Here is a template to build your very own Multi-State Performance “style” exam. After you’ve made your edits, save the HTML file and share it with students. Keep a copy for a template.
Word Count Restraint Syndrome
Oh, Claude!
Help Law Students Suffering from Word Count Restraint Syndrome (WCRS)
They just need one more footnote. Please.
About this campaign
Every year, thousands of law students are diagnosed with Word Count Restraint Syndrome — a devastating condition in which the afflicted student is constitutionally incapable of writing a memo, brief, or exam answer within the assigned page limit.
Symptoms include:
Compulsive footnoting (up to 200 per page) · Inability to use a period without appending a dependent clause · Reflexive citation of law review articles published between 1887 and 1904 · Spontaneous Latin · Restatement parentheticals inserted into casual conversation · Accidentally writing a 12-page text message · Beginning every sentence with “It is well-established that…”
The science
Researchers at the Institute for Prolific Legal Scholarship (not accredited) have identified WCRS as a bio-psycho-socio-legal phenomenon arising from overexposure to casebooks, legal writing professors who use the phrase “thorough analysis,” and grading rubrics that award points for “comprehensiveness.” Peer-reviewed*
*Reviewed by three peers who also have WCRS and made the abstract 6,000 words long.
Where your money goes
Funds will cover: therapy (specifically, a licensed professional who can say “stop writing” in a legally binding way) · Printer ink · Wrist braces from excessive Westlaw scrolling · A graduate student to read the footnotes · Emergency Bluebook consultations · Post-traumatic stress counseling for TAs who received 80-page “short answer” exams
The case for giving
As the court held in Generosity v. Stinginess, 404 U.S. 1 (1971) (fictional), the duty to assist those in verbose distress is not merely moral but arguably quasi-contractual, subject to promissory estoppel if you’ve read this far. We argue, in the alternative, that your donation is both (1) the right thing to do, and (2) tax-deductible, notwithstanding the fact that we checked neither of those things.
GoFundMe is not responsible for the contents of this campaign, including but not limited to: the 14 string citations embedded in the campaign description, the three footnotes we removed before publishing, or the executive summary (62 pages) available upon request. All legal conclusions herein are provided for entertainment purposes only and do not constitute legal advice, notwithstanding that they are extensively cited.
AI Law Final Spring 2026
Administrative Process: AI in Law and Practice
Final Examination — Multistate Performance Test Format
About this examination
This examination is modeled on the Multistate Performance Test (MPT). You are a junior associate at a law firm retained by Nexus Health, Inc. You must complete three lawyering tasks.
The File and the Library
The File contains the factual record: client communications, internal documents, and regulatory notices. The Library contains a curated set of real, enacted authorities with official citations and hyperlinks — the statutes, regulations, and professional responsibility rules directly relevant to the tasks.
The Library is sufficient to complete all three tasks with a full, well-reasoned answer. You are not required to go beyond it.
Because this is an open-book, take-home examination, you may also draw on additional authorities from outside the Library — cases, regulations, secondary sources, or other statutes — if you believe they strengthen your analysis. Outside authorities are not required, and a response grounded entirely in the Library materials can receive full credit. If you do cite outside sources, use proper legal citation form and do not misrepresent what those sources say.
Scope note on California AI law
The California legislature has enacted a layered AI framework. The CCPA/CPRA provides the broadest base, with finalized ADMT regulations effective January 1, 2027. California’s Transparency in Frontier Artificial Intelligence Act (SB 53, 2025) adds requirements for “frontier developers.” Students should assess which frameworks apply to Nexus Health and where scope limitations create gaps that affect the analysis.
Format and citation rules
- Answer in the document type specified for each task (memo, client letter, ethics analysis)
- Use headings appropriate to the document type
- Cite all authorities using proper legal citation form
- Total word limit: 3,000 words across all tasks
Scenario: Nexus Health & the ARIA System
Nexus Health, Inc. is a digital health company headquartered in San Francisco, California. Nexus developed ARIA (Adaptive Risk Intelligence Assistant), an AI system deployed at partner hospitals to assist clinicians with triage and to flag patients at elevated risk of deterioration. ARIA is not FDA-cleared as a medical device; it is marketed as a “clinical decision support tool.” Nexus has approximately $80 million in annual revenue and processes health data for over 300,000 California residents.
Privileged & Confidential — Attorney Work Product
MEMO To: Outside Counsel | From: Dana Voss, General Counsel, Nexus Health | Date: March 14, 2026
Three urgent issues require your written analysis. First, ARIA is deployed in hospitals in California and Germany. Each regulator is asking different things of us. Second, the California Privacy Protection Agency (CPPA) has sent a formal inquiry alleging that ARIA processes “sensitive personal information” without adequate disclosure and that its outputs constitute “automated decisionmaking technology” (ADMT) subject to consumer rights. Third, our data scientist Dr. Priya Mehta has flagged internally that ARIA’s risk scores show a disparate performance gap across racial subgroups — an 18% false-negative rate for Black patients versus 9% for white patients on the deterioration-prediction task. Dr. Mehta has asked whether she has any obligation to report this externally. We have not yet disclosed this disparity to our hospital partners.
Please advise on all three issues.
California Privacy Protection Agency — Informal Inquiry Notice No. 2026-012
The CPPA has received a complaint alleging that Nexus Health’s ARIA system: (1) processes patient health data and infers racial/ethnic characteristics without a conspicuous pre-use notice; (2) generates risk scores that constitute “automated decisionmaking technology” affecting patients’ access to care; and (3) has not provided consumers with an opt-out mechanism.
The CPPA requests a written response within 30 days addressing Nexus Health’s data practices under the CCPA (Cal. Civ. Code §§ 1798.100–1798.199.100) and the CPPA’s ADMT Regulations (11 Cal. Code Regs. §§ 7150–7157), which require pre-use notices for ADMT used in significant decisions affecting health.
ARIA Model Card — Internal v2.3 (Excerpt)
ARIA uses a gradient boosting model trained on EHR data from three hospital systems (2015–2023). Inputs include age, vital signs, lab values, ICD-10 codes, medication history, and ZIP code as a socioeconomic proxy. Outputs are risk scores (0–100) used by clinicians in triage decisions.
Post-deployment monitoring (Q4 2025) identified a performance disparity: false-negative rate of 18% for Black patients vs. 9% for white patients. Root cause analysis is ongoing.
The model was developed at an estimated cost well below $100 million in compute.
Compliance note: ARIA is not an FDA-cleared device and is not developed by a “frontier developer” as defined in California Health & Safety Code § 22756.1 (SB 53). Nexus does not train foundation models.
Nexus EU Operations — Compliance Status (March 2026)
ARIA is deployed at two hospital partners in Germany. Both classify ARIA as a high-risk AI system under Annex III of the EU AI Act (Reg. (EU) 2024/1689). They are requesting a conformity assessment and technical documentation.
Our German deployment predates August 2, 2026. Counsel should advise whether the transitional provisions of Article 111 of the AI Act affect our obligations.
Internal Email — Dr. Mehta to General Counsel
“Dana — I’ve reviewed the Q4 monitoring data. The disparity is real and the hospitals are using ARIA scores to prioritize ICU bed allocation. If patients are being harmed because the model performs worse for Black patients, I believe we have a duty to disclose. I’ve spoken with HR about whistleblower protections. I asked specifically whether California’s new AI safety law — the one Newsom signed last fall — protects me if I report to the CPPA or Attorney General directly. HR couldn’t give me a clear answer. Can outside counsel address whether I’m protected?”
(a) A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following: (1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section. (2) If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared. A business shall not collect additional categories of sensitive personal information or use sensitive personal information collected for additional purposes that are incompatible with the disclosed purpose for which the sensitive personal information was collected without providing the consumer with notice consistent with this section. (3) The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.
A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
Includes: (1) personal information that reveals a consumer’s racial or ethnic origin; (2) a consumer’s health or medical information; (3) inferences drawn from any personal information to create a profile about a consumer reflecting the consumer’s health.
The Agency shall promulgate regulations governing the use of automated decisionmaking technology, including profiling. The regulations shall establish consumer rights to access information and to opt out of the use of automated decisionmaking technology.
A consumer whose nonencrypted and nonredacted personal information is subject to an unauthorized access, exfiltration, theft, or disclosure may bring a civil action for statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater.
Any technology that processes personal information and uses computation to execute a decision, replace human decisionmaking, or substantially replace human decisionmaking. “Substantially replace” means using the technology’s output as a key factor in a human’s decisionmaking.
A decision that results in the provision or denial of, or that significantly affects: financial or lending services; housing; insurance; education enrollment; employment or independent contractor opportunities; healthcare access or service; or access to essential goods or services.
A business that uses ADMT to make a significant decision concerning a consumer must provide a Pre-use Notice before using ADMT with respect to that consumer. The Pre-use Notice must inform the consumer about: (1) the type of ADMT used; (2) the purpose and logic of the ADMT; (3) how to exercise the right to opt out.
A business must conduct and document a risk assessment before initiating processing activities that pose significant risk to consumer privacy, including use of ADMT for a significant decision concerning a consumer. Assessments must identify and weigh benefits against potential risks to consumers, including risks from algorithmic discrimination based on protected characteristics.
ADMT obligations apply to businesses using ADMT for significant decisions beginning January 1, 2027. Risk assessment obligations are effective January 1, 2026. As of the exam date (March 2026), pre-use notice and opt-out obligations are not yet operative, but risk assessments are required.
AI systems listed in Annex III are classified as high-risk. Annex III, point 5(c) covers AI systems intended to be used for making decisions or materially influencing decisions on access to and enjoyment of essential private services and public services, including healthcare.
A risk management system shall be established, implemented, documented, and maintained in relation to high-risk AI systems. The risk management system shall consist of a continuous iterative process run throughout the entire lifecycle of a high-risk AI system.
Training, validation, and testing data sets shall be subject to appropriate data governance and management practices. Those practices shall concern, in particular: the examination in view of possible biases that could affect health, safety or fundamental rights or lead to discrimination prohibited under Union law.
High-risk AI systems shall be designed and developed in such a way to ensure that their operation is sufficiently transparent to enable deployers to interpret the system’s output and use it appropriately. The provider shall ensure that high-risk AI systems are accompanied by instructions for use including: the level of accuracy, robustness, and cybersecurity against which the system has been tested and validated, and any known and foreseeable limitations.
Providers of high-risk AI systems shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred. A “serious incident” includes any malfunctioning of a high-risk AI system that has led or may lead to the death of a person or serious damage to a person’s health.
High-risk AI systems that have been placed on the market or put into service before August 2, 2026 shall comply with this Regulation by August 2, 2027, provided they have not undergone significant changes in their design since their initial placing on the market or putting into service.
The TFAIA applies to “frontier developers” — persons who train a “frontier model” using more than 10²⁶ floating-point operations. A “large frontier developer” additionally has annual gross revenues exceeding $500 million. Students must assess whether Nexus Health meets these thresholds.
“Frontier model” means a foundation model trained using a quantity of computing power greater than 10²⁶ integer or floating-point operations. “Frontier developer” means a person that trains a frontier model and makes it publicly available to Californians.
A frontier developer shall not make, adopt, or enforce a rule, regulation, policy, or contract that prevents a covered employee from disclosing to the Attorney General, a federal authority, or a person with authority over the covered employee, information that the covered employee reasonably believes discloses that the frontier developer’s activities pose a specific and substantial danger to the public health or safety resulting from a catastrophic risk, or that the frontier developer has violated the TFAIA. A frontier developer shall not retaliate against a covered employee for such disclosures.
“Covered employee” means an employee responsible for assessing, managing, or addressing the risk of a critical safety incident in the company.
California Labor Code § 1102.5 (not reproduced in full) provides broader whistleblower protections for employees who report violations of state or federal law to government agencies. Students should note whether § 1102.5 may provide an independent basis for protection where the TFAIA does not apply.
If a lawyer for an organization knows that an officer, employee, or other person associated with the organization is engaged in action, intends to act, or refuses to act in a matter related to the representation that is a violation of a legal obligation to the organization, or a violation of law that reasonably might be imputed to the organization, and that is likely to result in substantial injury to the organization, then the lawyer shall proceed as is reasonably necessary in the best interest of the organization. Unless the lawyer reasonably believes that it is not necessary in the best interest of the organization to do so, the lawyer shall refer the matter to higher authority in the organization.
A lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary to prevent reasonably certain death or substantial bodily harm.
A lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary to prevent the client from committing a crime or fraud that is reasonably certain to result in substantial financial injury to another and in furtherance of which the client has used or is using the lawyer’s services.
In representing a client, a lawyer shall exercise independent professional judgment and render candid advice. In addition to legal considerations, a lawyer may refer to other considerations such as moral, economic, social and political factors, that may be relevant to the client’s situation.
The CPPA announced that regulations covering cybersecurity audits, risk assessments, and automated decisionmaking technology were approved on September 22, 2025 and take effect January 1, 2026, with ADMT-specific consumer rights operative January 1, 2027. The regulations require businesses using ADMT for significant decisions to provide pre-use notices and honor opt-out rights. Risk assessments are required before initiating processing activities posing significant risk, including use of ADMT for significant decisions affecting healthcare access.
Task A — Interoffice Memorandum (~1,100 words)
Dana Voss has asked you to prepare an interoffice memorandum analyzing Nexus Health’s legal exposure under three frameworks: (1) the CCPA/CPRA and finalized ADMT Regulations; (2) the EU AI Act; and (3) California’s Transparency in Frontier Artificial Intelligence Act (SB 53).
For each framework, address:
- (a) whether and why ARIA is a covered system;
- (b) Nexus Health’s most significant compliance obligations given the facts; and
- (c) the primary legal risk from non-compliance, particularly given the known performance disparity.
Your memo must engage honestly with scope limitations. For SB 53, you must analyze whether Nexus Health and ARIA fall within the statute’s definitions. If a framework does not fully apply, explain the gap and identify what residual risk remains.
Your memo should also assess how California’s regulatory trajectory — the ADMT regulations effective January 1, 2027 — affects compliance planning even now.
Drafting note: The memo is privileged and candid. Do not soft-pedal bad facts.Task B — Client Letter (~1,000 words)
Write a client letter to Dana Voss responding to the CPPA inquiry (Document 2). Your letter must address three questions:
- Whether ARIA’s risk scores likely constitute “automated decisionmaking technology” (ADMT) under 11 Cal. Code Regs. § 7001(f), and whether using them for ICU triage qualifies as a “significant decision” under § 7001(ddd). What does the “substantially replace” standard mean in ARIA’s context, where a human clinician sees the score and makes the final call?
- Whether patient health data and inferences about race/ethnicity processed by ARIA qualify as “sensitive personal information” under Cal. Civ. Code § 1798.140(ae), and what use limitations apply under § 1798.121(a).
- What you recommend Nexus Health do within the 30-day CPPA response window. Your recommendation must address whether and how to disclose the performance disparity — and the legal and ethical consequences of non-disclosure.
Task C — Ethics Analysis (~700 words)
Dr. Mehta’s email (Document 5) raises professional responsibility questions. Draft a section of an internal ethics memo addressing:
- Your obligations under Model Rule 1.13(b). You know about the performance disparity and the risk of patient harm. Nexus Health is your client. What does Rule 1.13(b) require of you? What is “higher authority” in this context, and have you satisfied your obligation?
- The confidentiality question under Model Rule 1.6. Does the “reasonably certain death or substantial bodily harm” exception in Rule 1.6(b)(1) apply here? Analyze the standard carefully — “reasonably certain” is a demanding threshold. What, if anything, does Rule 1.6 permit you to disclose, and to whom?
- Dr. Mehta’s whistleblower protection under California law. Dr. Mehta asks whether SB 53 (Cal. Health & Safety Code § 22756.3) protects her if she reports to the CPPA or Attorney General. Analyze whether SB 53 applies to Nexus Health and to Dr. Mehta as a “covered employee.” If SB 53 does not fully protect her, identify what alternative protection, if any, might exist under the California Labor Code § 1102.5 framework (note: § 1102.5 is referenced in the Library but not reproduced in full; you may note this limitation or research it further).
Use this checklist to self-assess your response before submitting. I will look for evidence of each item in your written work.
Task A — Interoffice Memorandum
Task B — Client Letter
Task C — Ethics Analysis
Solution Vibing: An Adobe Acrobat Word Counter
I want my students to have experience with Adobe Acrobat and pdfs before their first summer jobs, so I ask that they submit their final appellate brief in pdf. The trouble is the word count. Adobe has not deemed it a necessary tool. I made a plugin.
Now, obviously, I’m a wordsmith, not a coder, but as most have discovered, generative AI has made it easy to solve work problems that are so niche no one has already solved them. I spent about an hour on this plugin. In full disclosure, I had created an Adobe plugin before. It was years ago, but I was somewhat familiar with the basic steps. I think a lot of people don’t realize that Adobe Reader is the basic, free app. Adobe Acrobat Pro is the actual app with the bells and whistles. Some don’t realize there are many, many tools available if you click All Tools. And you can add your own tools. Creation/coding for your tools happens outside of Adobe Acrobat Pro, and depending on your version of Acrobat Pro and operating system, the precise code varies. If you or your school hasn’t invested in the Adobe suite, do yourself a favor and prioritize the subscription from your PDF funds (see what I did there?). Back then, creating the plugin – for which I now can’t remember the purpose – was painful and took a couple of days of trial and error, searching high and low on obscure internet forums, etc. For this one, I simply gave Claude my vision. But if I didn’t have that foundational knowledge, I don’t think I could’ve had an intelligent exchange with Claude to produce what I needed, and the lack of basic skills would’ve turned it into a multi-hour project.
I made the commercial just for fun to see how AI video production has improved over the last year. Meh. I don’t know how production companies are creating entire, BEAUTIFUL films. I could never get a video of more than 20 seconds, and even applying the same descriptors and instructions, it never produced clips that had continuity (same lighting, office space, etc.). At the end of the day, I was left with several clips I had to splice together in iMovie.
I think this is an important realization for all the fear-mongers worried about jobs. Sure, the AI product can do the task, but it can’t do it well unless the person driving the machine knows what to ask for. I feel like I have pretty strong video editing skills; I was even a partner in a film company and have been on sets with cameras and all that jazz. I’ve sat for hours in editing bays to filter microseconds of footage. Yet, this was the best I could get out of Sora 2 Pro and Wan. Wan was much more successful. So yes, a layperson could probably produce an appellate brief with AI, but doing so would take them many more hours than an actual attorney, require lots of trial and error, and leave them with little assurance of the work.
This is sort of like your ego-driven spouse insisting you don’t need to call a plumber. Yes, they can probably find instructions, a video, and help at Home Depot, but were they prepared for the old PVC pipe to crumble into shards as soon as they turned the wrench? On-the-spot problem-solving with AI is rarely a practical approach, unless the user is already extremely skilled on the topic. For this example, I could have kept messing around with it and produced something amazing, but at some point, the learning curve becomes too steep to return an efficient work product. And sometimes a worker could do the task much more efficiently on their own. We don’t need an AI solution for every little thing. You wouldn’t cut a wedding cake with a chainsaw. I mean, we could, but oh, what a mess we’d make! And if the bride and groom have never used a chainsaw, they should probably leave it to the professionals.
We must teach students to, as Tracy Norton (LSU) says, have a cautious skepticism about new technologies while embracing the possibilities (Sorry, I mangled your brilliant quote, Tracy!). The basic rules of professional responsibility and human morality still apply, even as technology evolves.
Word Counter
Install Guide
A free plugin that adds word count to Adobe Acrobat Pro. Follow these steps to install it — then share this page with anyone who wants it too.
Download WordCounter.zipWordCounter.js file inside — that’s the file you’ll install.WordCounter.js after unzipping — not WordCounter.js.txt. If your system adds .txt, rename it to remove that extension.JavaScripts with a capital J and S.Oh, Blog. I remember you.
As so often happens in the land of academia, I’ve been so busy with teaching, scholarship, and service that I have neglected my space on the web. This post is a recommitment to myself. New and fresh material coming soon…