← All articles2026-05-18 · 9 min read

Is my AI legal assistant practising law without a license?

If you vibe-coded a tool that drafts contracts, files small-claims paperwork, or answers legal questions, the question isn't whether UPL law applies to you — it's whether you've crossed the line your state's bar uses to decide. Here's the actual test, the language that gets investigated, and the mitigations the legal-tech category has converged on.

The short answer

Unauthorised practice of law (UPL) is illegal in every US state. The statutes are old — they were written before software existed — but state bar UPL committees have applied them to software-mediated services for two decades. The defining cases are LegalZoom (multiple state-bar settlements, 2008–2015), Avvo (settled with NY in 2013), and the FTC's 2023 consent order against DoNotPay. The pattern is consistent: a state bar (or the FTC) brings a complaint when a non-attorney service appears to provide legal advice or representation, and the operator either settles, restructures, or shuts down.

50
US states with UPL statutes
3
States with most-active UPL committees (CA, NY, FL)
$0–$25K
Typical pre-suit UPL settlement range
C-and-D
Most common first contact (cease-and-desist letter)

The test state bars apply

There's no single national UPL test, but the cluster of state-bar opinions converges on three questions. Your AI legal tool is at material UPL risk if it answers "yes" to two or more.

  1. Does the tool provide legal information tailored to a specific user's situation? (Generic legal information is fine; "based on what you described, you should…" is the line.)
  2. Does the tool represent the user — draft a filing, send a demand letter, negotiate with a third party — without an attorney's review?
  3. Does the marketing imply equivalence to or replacement of an attorney? ("AI lawyer", "replaces your attorney", "win your case".)
The DoNotPay test

The FTC's 2023 consent order against DoNotPay (and the parallel state bar complaints) all cited the same three patterns: marketing as "the world's first robot lawyer," providing advice without attorney review, and operating without bar admission while taking action on the user's behalf. DoNotPay settled at $193K (FTC), restructured the product, and added prominent disclaimers. They're still operating — UPL isn't necessarily fatal, but it's expensive to get wrong.

The language that triggers investigations

State bar UPL committees almost never investigate code — they investigate marketing copy and user-facing language. The phrases below appear in the majority of state-bar UPL complaint records against software-mediated services. If your home page or product copy contains these, you are an above-baseline UPL investigation target.

  • "AI lawyer" / "AI attorney" / "virtual lawyer" — direct claims to be a lawyer trigger immediate state-bar attention
  • "We'll file your case" / "We'll represent you" / "We'll negotiate for you" — active representation language is the operative UPL act in most state statutes
  • "Replaces your lawyer" / "Same as a lawyer" — equivalence claims contradict every state's licensure regime
  • "Our legal advice" / "Get legal advice" — "legal advice" is a term-of-art that bars treat literally
  • "Win your case" / "Beat the IRS" / "Defeat your landlord" — outcome-promise language has been cited in FTC actions

What survivors do differently

The legal-tech category has converged on a recognisable disclaimer-and-framing pattern. LegalZoom, Rocket Lawyer, Clerky, Atrium (RIP), and the document-automation incumbents all carry essentially the same language. It's not bulletproof, but it's the established floor — a product without it stands out as the easier UPL investigation target.

  1. A persistent "not legal advice" disclaimer on every page that generates or displays legal content
  2. An "information, not advice" framing for everything the tool produces — outputs are documents the user reviews, not actions the tool takes
  3. An explicit "no attorney-client relationship" disclaimer in terms of service and at the point of output
  4. A jurisdictional scope statement ("available to US users; outputs are general legal information, not state-specific advice")
  5. Human attorney review available as an upsell (the Rocket Lawyer / LegalZoom model) — converts the tool from "alternative to a lawyer" to "front end for a lawyer"
  6. Marketing that frames the product as document generation or research, not legal services

State-by-state risk heatmap

UPL enforcement is uneven across states. The three states below run active UPL committees that publish opinions, investigate complaints proactively, and have institutional memory of software-mediated services. If your tool reaches users in these states (and most do), they're the primary risk vectors.

  • California — the State Bar's UPL committee is the most institutionally aggressive. Multiple opinions about software-mediated legal services. The bar maintains a public UPL complaint intake.
  • New York — historically pursued software-mediated services (Avvo settled with NY's AG in 2013; LegalZoom faced multiple NY-specific challenges). The NY State Bar's Committee on Professional Ethics issues regular UPL opinions.
  • Florida — Florida's Bar has its own UPL committee with separate prosecution authority. Florida is a notable outlier because UPL there is criminally prosecutable (third-degree felony under Fla. Stat. §454.23).
  • Texas, Pennsylvania, Massachusetts — less aggressive but not dormant; have brought UPL cases against software products in the last five years.
  • Most other states — UPL statutes exist but enforcement is reactive; complaints get investigated but proactive sweeps are rare.

What about the FTC?

The FTC isn't a state bar but has emerged as the federal enforcement layer against AI legal products that overclaim. The DoNotPay action (2023, $193K settlement) was brought under Section 5 of the FTC Act for deceptive marketing — specifically the "world's first robot lawyer" framing. The FTC's posture is consistent: marketing that overstates the legal capability of an AI tool is enforceable as a UDAP (unfair or deceptive acts or practices) violation regardless of UPL.

The implication for vibe-coded operators: even if you avoid state-bar UPL exposure by carefully framing your service, FTC overclaim risk applies to your marketing copy independently. Both layers are real.

What to do this week

  1. Audit your home page, marketing site, and chat interface for the trigger phrases above. Replace them with information-only framing.
  2. Add the two standard disclaimers — "not legal advice" and "no attorney-client relationship" — to every output page and in the chat interface header.
  3. Add a jurisdictional scope statement to your footer or About page.
  4. If you have institutional appetite, consult a lawyer admitted in CA, NY, and FL specifically — those are the states whose UPL committees you most need to satisfy.
  5. Re-scan after each change. Comply Code's professional-licensing rule pack flags exactly the patterns described in this article.
More: compliance scanning for AI legal tools →

Common questions.

Does UPL apply to my AI legal tool if I'm not a lawyer?

Yes — that's exactly when it applies. UPL statutes prohibit non-attorneys from practising law. If your software provides advice specific to a user's situation, takes action on the user's behalf (drafting filings, sending demand letters, negotiating), or markets itself as a lawyer, state bars treat it the same way they treat a non-attorney human doing the same thing.

Can I just put a disclaimer at the bottom of my page?

A disclaimer alone isn't sufficient if the product behaviour contradicts it. State bars and the FTC look at how the product actually functions and how it's marketed. A 'not legal advice' disclaimer next to copy that says 'AI lawyer that will file your case' is not protective. The disclaimer matters; the underlying framing matters more.

What about LegalZoom — how are they legal?

LegalZoom settled multiple state-bar UPL challenges (NC, SC, OH, MO, AR, WA, CA among others) over 2008–2015, paid fines, and restructured the product. The current model carefully avoids the UPL triggers: documents are 'self-help' forms, not 'legal advice'; human-attorney consultations are available as an explicit upsell; marketing avoids equivalence claims. The fact that they survived UPL challenges isn't because the statutes don't apply — it's because they restructured to satisfy them.

What's the worst-case scenario if I get a UPL letter?

Most state-bar UPL investigations resolve with a cease-and-desist letter and product restructuring — not a fine. Florida is the notable exception (third-degree felony, theoretical 5-year imprisonment, though prosecutions are rare). The realistic worst case for most operators: a letter requiring product changes and disclaimers within 30 days, plus public listing in the bar's UPL opinion record (which becomes a permanent search-result for your company name).

Does Comply Code's scanner detect UPL exposure?

Yes — when our scanner classifies your site as a legal-services vertical, it runs a UPL rule pack that flags the trigger phrases described in this article, checks for missing disclaimers, and looks for jurisdictional scope statements. Findings are categorised under 'professional licensing' in the report.

Related reading.

Sources

Want to find out which of these apply to your app?

Paste your URL. 60 seconds. Free.

Scan your app →