved-services list. If you are unsure whether a tool, account, or use is covered, ask UIT before you enter the information.

Approval is not blanket permission

A service being approved for a classification means the platform may handle that kind of data. It does not make every use appropriate. UIT’s Protecting Sensitive Data (opens in a new tab) guidance asks first whether your access to the data is “approved and necessary,” and to use only the minimum you need. Your school or office may have additional guidance, and data you received from someone else may come with its own restrictions.

Question 3: what else applies

  • Disclosure and authorization under your course policy, as above.
  • Sharing outside Stanford. Stanford requires a Data Risk Assessment (opens in a new tab) before Moderate or High Risk data is sent to or received from a non-Stanford entity. What that means for a particular AI project depends on the service and the project, so do not assume either that each prompt needs its own assessment or that an approved service covers every project. Confirm what is covered, and what further review is needed, with the service or project owner or the relevant Stanford office.
  • Research. Stanford’s Research Policy Handbook, section 1.10 (opens in a new tab) sets out information-security practices for research computing, alongside any approvals and agreements your project already carries.
  • Professional rules in clinics and other practice settings. Ask your supervising attorney; this lesson does not replace that conversation.
  • Transparency. UIT’s guidance suggests that if your final product is significantly influenced by AI, you consider telling people how you used it and cite appropriately.

Try it: what does each person need to check?

Three fictional situations. Assume no course-specific AI policy unless one is mentioned.

  1. Maya, a 1L, wants a chat assistant to quiz her on the elements of adverse possession before an exam in a course whose syllabus says nothing about AI. She will paste in her own study notes: her explanations of public course material, containing no personal, confidential, or otherwise restricted information.
  2. Jordan, a 2L, has finished a seminar paper and wants an AI tool to fix the Bluebook formatting of the footnotes. The syllabus has no AI policy. Jordan plans to mention it in the paper’s acknowledgments.
  3. Sam, a staff member, wants to paste a spreadsheet of student names, student ID numbers, and notes about approved accommodation requests into an AI tool to draft individual emails.
Discussion
  1. Maya: Permitted? Studying is learning support, which the SLS default permits; the policy’s own examples include organizing a study outline for an exam. She should confirm the syllabus really is silent and not use AI during the exam itself. Approved for the information? As described, her notes contain only her own explanations of public material, so they are Low Risk; using a Stanford-approved service with her Stanford-provided account is still a good habit. Anything else? If she added other people’s material, such as a classmate’s outline or materials the instructor distributed, whether she may upload it would be a separate question from its data classification. And quiz answers can be wrong, so she should check them against her readings.
  2. Jordan: the policy gives almost exactly this example: using AI to fix the Bluebooking of a paper is revising submitted work, so it must be authorized by the instructor in writing in advance. Under the default, Jordan needs to disclose the use to the instructor in advance and get written authorization before using the tool. A note in the acknowledgments afterward does not satisfy that. Even with authorization, Jordan remains responsible for the citations being accurate.
  3. Sam: confirm the facts before anything is uploaded. Classification: student records and ID numbers are Moderate Risk under UIT’s examples. Accommodation notes are student records and may also contain health information, which UIT lists as High Risk; whether any of it falls under a category with its own rules or exclusions, such as Protected Health Information, is a question for the office or UIT, not something to guess. Mixed data takes the highest classification. Authority and necessity: is Sam authorized to use these records for this purpose, and do the emails need them at all? Check the office’s guidance on accommodation and student information. Service: only then look for a service on the Approved AI Services list approved for that classification, with no exclusion that applies, used through the Stanford-provided account, with only the minimum information needed. A simpler alternative: have AI draft a generic message with no student records in it, and personalize it outside the tool.

Three separate checks. Is this use permitted? Is this service, and this account, approved for this information? What else is required? They are different questions with different sources; settle each one before you start. Accuracy and human review apply across all three, and none of them moves responsibility for the result away from you.

The governing sources