Security and privacy frameworks
Plain-English notes on the security, privacy and professional rules a law firm meets when it uses AI, and how each maps onto this framework.
MaintainedLast reviewed
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
Australian cyber security
Advice from the Australian Signals Directorate and its Australian Cyber Security Centre. These publications are not, by themselves, rules that bind a private law firm.
- ASD Essential Eight — Voluntary. This is ASD advice, not legislation, and it does not bind a private law firm unless a contract or a lawful direction makes it mandatory.
- Information Security Manual — Voluntary. The ISM is ASD’s advice, not legislation, and it does not bind a private law firm unless legislation, a contract or a lawful direction makes it mandatory.
- Engaging with artificial intelligence — Voluntary guidance. This is joint guidance for organisations that use AI, not legislation, and it does not bind a private law firm unless a contract or a lawful direction makes it mandatory.
- Deploying AI systems securely — Voluntary guidance. This report is not legislation and does not bind a private law firm unless a contract or a lawful direction makes it mandatory. It is aimed at organisations that deploy an AI system themselves, not a firm that only uses a vendor’s shared chatbot.
- Infosec Registered Assessors Program — Voluntary. IRAP is an assessment program, not legislation. A private law firm is not required to hold an assessment of its own network unless a contract or a lawful direction requires it.
Australian privacy law
The Privacy Act 1988 (Cth), the Australian Privacy Principles, the Notifiable Data Breaches scheme, and the OAIC’s guidance on commercial AI products.
- Privacy Act 1988 and the Australian Privacy Principles — The Australian Privacy Principles bind APP entities, including private organisations with annual turnover over $3 million, and some smaller firms. A firm under that threshold is not automatically covered.
- Notifiable Data Breaches scheme — The scheme binds entities that must protect personal information under APP 11. It does not automatically cover every small practice.
- OAIC guidance on commercially available AI products — The guidance itself is not binding. The Privacy Act is, for APP entities, and this guidance explains how the OAIC reads it. It gives no new duties to a firm that is not an APP entity.
Australian AI policy
Voluntary industry guidance, and the policy that binds non-corporate Commonwealth entities. A private law firm is not that kind of entity.
- Voluntary AI Safety Standard — The guardrails are voluntary. They do not create a new legal duty for a law firm.
- Policy for the responsible use of AI in government — Version 2.0 binds non-corporate Commonwealth entities, with the exceptions in the policy. It does not bind a private law firm.
Management-system and assurance standards
ISO/IEC management-system standards and the AICPA’s SOC 2 examination. A name in a vendor brochure is not the certificate or the report, and it does not say the firm’s plan is in scope.
- ISO/IEC 27001 — Voluntary. ISO standards are not legislation, and nothing in the standard requires a law firm to be certified unless a contract or regulator mandates it.
- ISO/IEC 27701 — Voluntary. ISO standards are not legislation. The Privacy Act’s duties do not depend on holding this certificate, and no certificate replaces them.
- ISO/IEC 42001 — Voluntary. ISO standards are not legislation, and the standard does not regulate admission to practice. Certification is a choice unless a contract or regulator mandates it.
- SOC 2 — Voluntary. SOC 2 is an attestation framework, not legislation. A law firm is usually reading a vendor’s report, and nothing requires the firm to commission its own unless a contract mandates it.
United States frameworks
NIST publications. They are voluntary guidance. They are not Australian law.
- NIST Cybersecurity Framework 2.0 — Voluntary. This is NIST guidance, not legislation. It is not Australian law and it is not a condition of legal practice unless a contract mandates it.
- NIST AI Risk Management Framework and the Generative AI Profile — Voluntary. The framework and the Generative AI Profile are NIST guidance, not legislation. They do not bind an Australian law firm unless a contract mandates them.
European law
The EU AI Act and the GDPR. They are European Union law. An Australian firm is not inside them merely because the firm is in Australia.
- EU Artificial Intelligence Act — An Australian law firm is not subject to the Act merely because the firm is in Australia. Whether a firm is in scope depends on Article 2 of the text in force.
- General Data Protection Regulation — A law firm in Australia is not subject to the GDPR merely because it practises in Australia. Article 3 can still bring some processing into scope.
The Australian legal profession
Conduct rules and law-society guidance. Confidentiality is a professional duty whether or not a cyber standard applies.
- Law Society of New South Wales: AI and cyber security — The conduct rules bind solicitors in New South Wales. The January 2026 guide is the Society’s guidance, not a judgment.
- Law Institute of Victoria AI Hub — The hub is a reading list. Victorian solicitors are bound by the Uniform Law and the Australian Solicitors’ Conduct Rules, not by the hub.
- Queensland Law Society Guidance Statement No. 37 — Guidance Statement No. 37 is for Queensland solicitors. It has no legislative effect. It is a standard of good practice.
- Solicitor confidentiality — Rule 9 is binding conduct law. It is in force under the Uniform Law for solicitors in New South Wales, Victoria and Western Australia, and in Queensland through the Australian Solicitors’ Conduct Rules 2023 (version 2), notified under the Legal Profession Act 2007 (Qld). Elsewhere, check the conduct rules that apply to the solicitor’s own jurisdiction.
- Law Council of Australia: AI and the profession — The Council’s page is an index of constituent-body work. It does not impose a national conduct rule.