Guides / Is AI safe for US immigration forms?

Is it safe to use AI for US immigration forms?

It can be, if the tool is set up for the data it handles and your firm stays in control of every filing. This guide covers what the ABA and state bars say about lawyers using generative AI, what to get from a vendor, the USCIS signature rules, and why an AI tool should never sign or file.

Last updated: 17 October 2026

This guide is general information for firms, not legal or ethics advice. Your obligations depend on your state, your matter and the rules that apply to you, so confirm them with your own ethics counsel or bar.

Why immigration files need extra care

A typical immigration file can hold passport numbers and A-numbers, Social Security numbers, birth and family records, medical exam results (for example on Form I-693), arrest and conviction records and, in asylum cases, the claim itself. Exposed, that data supports identity theft, and it can put clients and their relatives at risk.

Asylum information has its own federal protection. 8 CFR 208.6 generally bars disclosure of information in or about asylum, withholding of removal and Convention Against Torture applications without the applicant's written consent. USCIS says the rule safeguards information that, "if disclosed publicly, could subject the claimant to retaliatory measures by government authorities or non-state actors in the event that the claimant is repatriated, or endanger the security of the claimant's family members who may still be residing in the country of origin" (USCIS fact sheet).

California's privacy law also treats this data as sensitive. The CCPA lists Social Security and passport numbers, and "citizenship or immigration status," as sensitive personal information (Civil Code section 1798.140(ae)).

For lawyers, the baseline is Model Rule 1.6, which covers "all information relating to the representation of a client, regardless of its source" (ABA Formal Opinion 512).

Is it ethical to use AI for immigration forms?

Bar guidance so far allows it and applies the existing rules of professional conduct. The Florida Bar's Opinion 24-1 says lawyers may use generative AI in the practice of law, but must protect confidentiality, provide accurate and competent services and avoid improper billing. The duties stay with the lawyer.

ABA Formal Opinion 512 (July 29, 2024)

The ABA's Standing Committee on Ethics and Professional Responsibility applied the Model Rules to generative AI in Formal Opinion 512. We found no later ABA formal opinion on the subject. Its main points:

• Competence (Rule 1.1). Lawyers "need not become GAI experts," but "must have a reasonable understanding of the capabilities and limitations of the specific GAI technology" they use. Relying on output "without an appropriate degree of independent verification or review of its output" could violate the duty, and "lawyers may not abdicate their responsibilities by relying solely on a GAI tool to perform tasks that call for the exercise of professional judgment."
• Confidentiality (Rule 1.6). "As a baseline, all lawyers should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool," or consult someone who has. For self-learning tools whose output could reveal client information, the opinion says a client's informed consent is required before client information goes in, and that "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient." Whether a given vendor falls inside that, for example because it does not train on your data, turns on its terms.
• Communication (Rule 1.4). Disclosure depends on the facts, but lawyers must tell clients about AI use if asked, if the engagement terms require it, if consent is needed under Rule 1.6, if the tool's output will influence a significant decision, or if its use is relevant to the fee.
• Fees (Rule 1.5). Hourly billing must reflect actual time. On flat fees, which are common in immigration work, the opinion says it "may be unreasonable" to charge the same fee for work a tool makes much faster. A third-party service charged per use can ordinarily be billed to the client at actual cost, and absent contrary disclosure "the lawyer should not add a surcharge to the actual cost."
• Supervision (Rules 5.1 and 5.3). "Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI," and supervisors must make reasonable efforts to see that lawyers and staff comply, including through training. The duties reach outside providers too: the opinion points to vendor credentials, "understanding vendor's security policies and protocols," and confidentiality agreements, and says "these concepts also apply to GAI providers and tools."
• Candor (Rules 3.3 and 8.4(c)). For court filings, "output from a GAI tool must be carefully reviewed to ensure that the assertions made to the court are not false." USCIS forms are not court filings, but the preparer's certification on the form raises the same review question (see below).

State bar guidance

State opinions follow the same pattern. They are advisory unless your state adopts them as rules (Florida's says "Advisory ethics opinions are not binding"), and your own state's rules are what bind you.

• California. The State Bar's 2026 Practical Guidance replaces its 2023 version and addresses agentic AI. It says "A lawyer's professional judgment cannot be delegated to AI and remains the lawyer's responsibility at all times," and "Reasonable efforts require more than reliance on generalized marketing assurances." On autonomous tools: "Lawyers must not deploy agentic systems in a manner that allows the system to make substantive legal determinations, communicate legal advice, prepare and file pleadings, or otherwise act in a representative capacity without meaningful lawyer supervision and review." California has also proposed amending the comments to Rules 1.1, 1.4, 1.6, 3.3, 5.1 and 5.3 to address AI. When we checked, they were still proposals: a second public comment period closed on August 6, 2026.
• Florida. Opinion 24-1 (January 19, 2024) tells lawyers to protect confidentiality "by researching the program's policies on data retention, data sharing, and self-learning," and says "it is recommended that a lawyer obtain the affected client's informed consent prior to utilizing a third-party generative AI program if the utilization would involve the disclosure of any confidential information."
• Texas. Opinion 705 (February 2025) says that with any generative AI tool "the lawyer should be reasonably satisfied that the program will not reveal confidential information to others or permit the use of such information to the disadvantage of the client," and that "lawyers are responsible for the work product they submit regardless of who (or what) does the original research and drafting."
• New York. The City Bar's Formal Opinion 2024-5 (August 7, 2024) also applies the existing New York Rules to generative AI, including confidentiality, competence and supervision.
• Alabama. Formal Opinion 2026-01 says AI "does not create new ethical duties for lawyers" and relies on the ABA's Opinion 512 for the point that lawyers remain fully responsible for the work.

Other states have issued guidance too. Check your own bar's website for the current position.

AI in immigration practice: EOIR and recent discipline

• EOIR. Policy Memorandum 25-40 (August 8, 2025) says EOIR "has neither a blanket prohibition on the use of generative AI in its proceedings nor a mandatory disclosure requirement regarding its use," but individual adjudicators may adopt standing orders, and attorneys who submit hallucinated or erroneous AI-generated content to an Immigration Court or the BIA "may be subject to discipline." The memo is guidance for EOIR adjudicators and cites ABA Formal Opinion 512.
• Ninth Circuit. In Lnu v. Blanche (June 3, 2026) the court sanctioned two attorneys $2,500 each and suspended them from practice before that court for six months over briefs with nonexistent cases and misrepresented authorities, and over their lack of candor about the cause. It added: "We do not sanction [the attorneys] for the simple fact that they or their subordinates used generative AI."
• Board of Immigration Appeals. In Matter of Sethi, 30 I&N Dec. 112 (decided October 1, 2026), the Board imposed reciprocal discipline: a six-month suspension from practice before the Board, the Immigration Courts and DHS, which includes USCIS. The Board wrote that "an attorney must conduct himself or herself in accordance with governing rules of professional conduct regardless of the tools he or she uses to prepare and present cases."

Both cases concern court briefs, not USCIS forms. They show how regulators treat the lawyer who signs. Discipline before DHS is not limited to attorneys: 8 CFR 292.3 lets DHS and the Board sanction any "practitioner," meaning an attorney or representative as defined in 8 CFR 1.2, on the grounds in 8 CFR 1003.102.

We have not found any USCIS rule or form instruction written specifically for AI-assisted form preparation. The existing signature, preparer and false-statement rules below apply.

What to get from an AI vendor

Opinion 512 says the duties that apply when outsourcing legal and nonlegal services apply to AI providers. In practice, ask for these terms in writing:

1. Use limits. The vendor processes client data only to provide the service, on your instructions. No sale, no sharing, no training on your data.
2. Sub-processors. A list of every provider that touches client data, what each does, where it is located, and advance notice of changes.
3. Data location. Where documents are stored and processed, including at the AI model provider. California's guidance lists "cross-border data transfer laws" among the legal issues to consider.
4. Retention and deletion. The opinion says to "determine whether the [GAI tool] retains information submitted by the lawyer before and after the discontinuation of services or asserts proprietary rights to the information." Ask what is kept, for how long, and how data is returned or deleted when you leave.
5. Breach and legal-process notice. The opinion says the obligation of confidentiality should be enforceable and that "the lawyer will be notified in the event of a breach or service of process regarding production of client information."
6. Security and audit. The opinion says to investigate the tool's "reliability, security measures, and policies," including limits on the vendor's liability. Ask for a security questionnaire response and an audit right.

State privacy laws add contract terms of their own. Under the CCPA, a "service provider" is a person that processes personal information on behalf of a business under a written contract that prohibits selling or sharing it, using it for any purpose other than the business purposes in the contract, using it outside the direct business relationship, and combining it with other data. A service provider that engages another person must notify the business and bind that person by written contract (Civil Code section 1798.140(ag)).

The CCPA applies to for-profit businesses that do business in California and meet a threshold, such as annual gross revenue above $25 million (as adjusted) or buying, selling or sharing the data of 100,000 or more consumers or households. Many smaller firms fall below those thresholds, so confirm with your adviser. These are sensible terms to ask for either way.

What to check before you upload a client's file

1. Client consent and notice. Does your engagement letter and client communication cover this tool? Opinion 512 says boilerplate is not enough where informed consent is required, and Florida recommends informed consent before confidential information goes to a third-party AI program. Check your own state's position.
2. Is there a written service-provider agreement? It should limit the vendor to your instructions and cover the terms in the section above.
3. Is client data used for training? The answer should be no, in writing.
4. Where is data stored and processed? Ask about every provider that sees client documents, including the AI model provider.
5. How long are documents kept? The shorter the better. Ask what happens to originals, extracted data, drafts, logs and backups.
6. Who reviews the output? A licensed attorney or accredited representative at your firm should check every extraction and every completed form before the client signs.
7. Can it sign, file or log in to government accounts? It should not be able to.
8. Does your firm have an AI policy and training? Rules 5.1 and 5.3 put that on managers and supervisors.
9. What evidence of security can the vendor show? Questionnaire answers, certifications, a written risk assessment and an audit right. Note what it does not have.
10. How will you bill for it? Decide before you use it whether the cost is overhead or an expense, and whether flat fees still make sense.

Document deletion

The safest copy of a passport is the one that no longer exists. A form-filling tool needs the documents only long enough to read the details out of them. After that, the extracted summary is what your team reviews and what fills the form.

Look for a tool that deletes originals as soon as they have been read, deletes the remaining working data shortly after the form is drafted, and has a backstop for runs that fail halfway. Your firm keeps its own file in its own systems, as it does now.

Why AI should never sign or file

USCIS signature rules

Under 8 CFR 103.2(a)(2), an applicant or petitioner "must sign his or her benefit request." By signing, the signer certifies under penalty of perjury that the request and all evidence submitted with it is true and correct. An acceptable signature is "either handwritten or, for benefit requests filed electronically as permitted by the instructions to the form, in electronic format."

The USCIS Policy Manual (Volume 1, Part B, Chapter 2) adds that a valid signature is a handwritten mark showing that the person knows the contents of the request, has reviewed and approves the information, and certifies under penalty of perjury that it is true and correct. "USCIS does not accept signatures created by a typewriter, word processor, stamp, auto-pen, or similar device." Attorneys, accredited representatives, preparers and interpreters "generally may not sign a benefit request, or associated documents, for a requestor." A photocopy, scan or fax of an originally signed form is fine. An image of a signature affixed separately to an unsigned form is not.

An invalid signature gets the filing rejected or denied. A rejected request "will not retain a filing date," and a rejection cannot be appealed. USCIS "does not provide an opportunity to replace, correct, or cure a deficient signature." Under a DHS interim final rule effective July 10, 2026, for requests submitted on or after that date, USCIS may reject or deny a request it already accepted if it later finds the signature invalid, and if it denies, "USCIS may retain the associated benefit filing fee." The rule's preamble lists what USCIS commonly sees, including stamped signatures, applications "signed by someone other than the requestor (attorney, preparer, or interpreter)," and "signatures created by signature software programs."

For online filing, the preamble says the requestor's valid signature is a secure electronic signature prompted during the process in myUSCIS, and that "no electronic signature option is currently available for attorney-filed PDFi submissions." Check the current instructions for the route you use.

Preparer, interpreter and G-28

USCIS forms carry separate certifications for the people who help. On Form I-485 (Edition 09/18/26), the applicant certifies "under penalty of perjury" that they "provided or authorized all of the responses and information." The preparer certifies that they "prepared this application for the applicant at his or her request and with express consent and that all of the responses and information contained in and submitted with the application are complete, true, and correct and reflects only information provided by the applicant."

The Form I-130 instructions say that "Anyone who helped you complete this petition MUST sign and date the petition," and that "A stamped or typewritten name in place of a signature is not acceptable." Those certifications are made by people. A tool cannot make them for you.

Form G-28 does not change this. The Policy Manual says "A Form G-28 by itself does not authorize a representative to sign a request or other document on behalf of a person or legal entity." A notice of representation that is not properly signed is processed "as if the notice had not been submitted" (8 CFR 103.2(a)(3)).

Accuracy and the cost of getting it wrong

AI tools make mistakes: a misread date, a name in the wrong order, a missed trip abroad. Those are catchable when an attorney reviews the completed form before the client signs. They are much harder to fix afterward.

Under 8 CFR 103.2, filing fees "generally are non-refundable regardless of the outcome of the benefit request." A Request for Evidence allows at most twelve weeks to respond and a notice of intent to deny at most thirty days, and "Additional time to respond ... may not be granted." A request left unanswered may be "summarily denied as abandoned." The Policy Manual adds that the signer "may be held accountable for any fraud or material misrepresentation associated with the benefit request."

As the Ninth Circuit put it in Lnu v. Blanche, "the rules are not violated at the point of research and drafting, but at the point of signing and filing." That was said about court briefs, but it describes where the responsibility sits for any filing. A tool that signs or files, or that logs in to a client's USCIS account, removes the review that these rules and certifications assume a person performs. A tool that stops at an unsigned draft keeps your firm's review, and the client's own signature, as the final controls.

How Aion handles this

• Your firm controls client data, Aion is your service provider. We use client data only to prepare the forms you ask for, and never sell it or use it for advertising. The terms are in the data processing agreement in Schedule 1 of our Terms. Aion Automation LTD is a UK company that applies UK GDPR standards to its processing, and the agreement is also intended to meet the service-provider contract requirements of US state privacy laws.
• Attorney confirmation before each application. The user confirms they are a licensed attorney, a DOJ-accredited representative, or acting under the supervision of one, that they have the client's consent to process the documents they upload, and that they have given the client notice of Aion's processing as a service provider acting on their instructions.
• Documents are deleted on extraction. Documents travel over TLS into a private, encrypted AWS S3 bucket in us-east-1 (N. Virginia) and are never kept on the web server. Originals are deleted as soon as extraction succeeds. Everything else about an application is deleted within 24 hours, with an automatic 2-day deletion rule on the bucket as a backstop. Encrypted hosting backups rotate out after about seven days.
• Each application runs in its own single-use container, which is destroyed when the work ends. The US service runs no web browser and holds no government-account credentials.
• Documents are data, never instructions. The AI that reads documents has no tools, and a person reviews its output before any form is drafted.
• No training on client data. We use Anthropic's Claude through its commercial API, under terms where Anthropic does not train its models on our data. Our providers are in the United States, apart from Crisp support chat, which is in the EU. Every sub-processor is listed in Schedule 1 of the Terms.
• Access control. Sign-in is by Google or a single-use email link that expires after 15 minutes, and every application is checked against its owner on every request.
• Two human checkpoints. Your team reviews the extracted summary before anything is filled, and reviews the filled PDF before it is signed. Values the AI is unsure of or could not find are outlined in red and listed.
• Aion never signs and never files. It never logs in to myUSCIS or any USCIS account. It returns an unsigned draft of the official USCIS form, so the signatures and the filing stay with the people who must make them.
• Contract terms. The agreement commits us to notify you without undue delay of a personal data breach affecting your data, to give 14 days' notice of new sub-processors, to delete or return your data at the end and certify it in writing, and it gives you an audit right.
• Honest gaps. The US service is in beta. Aion does not yet hold SOC 2 or ISO 27001 certification, and we are reviewing both. Our own risk assessment rates AI error in a draft as a medium residual risk, falling to low with attorney review. We will complete your security questionnaire and share our full risk assessment on request.

The full detail is in our security and data protection summary. How we handle personal data about you and your firm is in our privacy notice.

Sources: ABA Formal Opinion 512 · State Bar of California: Practical Guidance (2026) · State Bar of California: proposed rule amendments · Florida Bar Opinion 24-1 · Texas Opinion 705 · NYC Bar Formal Opinion 2024-5 · Alabama State Bar Formal Opinion 2026-01 · EOIR PM 25-40 · Lnu v. Blanche (9th Cir. 2026) · Matter of Sethi (BIA 2026) · 8 CFR 103.2 · 8 CFR 292.3 · 8 CFR 208.6 · USCIS Policy Manual, Vol. 1, Part B, Ch. 2 · DHS interim final rule on signatures (91 FR 25479) · USCIS Form I-485 · Form I-130 instructions · USCIS asylum confidentiality fact sheet · California Civil Code section 1798.140.