The globe-trotting Law via the Internet Conference returned to Canada on October 13 and 14 in Montreal. It was just in time for CanLII’s 25^th anniversary, convened under the theme of Trusted Past, Open Future to share developments and trends in the delivery of legal information across the world.

On day one, University of Ottawa law professor Amy Salyzyn updated us on her research inventorying direct-to-public digital legal tools in Canada.

The inventory is not new (it started in 2016, with updates in 2019, 2021, and 2023)—but it has certainly grown. In 2023, 118 tools were cataloged (you can see the old list here), and in 2026 it’s grown to around 180. These tools are not entirely AI-driven, and the criteria for including one is that they are digital tools for public use, meaning they are interactive rather than simply static sources of legal information (search functions and hyperlinks don’t count as interactive). The inventory also excludes tools built by ministries, courts, and administrative entities (e.g. court form completion apps from government, online tribunals), that are embedded within the justice system itself.

Prof Salyzyn’s comments toward the end of her presentation caught my attention—referencing regulatory legal innovation sandboxes and other UPL (unlicensed practice of law) policy mechanisms.

Her scholarship has studied the connection between legal regulation and AI technology, even before any significant amount of legal AI was being used by lawyers or the public. But early on she encouraged us to think of how legal regulators influence the development of the legal AI, asking how law societies can mitigate risks relating to the quality, privacy and security, and access of these tools, and to what extent it’s within their scope of authority and mandate to even do so—since protecting the lawyers’ monopoly and fostering A2J innovation are competing goals.

I captured a simple question in my notes from Prof Salyzyn’s session: “What is the future of unauthorized practice of law regulation?”

She mentioned briefly the OpenAI UPL litigation from earlier this year, which I think means the Nippon Life Insurance Company of America v. OpenAI Foundation lawsuit. I have some tie-in observations about that case and its UPL claims, but I’ll get to that shortly.

When I got home, I considered this question and concluded this was not the first time I pondered it. I thought it was worth revisiting here.

Who—or what—is practicing law?

Back in November 2017 I posted “Who Dunnit? Artificial Intelligence and Unauthorized Practice.” I led with the story of DoNotPay’s precocious founder, Joshua Browder (AKA the “Spartacus of Camden Council’s by-law enforcement division”). His ticket fighting “robot lawyer” was debuting in North America, generating forms and letters for ordinary people contesting small fines—stuff a lawyer would rarely be engaged to resolve.

I used the DoNotPay story to elaborate on my earlier Slaw post “Of Cybernetic Shysters, Artificial Intelligence and Guardians of the Rule of Law.” The thesis of that even older post (from June 2016) was that the law and policy shaping AI’s development were too important to be left to engineers and entrepreneurs alone. I raised one of the obvious gaps, looking at UPL legislation’s focus on UPL with respect to “persons”.

BC’s Legal Profession Act still states that “No person, other than a practising lawyer, is permitted to engage in the practice of law.” Carve-outs exist for self-represented, articling students, out-of-province lawyers, etc., and “practice of law” is defined to include expected activities (if offered or sold for a fee):

• Appearing as counsel
• Drafting legal documents
• Negotiating and settling claims
• Brokering another lawyer’s services
• Giving legal advice
• Representing yourself as qualified to do these things

In 2017 I asked how could an enforcement mechanism that requires “persons” to be engaged in the unauthorized practice of law snap into action when a “robot lawyer” finally did start calling the shots.

I proposed we would have a real “who dunnit” mystery when “cybernetic shysters” (non-persons, i.e. AI) began calling more shots than a mere tool does. To keep a “person” accountable for what machines end up doing, regulation should be tweaked to cover the deeds that this person actually is doing. Include persons who own/deploy/configure the code, since the doer will at some point be the code itself exercising its own algorithmic form of legal judgment. Fail to do this, and you will eventually have a remoteness problem.

Agentic AI models were not yet running amok in 2017, but the Browder story teased this possibility.

I proposed—somewhat off the cuff—an additional line could be added in the statutory definition of practice of law, after (a)-(g) in the BC legislation. Something like: “h) installing or causing to be installed a computer program that is capable of doing anything referred to in paragraphs (a) to (g), unless [carefully worded exceptions]”?

A small debate ensued in the comments. Someone pointed out my argument was flawed. People build tools, and people apply tools in work. A regulator would have little reluctance in assigning the owner accountability for an AI tool that started spewing legal advice.

I replied, “How remote are we prepared to get?”. I asked, “And in AI, who is driving the intelligence? […] at some point the concept of a ‘person’ being ‘engaged’ just like any tool-user simply won’t apply to the applications of AI.”

Wouldn’t the wording of UPL laws need some retooling to bridge this remoteness problem?

The company behind the robot lawyer

The other commenter had a fair point, at least for DoNotPay. The company was making bold representations and developing something that almost begged for the regulator’s attention. The chatbot was billed as a “lawyer”, and the company was certainly charging a fee.

Ultimately, the State Bar of California did investigate DoNotPay in November 2021, and by June 2023 it issued a cease-and-desist notice alleging UPL. The regulator demanded the company stop selling itself as the “World’s First Robot Lawyer.”

DoNotPay faced other lawsuits, plus an action from the US Federal Trade Commission which resulted in DoNotPay paying $193,000 and agreeing to stop making deceptive claims. That was consumer protection enforcement, not a UPL ruling, but if you look at the filed FTC complaint it’s pretty clear from the allegations how far DoNotPay pushed its luck.

DoNotPay was allegedly promoting concrete legal uses and benefits, and the directness was difficult to argue.

The “persons” problem returns in Nippon v. OpenAI

In 2026, we see a different challenge for UPL legislation, and a set of facts that feature the more advanced GenAI capabilities we’re now familiar with.

The Nippon Life Insurance Company of America v. OpenAI case—which Prof Salyzyn mentioned—is fascinating, and if you are not familiar with it, you can see for yourself.

The Illinois lawsuit alleges, among other torts, that ChatGPT engaged in the practice of law when it coached a woman into a questionable litigation strategy to overturn her with-settlement agreement over disability benefits.

It is a grimly enthralling case. At least two real lawyers’ lives and reputations were allegedly affected by the AI model’s ambitious (and unhinged) litigation strategy. The case is rife with alleged facts about what ChatGPT did, and if you look at the claim’s language, the pleadings strive to attribute the AI model’s actions and outputs as the “collective conduct” or “wrongful conduct” of OpenAI (the company itself).

Illinois’ UPL legislation (705 ILCS 205/1), like most, looks for the person who is “practicing, charging or receiving fees for legal services.” The plaintiff’s attorneys pleaded ChatGPT itself engaged in UPL, but as a product of OpenAI, claiming:

“As a product of OPENAI, ChatGPT engages in the practice of law by providing users with legal analysis, legal advice, legal research, and produces drafted legal documents.”

OpenAI’s lawyers fired back with a motion to dismiss, plainly pointing out that ChatGPT is not a person. Their motion’s filing says:

“B. Nippon fails to plausibly allege that ChatGPT practices law.

The Illinois Attorney Act prohibits an unlicensed “person” from “practicing, charging or receiving fees for legal services.” 705 ILCS 205/1. Again, ChatGPT and its underlying LLMs are tools, not persons.

[…]

[ChatGPT] is incapable of practicing law within the meaning of the statute.”

Displeased with that, the plaintiff reframed their position in a filed response:

“ChatGPT’s activity unquestionably constitutes the practice of law as defined by Illinois’ Attorney Act. And, as the creator, owner, administrator, and operator of ChatGPT, OPENAI is responsible and directly liable for ChatGPT’s illegal activity.”

OpenAI’s reply to that:

“Nippon argues that even though ChatGPT is not a person, OpenAI is, and it can be held liable for ChatGPT’s alleged unauthorized practice of law. But that is nothing more than circular hand-waving. Because ChatGPT is incapable of practicing law, OpenAI cannot be responsible for its alleged unauthorized practice of law.”

We shall see what happens, I guess, but my original suggestion from 2017 stands out to me. Regulators need to retool the language in UPL legislation if indeed the “creator, owner, administrator, and operator” is to be more plainly captured. If the lawsuit had been based in Colorado, I’m not sure the motion to dismiss would have been considered.

Colorado names the owner and controller

Colorado changed its UPL rules in December 2022 when it adjusted the scope of prohibited activities to include “owning or controlling a website, application, software, bot, or other technology that interactively offers or provides services involving the exercise of legal judgment.”

I won’t claim to have inspired anyone in Denver, but it appears to address the same problem I was musing over, and with largely the same solution. Their wording is reasonably close to my own suggestion for what a possible paragraph “(h)” might contain in BC’s legislation.

Colorado’s rules sanction “nonlawyers”, which are defined as persons including individuals and legal entities unlicensed to offer legal services. By expanding prohibited activities to include ownership/control of AI tools that exercise legal judgment, the new rules recognize a new reality where “persons” are not just assigning discrete tasks to an AI, but offloading the cognitive decision-making work and legal judgment to the tool.

In a time when AI models can give advice, solve problems and (if agentic) carry out multistep tasks autonomously, UPL legislation can still sanction real humans or companies who are selling unauthorized legal services, while also acknowledging that autonomous AI may be the thing performing these services, such that liability must move upstream to those who own or control the technology.

It’s worth noting that Colorado’s Access to Justice Commission expressed concern that expanding the UPL rules to cover owners and controllers could have a chilling effect on innovative legal technology development.

A couple of Colorado judges also wrote a joint article reporting concerns that the new rules could block or impede new technologies that could benefit access to justice.

The Colorado Supreme Court established an AI subcommittee to consider how UPL rules might be adjusted, or how AI-related advances might be fostered responsibly rather than impeded due to developers fears that a technological tool will cross the line into the unauthorized practice of law.

Sticks and carrots

In September 2025, Colorado balanced the risks and benefits of regulating AI in public-facing legal services. It didn’t amend the rules again, but the Colorado’s Office of Attorney Regulation Counsel adopted a novel, lightweight strategy—a three year pilot non-prosecution policy.

The history and context of this work-around by Colorado—where the regulator enters the field by asserting authority to prosecute AI tool owners and controllers (the “stick”), but adopts an official non-prosecution policy for developers who observe clear boundaries (the “carrot”)—is well explained in the IAALS and Duke report on “Prosecutorial Guidance and Non-Prosecution Policies: A Pragmatic Path Forward for AI in Legal Service.”

The policy is that the regulator will not prosecute nonlawyers for technology-enabled legal services so long as specified consumer safeguards are built in. The nonlawyer must:

• avoid specified high-risk matters,
• work under lawyer supervision or a lawyer compliance officer with quality controls,
• clearly discloses its nonlawyer status and privacy practices,
• obtain the user’s acknowledgment, and
• have none of the policy’s listed misconduct or consumer-harm red flags.

The question for British Columbia

The Colorado solution is quite different from the LSBC’s innovation sandbox initiative. BC offers a conditional, proposal-specific arrangement for innovators who apply and are approved, Colorado’s non-prosecution policy is available to anyone who meets its criteria. It needs no pre-approval.

The Law Society of BC has approved some well-vetted legal service concepts to enter the sandbox. But will BC revise its UPL legislation language to acknowledge it’s not always a “person” doing the “practice of law”?

Colorado offers a partial answer to my old “who dunnit?” question: make ownership or control of interactive legal technology explicit, but limit when the regulator will prosecute via easy to change policy. I think the harder question for BC and similar jurisdictions is: when does a tool help someone understand and exercise their own rights, and when is its provider supplying a legal service?

UPL can retain its integrity function without insulating the profession or intimidating innovators. The challenge (that I’m hardly the first to point out) is drawing that line clearly.

What do you think? Should we expand the scope of Canadian UPL to cover the tech owners and controllers?