The AI question your firm's risk committee hasn't thought to ask

The profession has been clear for a while that confidential client information and public AI tools don't mix. The NSW Supreme Court's practice note on generative AI, in force since February 2025, lists legal professional privilege among the risks. For certain categories of material, such as documents produced on subpoena, it says it must not be entered into an AI tool unless the practitioner is satisfied it stays in the provider's controlled environment and won't be used for training. The Law Society of NSW has warned that putting confidential client information into a public AI system is close to putting it in the public domain.

In February a US court applied that principle to a real case. In United States v Heppner, Judge Rakoff in the Southern District of New York held that documents a defendant created with the consumer version of Claude were not privileged. Part of the court's reasoning came from the provider's privacy policy, which allowed training on user inputs and disclosure to third parties. On those terms, the court found no reasonable expectation of confidentiality. It's a US criminal case and it binds nobody here. The reasoning is still worth attention, because privilege in Australia also rests on confidentiality, and the court settled the point by reading the terms the user had agreed to.

That's where it becomes a technology matter. The outcome turned on which version of the tool was used. Consumer and enterprise accounts can look identical on screen and come with very different terms. Enterprise plans generally exclude training and include confidentiality commitments, which gives a firm a much stronger position than a personal account would.

The practical question for a firm, then, is whether it could show for a given matter which tool was used, on whose account and under what terms, and what went into it.

In most of the professional services businesses I've worked with, the answer is no. Staff use a mix of tools. Some are on company plans and some are on personal accounts set up long before any policy existed, and the same person can move between them in one afternoon. The policy can say the right things while nobody is able to check what happened on a particular file.

Most of the fix is ordinary IT work. Put everyone on a company account under an enterprise plan and rule out personal accounts for client work. Keep the logs, and set retention to match the firm's file retention rather than the provider's default. Where the same task on live matters keeps coming up, such as summarising correspondence or first drafts of routine documents, build it into a controlled tool so the right settings apply every time and each use is recorded. A question about privilege can then be answered from records instead of from memory.

VIEW ALL

The engagement letter is worth a look while you're at it. If a client asks whether AI will be used on their matter, one sentence covering which tools the firm uses and how the information is protected answers it before it turns into an awkward conversation.

None of this means firms should stop using these tools. The productivity gains are real. When privilege over AI-assisted work is eventually tested here, the firms in the best position will be the ones that can produce their records.

Nirlep Adhikari is the founder and director of Mount Mindforce.