I wrote earlier in this section about when local models are worth the trouble, and deliberately avoided naming any, because specific model recommendations age badly.

This piece does the opposite. It names the stack, because at some point abstraction stops being useful and you need to know what to actually install. And then it does something I have not seen another firm write down: it explains how we turn that capability into a choice the client makes, in the engagement letter, with a price attached.

The two halves are connected. A client’s election is meaningless if the firm cannot technically honor it. Running your own models is what makes “nothing about my matter leaves your building” a control rather than a promise.

Part One: The stack

Why Qwen

The Qwen family, from Alibaba’s Qwen team, has become the default recommendation for local deployment, and the reasons are practical rather than ideological.

The license. Qwen’s open-weight models are released under Apache 2.0. For a law firm this is not a detail. Apache 2.0 means you can download the weights, run them on your own hardware, use them commercially, and keep doing so — with no royalty, no usage reporting, and no term that lets anyone revoke it later. Several otherwise-excellent open-weight models ship under bespoke licenses with acceptable-use terms and revocation language. For infrastructure a practice depends on daily, a permissive standard license is worth a great deal.

The size ladder. Qwen releases across an unusually wide range — from sub-billion-parameter models up through very large mixture-of-experts variants. That matters because different tasks in a law office want different sizes, and being able to stay inside one family means consistent behavior, prompting, and tooling across all of them.

Current state as I write this. Qwen3 spans roughly 0.6B through 235B. Qwen3.5 arrived in February 2026, and Qwen3.6 followed in April, including a 27B dense model with a 256K context window that runs in roughly 17 GB of memory. That last configuration is the sweet spot for legal work right now: 27B is large enough to be genuinely useful, 17 GB fits comfortably on a well-specified laptop, and a 256K context holds a substantial chunk of a matter file.

Treat those version numbers as perishable. The family and the license are the durable part.

Choosing a size

Rough guidance by what you are actually doing:

That last row is the honest one. I have argued this before and it has not changed: local models are close enough on bounded mechanical work that the gap does not matter, and meaningfully behind on the hard reasoning where the gap is the whole point. Run the volume locally; send the twelve documents that matter to the best model available.

Runtimes

Four real options, and the choice is less consequential than the internet suggests.

Ollama is the right starting point for almost everyone. One install, ollama pull qwen3:27b, and you have a local API on your machine. It fetches quantized weights automatically and exposes an HTTP endpoint that most tooling already speaks. Recent versions use Apple’s MLX under the hood on M-series chips, so you get the Apple-silicon performance without managing it.

LM Studio is the same idea with a GUI — a model browser, a chat window, a server toggle. If nobody in your firm wants to touch a terminal, start here.

llama.cpp is the engine underneath much of this and the GGUF quantization format comes from its lineage. Use it directly if you need control the wrappers do not expose.

MLX is Apple’s own framework. On M-series hardware it is the fastest path — third-party benchmarks put it meaningfully ahead of GGUF equivalents on token throughput for larger models, and MLX-format weights tend to be slightly smaller on disk. If your firm is entirely on Apple silicon and you care about speed, it is worth the extra setup.

My advice: start with Ollama. Move to MLX only if you measure a reason to.

Quantization, briefly

Model weights are normally 16-bit numbers. Quantization stores them at lower precision — 8-bit, 4-bit — which roughly halves or quarters the memory needed, at some quality cost.

The practical answer is Q4_K_M, the default most people run. It sits at the four-bit tier but allocates a slightly higher bit budget to attention and embedding layers, which is why it holds up noticeably better than older uniform four-bit formats. Unless you have measured a reason to go higher, this is the setting.

The rule of thumb for capacity planning: a 4-bit quantized model needs roughly 0.6 GB of memory per billion parameters, plus headroom for context. A 27B model lands around 17 GB, which matches the figures above. A 32B model needs a bit over 20 GB. Add several more GB if you intend to use a long context, because the key-value cache grows with it and on long legal documents that is not a rounding error.

Hardware

On Apple silicon, unified memory is the number that matters, because CPU and GPU share one pool.

• 16 GB — 4B–8B models. Real classification and extraction work. A genuine starting point, not a toy.
• 32 GB — up to about 14B comfortably, 27B with a short context.
• 64 GB — 27B–32B with real context. This is the practical target for a firm that wants local drafting.
• 128 GB+ — larger models and multiple loaded at once.

For a small firm, the honest framing is that the jump from 32 GB to 64 GB on a machine you were buying anyway is the entire capital expense of this program. It is not nothing and it is not a server room.

Part Two: Letting the client choose

Here is the part I think is actually novel, and it grew out of a question a client asked me directly: “Are you using AI on my case, and do I get a say?”

The honest answer to the second half should be yes. So we built one.

The tier election

Every engagement letter now includes an election. The client picks one, and it governs the matter.

Tier 0 — No AI. No model of any kind touches this matter. Traditional research, human drafting, human review. Available to anyone who asks, for any reason or none.

Tier 1 — In-house only. Only models running on the firm’s own hardware. No information relating to the representation is transmitted to any outside provider. This is the tier Qwen exists to serve.

Tier 2 — In-house plus contracted providers. (Default.) Bulk work runs locally; specific, curated excerpts may go to an outside provider operating under a written agreement that forbids training on our inputs and limits retention. Best combination of cost and quality for most matters.

Tier 3 — Maximum leverage. Everything in Tier 2, plus AI-assisted review at scale on large document sets and automated monitoring. For high-volume matters where the alternative is a review budget the client cannot afford.

The three rules that make it real

1. Price the tiers, in dollars, in the letter.

This is the one that matters and the one most firms will not want to do.

An election the client cannot price is not an election. If Tier 0 means the work takes longer, the client has to see what that costs before choosing it — otherwise “no AI” is a free option that everyone takes for comfort, and the firm quietly eats the difference or, worse, quietly does not honor it.

So the letter says what each tier costs. Not as a penalty for choosing Tier 0 — as the actual price of the actual work. A document review that takes 90 hours by hand and 12 hours assisted is two different bills, and the client is entitled to know that before deciding which one they are buying.

There is an accountability effect here I did not anticipate but have come to think is the best argument for the whole scheme. Publishing the price difference forces the efficiency through to the client. A firm that shows a client “Tier 2 saves you $9,000 on this matter” cannot then bill Tier 2 work at Tier 0 rates. The election makes the savings visible, and visible savings are savings the client actually receives — which is the entire point of everything else in this section.

2. The default is the middle, and silence is never consent to the top.

If a client does not elect, they get Tier 2. Not Tier 3. A client who has not engaged with the question should land somewhere defensible and ordinary, not at maximum leverage.

3. The election has to be technically enforceable.

This is where Part One and Part Two meet, and it is the difference between a control and a promise.

If a client elects Tier 1, the firm must be structurally incapable of sending their information to an outside provider — not merely committed to remembering not to. In practice that means the matter is flagged, the flag gates the routing, and the tooling for that matter has no path to an external API. A local-only stack is what makes that enforceable, because there is somewhere else for the work to go.

I have made this argument repeatedly about other things: an unimplemented endpoint is a wall, an instruction is a request. It applies with more force here than anywhere else, because here the promise was made to a client in writing.

What does not change by tier

Every letter says this explicitly, because it is what clients are actually worried about:

• A lawyer reviews and signs everything. At every tier, including Tier 3.
• Every citation is verified against the source. At every tier.
• Confidentiality obligations are identical. Tier 3 is not a lower standard of care; it is a different toolset under the same duty.
• The lawyer is responsible for the work. Not the tool, not the vendor, not the tier.

The rules underneath it

Rule 1.4(b) requires a lawyer to “explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation.” Rule 1.6(c) requires “reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” The ABA’s Formal Opinion 512 routes generative AI through those same duties, and its confidentiality analysis turns on the client’s informed consent where information relating to the representation would be exposed.

A tier election is, I would argue, a fairly direct implementation of all three. It gives the client the information, it gives them the decision, and it documents both. I am not aware of authority requiring it, and I am not claiming it is required. I am claiming it is a better answer to those rules than a paragraph of boilerplate nobody reads.

The objection I have not resolved

Being honest about the weak point.

Is it coercive to price Tier 0 higher? A client who cannot afford the no-AI option has not really been given a choice. There is a real argument that presenting an option you have made more expensive is a soft form of pressure, particularly for an individual client with limited means facing an institutional opponent.

My answer is that the price difference is not manufactured — the work genuinely takes longer, and charging the same for both would mean overcharging one client to subsidize another’s preference. But I hold that answer with less confidence than I would like. The mitigation is to keep the gap honest rather than punitive, explain plainly why it exists, and never treat a Tier 0 election as a signal that the client is difficult.

And a related one I have no good answer to at all: the tier governs how we handle our client’s information. It does not govern the opposing party’s documents, or a third party’s records produced in discovery. Those people did not elect anything and have no say. That is a genuine gap in the framework and I do not think client consent solves it. Minimum-necessary handling of everyone’s information, regardless of whose it is, is the only discipline I have found that addresses it, and it is a practice rather than a control.

Why bother with any of this

Because the question is coming, and the firms that have not thought about it will answer badly.

Clients are going to ask what you are doing with their information. The wrong answer is a startled improvisation or a clause in the engagement letter authorizing everything. The right answer is: here are your options, here is what each one costs, here is what stays the same regardless, and here is how we make sure your choice is honored.

Building that answer requires the technical capability first. You cannot offer Tier 1 if everything you do runs through somebody else’s API. Which is the real reason to spend a weekend with Ollama and a 27B model — not because local inference is cheaper, though it is, and not because it is faster, because it is not.

Because it is what lets you hand the decision to the person whose information it is.

Sources

• Qwen open-weight model releases (Apache 2.0); Qwen3, Qwen3.5 (February 2026), Qwen3.6 (April 2026)
• Ollama, LM Studio, llama.cpp, and MLX
• Minn. R. Prof. Conduct 1.4 and Rule 1.6
• ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512 (July 29, 2024)

Rules quoted were verified against the Revisor of Statutes. Model versions, memory figures, and runtime performance characteristics change rapidly and are current only as of writing — verify before relying on them. General commentary on practice management; not legal advice, not ethics advice, and not a hardware or vendor recommendation. The tier framework described here is this firm’s own approach, not a standard, and Formal Opinion 512 is advisory rather than binding in any jurisdiction.