Committee Reports

Formal Opinion 2025-6: Ethical Issues Affecting Use of AI to Record, Transcribe, and Summarize Conversations with Clients

SUMMARY

The Professional Ethics Committee (Michael E. Salzman, Chair) issued an ethics opinion addressing how the New York Rules of Professional Conduct impact audio and video calls between attorneys and their clients where either the attorney or the client may want to make use of an artificial intelligence (AI) tool to record, transcribe and create a summary of the conversation. Attorneys are free to choose not to use AI to record such conversations, but electing to do so creates important ethical obligations. The opinion concludes that an attorney should obtain client consent before recording the call, should consider whether recording, transcribing and summarizing is tactically well-advised in the particular circumstances, including issues of confidentiality and privilege, and should check the work product for accuracy if there is a possibility the transcription or summary will be preserved and potentially relied upon. If an attorney knows that a client is recording a call with an AI tool, the lawyer should advise the client of the disadvantages of doing so.

REPORT

THE NEW YORK CITY BAR ASSOCIATION
COMMITTEE ON PROFESSIONAL ETHICS

FORMAL OPINION 2025-6: ETHICAL ISSUES AFFECTING USE OF AI TO RECORD, TRANSCRIBE, AND SUMMARIZE CONVERSATIONS WITH CLIENTS

TOPIC: Use of Artificial Intelligence tools to record, transcribe, and create summaries of conversations between attorneys and clients.

DIGEST: This Opinion addresses how the New York Rules of Professional Conduct (the “Rules”) impact audio and video calls between attorneys and their clients where either the attorney or the client may want to make use of an artificial intelligence (“AI”) tool to record, transcribe and create a summary of the conversation. Attorneys are free to choose not to use AI to record such conversations, but electing to do so creates important ethical obligations. The opinion concludes that an attorney should obtain client consent before recording the call, should consider whether recording, transcribing and summarizing is tactically well-advised in the particular circumstances, including issues of confidentiality and privilege, and should check the work product for accuracy if there is a possibility the transcription or summary will be preserved and potentially relied upon.  If an attorney knows that a client is recording a call with an AI tool, the lawyer should advise the client of the disadvantages of doing so.

RULES: Preamble [2]; Rules 1.1, 1.6, 5.1, 5.3, 8.4

QUESTION: What ethical issues should attorneys consider when using, or when clients use, AI-enabled communications tools that can record, transcribe, and summarize conversations with clients?

DISCUSSION:

Introduction

AI tools are becoming increasingly prevalent in legal practice, but as their use expands, so do the ethical issues they present. This opinion adds to the growing body of legal ethics opinions on the use of AI[1] by focusing on ethical issues that arise from the use of AI tools to record, transcribe, and summarize conversations with clients.[2]

The ability to record conversations between attorneys and clients is not new. Earlier New York ethics opinions addressed the recording of telephone conversations and concluded that an attorney generally may not record the conversation without informing the other participants in the conversation.[3] In addition to the attorney’s ethical duties, state law may require that both attorneys and clients disclose the intention to record the conversation and obtain the other individual’s consent.[4]

However, the advent of AI tools that make use of recordings calls on us to revisit the existing opinions. For one thing, videoconferencing has become ubiquitous since the COVID-19 pandemic, and videoconferencing platforms such as Zoom and Teams, among others, can be programmed to make recordings a law firm’s default option, requiring an affirmative act, often overlooked, to disable the recording feature. As a result, conversations between attorneys and clients are more likely to be recorded today than phone calls were in the past. More importantly, however, the prior ethics opinions assumed the more primitive technologies of their times: the use of magnetic tape and digital audio files that merely captured and preserved sounds that happened to include spoken words. Today’s AI tools go several steps further, using (a) voice recognition technology not only to record words spoken, but to attribute those words to particular speakers to create transcripts, including in some cases use of biometric tools, and (b) generative AI to impute meaning and intention to those speakers to create written summaries.

The creation and existence of such AI-generated transcripts and summaries raise novel ethical issues. These ethical issues call on us to consider both the processes by which such transcripts and summaries are created and the legal consequences of the end products. Lawyers must be careful in their use of AI tools that record and summarize conversations with clients and consider when they should not use such tools. Of course, as with taping phone calls in the past, lawyers must not violate the Rules by deceptive conduct in their use of such tools. They must also be aware of the illegal use of such tools without consent, with respect not only to jurisdictions that require all-party consent to recordings but also to those that regulate the capture of biometric digital data (such as voices and images). The danger that AI-generated transcripts and summaries could effectively formalize everything that was said, including informal legal advice that an attorney might have offered to the client “off the cuff,” argues for firm policies to govern the use of transcripts and summaries that have not been reviewed, corrected, and affirmatively adopted.[5]

These issues arise in two different contexts depending on whether it is the lawyer or the client who uses AI tools to preserve conversations. Accordingly, Section I discusses ethical issues that are implicated when attorneys use their own AI tools to record, transcribe, and summarize conversations with clients, and Section II discusses the vexing issues that may arise when it is the client rather than the attorney who has chosen to record the conversation using the client’s own AI tools. Whether at the instance of the attorney or the client, recording, transcribing, and summarizing conversations using AI tools may be helpful in legal practice. But in all cases—and especially since the technologies at issue are still new and developing—attorneys have a duty under Rule 1.1 to acquire an understanding of the technical features of the tools they and their clients use and be alert to the ethical issues that might arise.

I. Ethical issues involved in use of AI tools by attorneys to record, transcribe, and summarize conversations with their clients

A. Client Consent

No specific Rule speaks to a lawyer’s need to obtain prior client consent to record, transcribe or summarize communications. Rather, lawyers’ general ethical prohibition against routinely recording conversations without consent—at least in a one-party consent state such as New York—is rooted in the overarching duty of loyalty that lawyers owe their clients[6] and in Rule 8.4’s proscription that “A lawyer or law firm shall not: . . . (c) engage in conduct involving dishonesty, fraud, deceit or misrepresentation.”  This Association’s last Formal Opinion (“Opinion 2003-02”) on the subject made it clear that the ethics of surreptitiously recording calls turns primarily not on the other party’s expectations that their lawyer is not doing so, but on the fundamental deception being played by the lawyer who does so without telling them.[7]

Nevertheless, the expectations of clients necessarily play a role in determining ethical conduct, and when speaking of AI-generated transcriptions and summaries those expectations must be more carefully considered. Given the Rules and past Opinions, as well as societal norms about the attorney-client relationship, clients may well expect their calls with their lawyers not to be recorded. On the other hand, clients surely expect lawyers to take notes during telephone calls and to reduce those notes to a summary of the call. Indeed, some calls may be so critical that a lawyer could be failing to act competently or diligently, in violation of Rules 1.1 and/or 1.3, if the lawyer does not memorialize them. Given that summaries of calls are expected, should a summary created by an AI tool be treated any differently than a summary written by the lawyer?

Insofar as we are discussing only the summary of the call itself, we do not see why one created by an AI tool should be treated any differently than one created by a lawyer. But AI-generated summaries involve more than just the resulting summary. The summary is the end product of an automated process that includes (a) a voice recording, (b) a written transcription of that recording in which an AI voice recognition tool identifies the speakers, which transcript is then (c) acted upon by generative AI to create the summary. Only if the intermediate products—the voice recording and the transcription—are eliminated from the process can it be said that the AI-generated summary is functionally the same as the attorney’s own file memo of the call, and then only if the attorney has actually reviewed and corrected the AI summary prior to putting it in final form.

Therefore, it is the creation and existence of the predicate voice recording (transcribed or not) that makes the difference.[8] It is debatable whether, based on current technology, a summary derived from an AI-generated transcript of a recorded call will invariably be more accurate than one created from an attorney’s notes, memory, and judgment. But even if it reliably were, in Opinion 2003-02 we concluded that “merely wishing to obtain an accurate record of what was said does not justify undisclosed taping.” We see no reason to deviate from that conclusion.

But Opinion 2003-02 assumed, reasonably enough for the time, that any intentionally made recording would be retained presumably to prove what was actually said, either as formal evidence or as an aid to negotiation. We there recognized that knowing that one is being recorded will affect how one will speak:

As attorneys are well aware, individuals tend to choose their words with greater care and precision when a verbatim record is being made and some individuals may not wish to speak at all under such circumstances. Undisclosed taping deprives an individual of the ability to make those choices. Undisclosed taping also confers upon the party making the tape the unfair advantage of being able to use the verbatim record if it helps his cause and to keep it concealed if it does not. In addition, because undisclosed taping has those effects, it therefore also has the potential effect of undermining public confidence in the integrity of the legal profession, which in turn undermines the ability of the legal system to function effectively.[9]

As a general matter, those effects remain even if, unlike when calls were intentionally recorded, the summary created from the voice recording is all that remains in the attorney’s file. Opinion 2003-02 did not consider the possibility of making a voice recording/transcription that is not retained. It is not clear for how long common communication tools like Zoom and Teams retain recordings and transcripts. But even if the recording and transcript themselves do not long survive, the resulting summary will be based on a verbatim record. Therefore, the reasons set forth in Opinion 2003-02, to the effect that clients may speak differently if they know they are being recorded, continue to be valid.[10] As a result, we conclude that clients must be notified, and their consent obtained, whenever their calls are being recorded by an AI-empowered system.[11]

Finally, as discussed in note 4, supra, lawyers must continue to be mindful that many states require two-party consent to lawfully record telephone calls. In addition, some states have enacted laws to protect biometric data, and such laws include “voiceprints” as protected information.[12] AI transcription tools use voiceprints derived from audio files of recorded conversations to generate transcripts and summaries. At this writing, New York does not have legislation governing biometric data, but there have been attempts to enact such laws, which may succeed in the future.[13] The use of AI tools to record, transcribe and summarize conversations may violate such laws if done without client knowledge and consent.

B. Confidentiality and privilege

Attorneys must safeguard all records of client communications to preserve confidentiality and privilege and carry out their ethical responsibilities under Rule 1.6. Attorneys also need to understand the implications for confidentiality and privilege of retaining a written record of conversations. There are risks in preserving the recordings of conversations with clients, as well as the competing risks in not doing so. For example, if the recording is preserved, if the client is later involved in litigation, the client may be able to use this evidence as part of an “advice of counsel” defense. On the other hand, a preserved recording of a client’s unconsidered and spontaneous remarks could provide evidence that an opponent might seek to rely on as evidence of fraudulent intent or the like.

Attorneys also should consider what privacy and security safeguards are in place in an AI tool to protect the data, including where data will be stored and for how long, how data might be retrievable through discovery, whether the tool uses such data for training, and whether there is a right to data deletion.[14] Because much of this will be under the control of the AI provider, rather than the firm, attorneys should advise clients of the risks of the loss of confidentiality and privilege, particularly, as discussed below, where clients are using their own AI tools.

C. Duty of competence

    1. Reviewing transcripts and summaries for accuracy

In addition to the concerns discussed above about confidentiality and privilege, important issues of competence under Rule 1.1 are implicated in the use of AI tools to record conversations. As with any conversation with a client that the attorney intends to memorialize, the duty of competence implies that attorneys should independently review any recording, transcript, or summary of the conversation – whether prepared by another individual (other attorneys, firm employees, or clients), recorded through traditional electronic means, or generated by AI tools – to ensure that it accurately reflects the conversation. Attorneys should not simply rely on work products prepared by AI tools without independently verifying their accuracy. Likewise, if the AI tools have generated a legal analysis or recommended course of action as part of the summary, the attorneys should independently confirm that the legal analysis and recommendations are sound.[15]

These recordings and summaries may be relied upon, sometimes even years later, and the attorney should therefore review them soon after they are prepared and ensure that any necessary revisions are made. This includes carefully reviewing any informal advice that the attorneys may have offered without adequate time for full reflection, but which may take on greater weight because of the memorialization of the advice in a written transcript or summary.[16]

    1. Acquiring an understanding of the AI tools being used

As part of their duty of competence under Rule 1.1, attorneys have a duty to acquire a facility with new legal technologies.[17] This includes being conversant with the AI tools they use or are being asked to use by clients. For AI tools used by attorneys or their clients, attorneys need to acquire an understanding of the following issues, among others[18]:

  • What steps will be taken to ensure that the attorney, other firm employees, and the client understand at a non-technical level how the AI tool works?
  • What are the terms of service with the provider of the AI tool that will be used?
  • For videoconferencing platforms that have a default AI recording feature, how can this feature be disabled, if desired, and what can be done in case a conversation is inadvertently recorded (e.g. deleting the conversation with client permission)?

In addition, and consistent with the principles set out in New York City Bar Ass’n Pro. Ethics Comm. Op. 2024-5, note 1, supra, attorneys need to acquire an understanding of the security features provided by the AI tool – and their limitations – in order to address the concerns about confidentiality and privilege discussed above.

    1. Training and supervising subordinate lawyers and other employees

As in other contexts, attorneys have a duty under Rules 5.1 and 5.3 to ensure that those they supervise understand their ethical duties and are competent to carry them out. This requires specific training in the use of AI tools and the ethical duties related to this, as well as ongoing supervision.[19]

II. Special issues arising from the use of AI tools by clients

The discussion to this point has focused primarily on ethical issues that arise when it is the attorneys who have chosen to employ AI tools to record, transcribe, and summarize conversations with clients. In situations involving the use of the attorney’s own AI tools, they are largely under the control of the attorney. As discussed above, in order to exercise this control effectively, the requirement under Rule 1.1 that lawyers must be technologically competent means that lawyers must have sufficient mastery of and confidence in using the AI tools they incorporate into their law practices to be able to anticipate the ethical issues that may arise.

However, it is likely that clients will choose to use their own AI tools in conversations with their attorneys, a situation that is largely outside the control of the attorney. An attorney may not be familiar with the AI tools being used by the client and will not have possession of—or, potentially, even access to—the recordings, transcripts, and summaries prepared by the client’s AI tool. Nor will the attorney have control of the tool’s security features. This puts the attorney at risk of not being able to carry out the ethical responsibilities outlined above. In particular, both the attorney and the client may be at special risk later, should the client seek to rely on the summary, if the client does not provide the attorney with, or with access to summaries created by the tool, and an opportunity to verify the accuracy (or otherwise) of the summary.

As with so many ethical issues, problems can often be avoided if expectations are made clear at the outset of the representation. Because of the importance to attorneys of being able to use AI tools with which they are familiar and over which they have some degree of control, the ideal solution is for clients to agree not to use their own AI tools to record conversations with attorneys without advance notice to the attorneys.

If, however, clients insist on using tools that attorneys have not had an opportunity to approve, attorneys are faced with the dilemma of having to decide how best to protect the interests of the clients and the attorneys. Attorneys have several options, none of which presents a complete solution, but which may solve some issues depending on the circumstances:

  • Attorneys may ask that conversations not be recorded.
  • Attorneys should include provisions in retainer agreements stating that any recordings, transcripts, or summaries prepared by AI tools selected or used by the client will not be deemed dispositive or binding as against the attorneys unless they are promptly provided to the attorneys so that the attorneys may conduct independent reviews of the accuracy of these materials.[20]
  • Because the storage of information obtained by client AI tools will not be under the attorneys’ control, they should advise clients of the risks of the loss of confidentiality and privilege.[21]

Conclusion

The use of AI tools to record, transcribe, and summarize conversations between attorneys and clients implicates important ethical considerations.

As a threshold matter, both ethical and legal concerns require lawyers to notify clients in advance that their conversations will be recorded to create AI-generated summaries.

With respect to confidentiality and privilege, attorneys must safeguard all records of client communications to carry out their ethical responsibilities and must understand the implications for confidentiality and privilege – as well as risk management – of retaining a written record of conversations.

With respect to the duty of competence, attorneys should independently review any recording, transcript, or summary of the conversation – regardless of who or what has prepared it – to ensure that it accurately reflects the conversation.

Connected to the duties of confidentiality and competence, attorneys have a duty to ensure that those they supervise receive training in the use of AI tools and the ethical duties related to this, as well as ongoing supervision.

Especially complicated ethical issues arise when it is the clients who choose to use their own AI tools in conversations with their attorneys, a situation that is largely outside the control of the attorneys. This puts attorneys at risk of not being able to carry out their ethical responsibilities. One solution is to craft retainer agreements that seek to preclude clients from using their own AI tools in conversations with attorneys and provide that any recordings will be done by the attorneys’ own AI tools. If, however, clients refuse to agree to such terms and insist on using their own or commercially available AI tools, attorneys should affirmatively disclaim responsibility for unreviewed AI-generated summaries of the conversations and otherwise warn the clients of the potential loss of confidentiality and privilege from using such tools.

Finally, in order for attorneys to competently navigate the various issues that arise when using AI in client communications, attorneys have a duty to acquire an understanding of the technical features of the AI tools they and their clients use.

 

Footnotes

[1] See, New York City Bar Ass’n Pro. Ethics Comm. Op. 2024-5, Ethical Obligations of Lawyers and Law Firms Relating to the Use of Generative Artificial Intelligence in the Practice of Law, and opinions and reports cited in footnote 1 of that opinion.

[2] This opinion narrowly addresses the use of AI tools in conversations between lawyers and their clients.  Similar, but different, considerations apply when these tools are used in intrafirm communications and in conversations between co-counsel or opposing lawyers, and conversations with witnesses, courts, and other third parties.

[3] See, e.g. New York City Bar Ass’n Pro. Ethics Comm. Op. 2003-02, Undisclosed Taping of Conversations by Lawyers (opining that a lawyer may not, as a matter of routine practice, tape record conversations without disclosing that the conversation is being taped, but that a lawyer may engage in the undisclosed taping of a conversation if the lawyer has a reasonable basis for believing that disclosure of the recording would impair pursuit of a generally accepted societal good); New York State Bar Ass’n Comm. on Pro. Ethics Op. 328 (1974) (stating that except in special situations it is improper for an attorney engaged in private practice to electronically record a conversation with another attorney or any other person without first advising the other party); but see New York Cnty. Laws. Ass’n Op. 696 (1993) (concluding that a lawyer may secretly record telephone conversations with third parties, including other lawyers, provided one party to the conversation has consented and provided that such recording does not violate any applicable law or a specific ethical rule, but cautioning that there are risks to such a practice, including a client’s feeling of betrayal and mistrust).

[4] New York is generally a one-party consent state and permits individuals to surreptitiously record their own calls. See N.Y. Penal Law §250.00 Eavesdropping; definition of terms, subsecs. (1) (“Wiretapping”), (2) (“Mechanical overhearing of a conversation”), and (6) (“Intercepting or accessing of an electronic communication”); N.Y. C.P.L.R §4506 Eavesdropping evidence; admissibility; motion to suppress in certain cases; see also People v Badalamenti, 124 A.D.3d 672, 673 (2d Dep’t 2015) (“The New York eavesdropping statute is similar to the federal wiretap statute, in that both statutes require consent from at least one party to the conversation for the recording to be lawful. . . .”); and People v. Clark (Connie), 19 Misc. 3d 6, 7-8 (App. Term, 2d Dep’t 2008) (discussing Penal Law §250.00 and C.P.L.R. §4506).  However, other states have different laws about recording calls, and one concern particular to AI is that AI tools are not yet capable of determining when recordings would violate these varying laws. Attorneys should therefore not rely on AI to determine whether recording is permitted by state substantive law.

[5] Whether the recording of such a communication as described herein would be admissible as evidence or otherwise considered reliable is beyond the purview of this Committee and therefore beyond the scope of this opinion.

 

[6] “The touchstone of the client-lawyer relationship is the lawyer’s obligation . . .  to act with loyalty during the period of the representation.” N.Y. Rules of Pro. Conduct Preamble [2].

[7] New York City Bar Ass’n Pro. Ethics Comm. Op. 2003-02 (“[W]e regard the state of mind of the recording’s target to be considerably less relevant than the state of mind of the individual making the decision to engage in undisclosed taping. . . . [I]t cannot seriously be doubted that an individual who engages in undisclosed taping does so in the hope that the target is not expecting to be taped. Indeed, it is difficult to conceive of any other reason for failing to disclose that the conversation is being taped.”)

[8] We deal here with recordings and transcriptions together. While they are two different tasks, any recording may be transcribed, regardless of the technology used, and many recordings are transcribed and always have been. Therefore, the creation of a transcript, even if generated by AI tools, does not significantly affect the analysis of this Opinion.

[9] New York City Bar Ass’n Pro. Ethics Comm. Op. 2003-02. These effects would exist in other contexts as well.  For example, it would be equally unethical for an attorney to have a stenographer transcribing a telephone call without the client’s knowledge, or a team of associates all quietly taking notes as silent witnesses when the client thought they were speaking only with one attorney. One can imagine an AI-powered communications tool as being a digital agent playing the roles of such stenographer or associates. The ethical issues of not disclosing its presence are the same for all.

[10] Moreover, they continue to be valid regardless of the accuracy of the recording and transcript that results, in the same way that an undisclosed taping of a call would be unethical even if the tape recorder malfunctioned or the resulting tape garbled by extraneous noise.

[11] What the prevalence of such systems may affect is the nature of the required notification and consent. When the practice was deemed unusual, it was reasonable to advise clients each time they were recorded. Today, recording of calls is much more prevalent. Even so, however, unless services like Zoom and Teams provide clear notice that the call is being recorded, the client should be notified, and consent obtained, each time a call is being recorded. Lawyers may also address issues of notice and consent in engagement letters. If a lawyer or firm adopts a policy not to retain recordings and transcripts, such a policy should be disclosed; but in such cases, that policy should be strictly followed. See subsection B below concerning the retention of such documents.

[12]Illinois, Texas, Colorado, Maryland, Oregon, and Washington currently have such laws. Similar laws specifically targeting biometric data have been proposed in other states, including New York and nearby Massachusetts and Pennsylvania. New Jersey and other states have general consumer privacy laws that would expressly or perhaps implicitly cover biometric data. The legislative map is too diverse to cover in depth here, but a convenient tracker of relevant legislation is available at https://www.bclplaw.com/en-US/events-insights-news/us-biometric-laws-and-pending-legislation-tracker.html. (All websites last accessed Dec. 2025)

[13] New York City has a biometric data protection law, but by its terms it does not appear to apply to lawyers or law firms. Local Law 3 of 2021, available at https://intro.nyc/local-laws/2021-3.

[14] In addition, clients may themselves insist on using commercial facilities, at least on occasion. Because of the risk of disclosure in open systems, lawyers should be fully conversant with the commands of generally available remote meeting facilities like Zoom, Teams and similar products that may arise in the future. See New York City Bar Ass’n Pro. Ethics Comm. Op. 2024-5, note 1, supra.

[15] This is so, given the well-recognized tendency of AI tools to “hallucinate” non-existent sources or inaccurate information. Attorneys may not rely on AI-generated information without independently verifying it. For example, in many recent cases attorneys have faced the possibility of sanctions for failing to independently verify the accuracy of information generated by AI tools and citing nonexistent sources in their submissions to courts. See, e.g., Rotonde v. Stewart Titles. Ins. Co., 86 Misc. 3d 1213(A) (Sup. Ct. Westchester Co. 2025) (declining to impose sanctions); Matter of Samuel, 82 Misc. 3d 616, 620 (Surrogate’s Ct., Kings Co. 2024) (striking pleadings and scheduling hearing on possible sanctions); Benjamin v. Costco Wholesale Corp., 779 F. Supp. 3d 341, 351 (E.D.N.Y. 2025) (imposing sanctions); United States v. Cohen, 724 F. Supp. 3d 251, 258-60 (S.D.N.Y. 2024) (declining to impose sanctions); Mata v. Avianca, Inc., 678 F. Supp. 3d 443, 459-66 (S.D.N.Y. 2023) (imposing sanctions).

[16] As discussed in Section II. infra, a particular challenge is presented when the client wants to use the client’s own AI tool to record, transcribe, and summarize the conversation.

[17] N.Y. Rules of Pro. Conduct r. 1.1 cmt. 8 states:

To maintain the requisite knowledge and skill, a lawyer should (i) keep abreast of changes in substantive and procedural law relevant to the lawyer’s practice, (ii) keep abreast of the benefits and risks associated with technology the lawyer uses to provide services to clients or to store or transmit confidential information, and (iii) engage in continuing study and education and comply with all applicable continuing legal education requirements under 22 N.Y.C.R.R. Part 1500.

[18] Some of the issues on this list are adapted from the work of Hilary Bowman and Alex Paykin, AI is in the Room: Responsible Adoption of AI in the Virtual Attorney-Client Conversation (Powerpoint accompanying CLE Presentation for New York State Bar Association, July 29, 2025).

[19] See New York City Bar Ass’n Pro. Ethics Comm. Op. 2024-5, note 1, supra.  The Committee recognizes that AI tools may be helpful to attorneys and clients who are hearing impaired or otherwise disabled. However, the conclusions of this Opinion do not change depending on how attorneys and clients intend to use the products of AI tools.

[20] Whether the clients will be required to pay for these reviews is an additional term that will have to be negotiated.

[21] See New York State Bar Ass’n, Comm. on Pro. Ethics, Op. 1020 (2014) ¶ 10 (a lawyer “may post and share documents using a ‘cloud’ data storage tool” that does not provide “reasonable protection to confidential client information” only where “the lawyer obtains informed consent from the client after advising the client of the relevant risks”).