The New Mandatory Rules: Succession Planning Obligations Every Law Firm Should Know

Unlike RIAs or banks, law firms don't answer to one continuity regulator. What they answer to is a patchwork of professional ethics rules — the ABA Model Rules of Professional Conduct, adopted with modifications in every U.S. jurisdiction, plus a fast-growing list of states that have stopped treating continuity as implied and started writing it into black-letter rule. As of 2025, seven states require a written succession or continuity plan outright. More are actively considering it. The direction of travel is unmistakable.

Five ABA Model Rules Already Require This — They Just Don't Say So

None of the core Model Rules uses the words "business continuity plan." None of them has to. Five of them, taken together, are difficult to satisfy without one.

Rule 1.1 — Competence

Competence requires the knowledge, skill, and preparation reasonably necessary for the representation. Comment 8, added in 2012, extended that explicitly to technology: lawyers are expected to understand the benefits and risks of the technology they rely on. A firm running its practice on a cloud-based system with no plan for what happens if that system fails, or if the firm is hit by ransomware, has a Rule 1.1 problem before it has a technology problem.

Rule 1.3 — Diligence

ABA commentary on this rule is unusually direct for sole practitioners: to prevent neglect of client matters in the event of death or disability, the duty of diligence may require a plan that designates another lawyer to review files, notify clients, and take protective action if needed. Disciplinary authorities have read this broadly — death and disability aren't the only disruptions that leave matters unattended. A technology failure or a facility closure can trigger the same exposure.

Rule 1.4 — Communication

Clients are owed reasonably prompt updates on their matters. A disruption that cuts off communication, with no backup channel and no plan for restoring it, is a Rule 1.4 issue on its own. The rule has a specific data breach dimension too: ABA ethics guidance makes clear that a firm experiencing a breach has to notify affected clients in enough detail for them to make informed decisions about their representation — which only works if the firm has a response plan before the breach happens, not after.

Rule 1.6 — Confidentiality

Lawyers must make reasonable efforts to prevent unauthorized access to client information. What counts as reasonable depends on the sensitivity of the data, the likelihood of disclosure, and how hard protective measures are to implement — a facts-and-circumstances standard that applies just as much during a ransomware incident or a disaster as it does on an ordinary Tuesday.

Rule 1.15 — Safeguarding Client Property

Trust accounts don't pause for a disruption. Client funds have to stay accessible and properly administered even when the attorney responsible for them is unavailable. State succession rules have consistently treated this as core, not optional — several explicitly require a plan to address how a designated successor accesses and administers trust accounts.

Two more rules round out the framework: 5.1 and 5.3 require supervisory lawyers to ensure the firm's own conduct — and that of its vendors — meets these same obligations. A cloud provider or IT vendor handling client data is the firm's responsibility to supervise, not a separate problem.

Seven States Have Gone Further

On top of the implied ABA baseline, seven jurisdictions have enacted explicit mandatory rules requiring a written succession or continuity plan — not a general duty to be prepared, but specific documentation, named individuals, and in some cases a filing with the state bar.

New Mexico Sets the Bar

Effective October 1, 2022, New Mexico Rule 16-119 NMRA requires every actively licensed attorney to have a written succession plan, individually or as part of a firm plan, covering what happens in the event of extended incapacity, disability, or death.¹ At minimum, the plan must name an "assisting attorney" who will carry out its terms, document the location of client files, active client lists, and passwords, and lay out how clients will be notified if the plan is activated. The attorney has to file a Certificate of Compliance with the State Bar of New Mexico and keep the plan updated as circumstances change. It's the most detailed mandatory rule currently in force, and a reasonable model for what "compliant" looks like even in states without an equivalent requirement.

New Jersey's New Registration Requirement

New Jersey took a different approach. Effective September 26, 2025, the New Jersey Supreme Court began requiring attorneys in private practice to disclose their succession planning status as part of the annual attorney registration process — including a designated successor attorney and a "person with knowledge" of where files and records are located.² One detail worth getting right: the September 2025 notice implemented the registration system change itself; the actual collection of succession data through the annual registration cycle was slated to begin with 2026 registrations. The state has also set up a public registry so clients can identify a successor quickly in an emergency.

California Ties It Together Without a New Rule

California hasn't adopted a standalone mandatory succession rule, but its State Bar's Formal Opinion 2024-209 makes the point just as forcefully: the duties of competence, diligence, communication, and protection of client property already require attorneys — solo practitioners especially — to take reasonable steps to avoid harm to clients from an interruption in practice, including engaging in succession planning.³ It's a useful illustration of the broader pattern: even jurisdictions without an explicit mandate are arriving at the same conclusion through existing rules.

Why More States Are Coming

New Mexico adopted its rule in 2022. New Jersey added its registration requirement in 2025. Illinois has a draft rule awaiting final court approval. Several other state bars are actively studying similar requirements. The demographic backdrop makes the direction of travel even clearer: the share of practicing lawyers over 65 has grown by more than fifty percent over the past decade, and solo and small-firm practitioners approaching the end of their careers represent the highest-risk population for the kind of unplanned interruption these rules exist to prevent.

What a Defensible Plan Actually Looks Like

Across the ABA baseline and every state mandatory rule, a defensible continuity plan shares the same core characteristics, regardless of firm size.

The Floor, Not the Ceiling

• Written and documented — not a mental plan or an informal understanding between partners
• A named successor or assisting attorney, with their consent on record
• Documented procedures for accessing client files and trust accounts during a disruption
• A client communication procedure, including for a data breach scenario
• Technology and data dependencies identified and addressed
• Reviewed and approved by firm leadership, not just drafted and filed away
• Tested at minimum through a tabletop exercise, with gaps documented and remediated

For firms building a program today, the practical move is to build to New Mexico's standard and treat it as the floor rather than the ceiling — it's unlikely any other state's eventual rule will ask for less.

Footnotes

1. State Bar of New Mexico, Rule 16-119 NMRA. ↩

2. New Jersey Courts, Notice to the Bar, Sept. 19, 2025. ↩

3. State Bar of California, Formal Opinion No. 2024-209. ↩