Ask ten small firm owners what technology they run and you get ten different lists, most of them assembled the same way. Something came bundled with a bar association membership. Something was recommended at a CLE by a speaker who was selling it. Something was bought during a bad month and never turned off. The result is a stack nobody designed, which usually costs more than it should and still leaves the one job that matters undone. The more useful way to think about law office technology is not as a list of products. It is a short list of jobs your firm has to do every week, and a decision about which of those jobs a piece of software will do instead of you.
Key takeaways
- A small firm stack has to cover six jobs: matter records, calendar and deadlines, documents, time and billing, trust accounting, and client communication. Products are interchangeable. The jobs are not.
- The conduct rules set the floor before any vendor does. Competence expressly includes keeping abreast of the benefits and risks associated with relevant technology, and confidentiality requires reasonable efforts against unauthorized access.
- Trust records may be kept electronically, but they must be retained at least seven years, reconciled as often as statements are generated or at minimum quarterly, and backed up frequently.
- Cloud tools are already the norm at this size. 79 percent of solos and 81 percent of small firms use cloud-based practice management software, against 47 percent of larger firms.
- Artificial intelligence is widely tried and narrowly deployed: 72 percent of solos use it in some capacity, and 8 percent have adopted it widely.
- Software is a small line item. Small firms spend about 2 percent of overall expenses on it, solos roughly half that. The expensive part is rarely the subscription.
The short answer: six jobs, not sixty tools
Every functioning law firm, whatever it runs, does the same six things with information. It keeps a record of who the clients are and what matters are open. It tracks dates that carry consequences if missed. It creates, stores, and finds documents. It records time and produces bills. It holds other people’s money separately and accounts for it. And it receives, answers, and logs communication from clients and prospective clients.
That list is the actual specification. Notice what it does not contain: any product name, any category label a vendor invented, and any reference to whether the thing runs in a browser or on a machine under your desk. Those are implementation details. A firm running a well-kept spreadsheet, a shared calendar, and a disciplined folder structure is covering four of the six jobs, which is four more than a firm running an expensive platform nobody has finished configuring.
The question to ask of any piece of software, before the demo and before the price, is which of the six it does and whether anything else you already pay for does the same job. Most small firm stacks fail one of two ways. Either a job is uncovered, usually deadlines or trust accounting, and the failure surfaces as a missed date or a reconciliation that will not balance. Or three products cover the same job at once, which is how firms end up with client contact details in a practice management system, a billing tool, and a phone app, none of which agree.
Coverage without duplication is the whole design goal. One system can honestly do several of the six, and that consolidation is the main argument for practice management software as a category. But nothing here requires you to buy the largest system available. It requires you to be able to name, for each of the six jobs, the one place where that job lives.
The rules set the floor before any vendor does
Technology decisions at a law firm are governed decisions, which is the part vendor material tends to leave out. Two rules do most of the work, and a third dictates what your accounting software has to be able to produce.
The first is competence. The comment to the competence rule, as adopted in Washington and in substantially similar form across most states, says that to maintain the requisite knowledge and skill a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology. That language does not require you to be an early adopter. It cuts the other way just as often, since the risks are named alongside the benefits. What it does mean is that not understanding how your own systems handle client information has stopped being a neutral fact about you.
The second is confidentiality. Washington’s RPC 1.6(c) puts it plainly: a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Reasonable is defined by a list of factors in the comment, which include the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing them, the difficulty of implementing them, and the extent to which safeguards would make a device or an important piece of software excessively difficult to use. That last factor is worth sitting with, because it acknowledges what every firm discovers eventually: a control nobody can work with is a control nobody uses.
The third is records. Trust account records may be kept in electronic or manual form, but they must be retained for at least seven years, and the rule enumerates exactly what they must contain, including a check register, individual client ledgers, and copies of all reconciliations.
| What the rule requires | What your stack has to be able to do |
|---|---|
| Competence includes the benefits and risks of relevant technology (RPC 1.1, comment 8) | Let you explain, without help, where client data sits and who can reach it |
| Reasonable efforts against unauthorized access or disclosure (RPC 1.6(c)) | Support access controls you will actually keep switched on |
| Trust records in electronic or manual form, retained at least seven years (RPC 1.15B(a)) | Export a complete, readable record that outlives the subscription |
| Individual client ledger records showing every receipt, disbursement, and transfer (RPC 1.15B(a)(2)) | Keep a per client balance, not just an account balance |
| Reconciliation as often as statements are generated, at minimum quarterly (RPC 1.15A(h)(6)) | Produce a three way reconciliation you can save and store |
| Frequent, preferably daily backups where trust records are computerized (RPC 1.15B, Washington comment 2) | Back up automatically, and let you verify that it happened |
Rules are numbered by state and the wording varies, so read your own jurisdiction’s text rather than this table. The pattern, though, is consistent enough to design against: the rules care about what your systems can produce and protect, not about which brand produced them. A firm using a general ledger tool and a disciplined manual process can satisfy every line above. A firm using the most expensive legal-specific platform on the market can fail all of them by never running the reconciliation. Our companion piece on law firm trust accounting works through the compliance system itself, and the IOLTA account explainer covers where the interest goes and why.
What small firms actually run
The stereotype of the technologically reluctant solo has aged badly. In Clio’s 2025 research on solo and small firms, cloud-based practice management software was in use at 79 percent of solos and 81 percent of small firms, against 47 percent of larger firms. On this one measure the small end of the profession is roughly thirty points ahead of the large end, which is the reverse of the usual story and has a simple explanation. A two-lawyer firm has no server room, no IT staff, and no incentive to keep either.
The rest of the picture is similarly saturated. Cloud data storage sits at 81 percent of solos and 85 percent of small firms. Video conferencing is at 80 percent for both. Electronic payment tools reach 76 percent of solos and 72 percent of small firms, and e-signature tools 72 and 78 percent respectively. These are not emerging technologies at this size. They are the baseline, and a firm without them is now unusual rather than merely conservative.
The six systems, and what breaks without them
Coverage is easier to audit than it sounds. Take each of the six jobs, write down the single product or process that owns it, and then write down what the first visible symptom would be if that owner quietly stopped working. The symptom column is the useful one, because failures in a small firm rarely announce themselves as technology problems. They announce themselves as an angry client, a bar complaint, or a month where the money does not add up.
Run the exercise on paper first, and run it for the firm as it operates today rather than as you intend to operate it next quarter. Owners consistently name the system they bought rather than the system they use, which is how a firm ends up believing its deadlines are docketed in a practice management platform when in practice they live in one person’s phone. If the honest answer to a job is a person rather than a product, write the person’s name down. That is a legitimate answer at this size, and it is far better than a product name that describes an intention. It also tells you something useful immediately, because a job owned by a single person is a job that stops the week that person is out.
| Job | What usually owns it | First symptom when it is uncovered |
|---|---|---|
| Matter and client records | Practice management software, or a single maintained list | Two people give a client different answers about the same matter |
| Calendar and deadlines | A shared calendar with docketing rules, ideally with a second reminder | A date is met at the last minute, then one is not met at all |
| Documents | Cloud storage with one naming convention, or a document management system | Time spent looking for the current version of something you wrote |
| Time and billing | Timekeeping in the same place the work happens, plus invoicing | Reconstructed timesheets, then write-downs you cannot explain |
| Trust accounting | Software producing per client ledgers and three way reconciliations | A reconciliation that will not balance, discovered late |
| Communication and intake | A phone and messaging setup where every enquiry lands in one queue | A prospective client who called twice and was never called back |
Two of the six deserve a note. Trust accounting is the one job where general business software most often falls short, not because it cannot hold the numbers but because the per client ledger and the three way reconciliation are not native concepts to it. That is a real argument for legal-specific software, and it is a narrower argument than the one usually made, since it applies to one job rather than to your entire operation.
Intake is the opposite case. It is the job most likely to be uncovered entirely, and the least likely to be fixed by buying something. Clio’s 2025 research reported 53 percent higher revenue among solos and 28 percent higher revenue among small firms using e-signatures, online search ads, online schedulers, online intake forms, and text messaging. Read that as an association between firms rather than a promise about what installing a tool will do, because the underlying discipline is answering quickly and following up. The tools make a working process faster. They do not create one. Our law firm intake process guide covers the sequence itself.
The same research recorded improved conversion rates among solo and small firms using e-signatures, 10 percent for each group, and a 48 percent increase in client leads for solos against 6 percent for small firms using the same set of features. The gap between those two lead figures is the interesting part, and the likeliest reading is that solos were starting from a much thinner intake process, so the tools had more to fix. A firm that already answers its phone and follows up the same day has less headroom to gain, which is another way of saying the process is doing the work.
What you can skip
The honest half of any technology conversation is the subtraction. Several categories that are heavily marketed to small firms are, for most of them, optional, premature, or already covered.
Anything that duplicates a job already owned is the first to go. If contacts live in three systems, two of those are not features, they are liabilities, because the moment they disagree you have no way to know which one is right. The second category is capability bought for a volume you do not have. Document automation earns its keep when you produce the same instrument repeatedly, and litigation-scale document review tools assume a document population most small firms will never see. Buying either early means paying to maintain a configuration you are not exercising.
The third is the analytics layer. Dashboards are the easiest thing to sell an owner who suspects the firm could be run better, and the least likely to change anything, because a small firm’s numbers are small enough to read directly. If you have fifteen open matters, you do not need a visualization of them. You need to look at the list.
Cost is worth putting in proportion here. Clio’s 2025 data puts software at roughly 2 percent of overall expenses for small firms, and about half that for solos. Software is not what is making your firm expensive to run. What it can cost you sits off the invoice entirely: the weeks of migration, the double entry while two systems run in parallel, the training you never finished, and the exit cost if your records are difficult to extract. When we look at how to weigh those, we cover it in the piece on choosing law practice management software, which treats selection as a requirements problem rather than a product comparison.
Where AI fits right now
The gap between trying and deploying is the most useful number in the current data, and it is large. Clio’s 2025 research found 72 percent of solos and 67 percent of small firms using AI in some capacity, while only 8 percent of solos and 4 percent of small firms had adopted it widely or universally. Larger firms show the same shape at a higher level, 85 percent using it in some capacity and 35 percent widely.
Read that as a maturity signal rather than a hesitation signal. Nearly everyone has opened the tool. Very few have rebuilt a process around it, which is what widespread adoption would mean. Where it is being used, the most common categories among solo and small firms are generic tools not built for law, at 57 percent of solos and 54 percent of small firms, and legal research platforms, at 54 and 56 percent. Document drafting and automation trails at 25 and 30 percent, and virtual receptionists at 27 and 16 percent.
The benefits practitioners report are about time rather than transformation. Saving time and increasing efficiency was cited by 61 percent of solos and 63 percent of small firms, saving money by 37 and 34 percent, and improving the quality of work by 36 and 34 percent. That is a productivity story, and it fits the competence comment’s framing precisely: benefits and risks together, understood by the person responsible for the work product.
The security floor is three controls
Security guidance aimed at law firms tends to arrive as a forty-item checklist, which is a reliable way to ensure nothing gets done. Three controls carry most of the load at small firm scale, and each maps directly to an obligation you already have.
Multifactor authentication comes first, on email above all. The Cybersecurity and Infrastructure Security Agency describes it as a layered approach in which a compromised password is not enough on its own, and specifically advises enforcing it on internet-facing systems such as email, remote desktop, and virtual private networks. The threat this addresses is not hypothetical for firms that move money. The FBI’s Internet Crime Complaint Center recorded 21,442 business email compromise complaints in 2024, with reported losses of about $2.77 billion, and the pattern in those cases is a legitimate mailbox being read or impersonated before a payment instruction changes.
Backups come second, and the trust rules say so directly. Washington’s comment to the required records rule states that if trust records are computerized, a system of regular and frequent, preferably daily, backup procedures is essential. The word doing the work there is verify, which the rule does not say but practice demands: an unverified backup is a belief, not a control.
Third is knowing where the data actually lives and what your vendor agreed to. North Carolina’s 2011 formal ethics opinion on software as a service, one of many state opinions permitting cloud use with reasonable care, suggests evaluating a provider’s security measures, reviewing the terms of service, confirming that hosted data is returned or destroyed on request, and consulting periodically with people competent in online security. That last suggestion is the one small firms skip, and it costs nothing to schedule once a year.
| Control | What it is for | Where to apply it first |
|---|---|---|
| Multifactor authentication | Makes a stolen password insufficient on its own | Email, then remote access, then anything holding client files |
| Verified backups | Survives ransomware, hardware loss, and a vendor going dark | Trust records and document storage, checked on a schedule |
| Knowing where data lives | Lets you answer the competence and confidentiality questions | Written list of systems, what each holds, and who can reach it |
Buy it in this order
If you are building from nothing or rebuilding after a bad year, sequence matters more than selection. Start with the two jobs whose failures are unrecoverable: deadlines and trust accounting. A missed limitation period and a trust shortfall are not inconveniences, they are the two failures most likely to end a practice, and both are cheap to cover early.
Both are also unusual in that adequate coverage does not depend on spending much. A shared calendar with a written docketing rule, a second reminder on anything jurisdictional, and one person responsible for entering dates will cover the deadline job at a two-lawyer firm. Trust accounting has a harder floor because of the per client ledger and the reconciliation, but the requirement is a defined output rather than a particular product, and it is a requirement whether you have one trust matter or two hundred. Cover those two before you spend a day comparing systems that promise to cover all six, because the comparison will take longer than the coverage does and the exposure runs the whole time. Nothing about covering them provisionally prevents you from consolidating later. It simply means that if the consolidation slips by six months, which it usually does, the two jobs that could end the practice were never the ones left waiting.
Then cover intake, because an uncovered intake job costs revenue every week it stays uncovered and the fix is mostly process. Then documents and time capture, which are where the daily friction lives. Consolidate last, once you know from experience which jobs your firm handles differently from the textbook, because that knowledge is exactly what you need in order to evaluate a system that claims to do six things at once.
Add one system at a time and let it settle before adding another. Running two migrations at once is how firms end up with the worst version of both, and the cost of a stalled migration is not the subscription, it is the months where nobody trusts either system’s numbers. The operations chapter of our guide to running a law firm sets this in the wider context of how the firm is managed.
Frequently asked questions
Enough to cover six jobs: matter and client records, calendar and deadlines, documents, time and billing, trust accounting, and client communication and intake. One product may cover several of them. What matters is that each job has exactly one owner, so nothing is uncovered and nothing is duplicated across three systems that then disagree with each other.
The comment to the competence rule, as adopted in Washington and in similar form in most states, says a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology. Separately, RPC 1.6(c) requires reasonable efforts to prevent unauthorized access to or disclosure of client information. Neither requires you to adopt any particular tool, and both assume you understand what the tools you do use are doing with client data. Check your own jurisdiction’s wording, since the rules are numbered and phrased differently by state.
Yes. Washington’s RPC 1.15B states that trust account records may be in electronic or manual form, and must be retained for at least seven years. The rule then lists what those records must include, among them a check register, individual client ledger records, and copies of all reconciliations. Trust records must be reconciled as often as bank statements are generated, or at least quarterly. The Washington comment adds that where trust records are computerized, regular and frequent backups, preferably daily, are essential.
State ethics opinions have generally permitted cloud storage where the lawyer exercises reasonable care. North Carolina’s 2011 formal ethics opinion on software as a service, for example, concluded a firm may use it while taking reasonable care to safeguard confidential information, and suggested evaluating the provider’s security measures, reviewing the terms of service, confirming that hosted data is returned or destroyed on request, and consulting periodically with professionals competent in online security. Adoption at this size is already high: 81 percent of solos and 85 percent of small firms reported using cloud data storage in 2025.
Clio’s 2025 research puts software at roughly 2 percent of overall expenses for small firms, and about half that for solos. The subscription is rarely the expensive part of a technology decision. Migration time, running two systems in parallel, unfinished training, and the difficulty of extracting your records if you leave are the costs that do not appear on any invoice, and they are the ones worth estimating before you sign.
Technology at a small firm is not a spending decision, it is a coverage decision, and the two get confused constantly. The firm that can name where each of the six jobs lives, keep its trust records in a form the rules recognize, and switch on the handful of controls that make a stolen password useless is in better shape than the firm with a larger stack and no map of it. If you are working out which part of your own operation is currently the binding constraint, the five minute firm health assessment is built to point at it, and our guide to starting a law firm covers the same decisions in the order a new practice faces them.
Sources
- Clio, “Highlights From the 2025 Legal Trends for Solo and Small Law Firms Report.” clio.com
- Washington Rules of Professional Conduct, RPC 1.1 Competence, comment 8. courts.wa.gov
- Washington Rules of Professional Conduct, RPC 1.6 Confidentiality of Information, paragraph (c) and comments. courts.wa.gov
- Washington Rules of Professional Conduct, RPC 1.15A Safeguarding Property. courts.wa.gov
- Washington Rules of Professional Conduct, RPC 1.15B Required Trust Account Records. courts.wa.gov
- North Carolina State Bar, 2011 Formal Ethics Opinion 6, Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property. ncbar.gov
- Cybersecurity and Infrastructure Security Agency, Multi-Factor Authentication fact sheet. cisa.gov
- Federal Bureau of Investigation, Internet Crime Complaint Center, 2024 Internet Crime Report. ic3.gov