--- title: "Law Society of New South Wales: AI and cyber security" url: "https://ailawframework.com/frameworks/law-society-nsw" type: "framework_note" site: "AI Law Framework" issuer: "Law Society of New South Wales" status: "The conduct rules bind solicitors in New South Wales. The January 2026 guide is the Society’s guidance, not a judgment." checked: "2026-10-10" --- # Law Society of New South Wales: AI and cyber security > New South Wales guidance on generative AI: the January 2026 solicitor’s guide, the December 2024 statement, and Lawcover cyber security material. Canonical page: https://ailawframework.com/frameworks/law-society-nsw Checked: 2026-10-10 Site index for agents: https://ailawframework.com/llms.txt The conduct rules bind solicitors in New South Wales. The January 2026 guide is the Society’s guidance, not a judgment. New South Wales guidance on generative AI: the January 2026 solicitor’s guide, the December 2024 statement, and Lawcover cyber security material. This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard. ## What it is The Law Society of New South Wales, the Legal Practice Board of Western Australia and the Victorian Legal Services Board and Commissioner issued a statement on the use of artificial intelligence in Australian legal practice in December 2024. The statement says that when solicitors use AI they must still meet the Legal Profession Uniform Law and the Australian Solicitors’ Conduct Rules. The Society’s January 2026 publication, A solicitor’s guide to responsible use of artificial intelligence, is its longer guide for solicitors. Its ethics FAQ says that generative AI takes information that is inputted and uses that information to learn, and discloses it to other users, and that inputting client confidential information therefore puts it in the public domain. The FAQ says this may be a breach of confidentiality and that the client may lose privilege. That sentence is about generative AI that learns from the input and discloses it. It is not a finding about every enterprise tool. With Lawcover, the Society published Data and Cyber Security for Law Practices in November 2025. The Society’s October 2025 guidelines on digital documents treat encryption, multi-factor authentication, access control and a breach-response plan as part of keeping digital documents. ## Who it applies to The conduct rules bind solicitors in New South Wales. The December 2024 statement was issued by the Law Society of New South Wales, the Legal Practice Board of Western Australia, and the Victorian Legal Services Board and Commissioner, for solicitors in those Uniform Law jurisdictions. Western Australia is one of the issuing jurisdictions. The January 2026 guide is the Society’s guidance for New South Wales solicitors. It is guidance. The Society is not a court. A solicitor elsewhere should read that jurisdiction’s society and its own conduct rules. ## What it asks of a law firm using AI - The December 2024 statement says solicitors cannot safely enter confidential, sensitive or privileged client information into public AI chatbots or copilots, or any other public tool. If a commercial tool is used with any client information, the contractual terms have to be reviewed so the information will be kept secure. - The statement says AI tools cannot be relied on as a substitute for legal knowledge. Solicitors who use AI to prepare documents must be able to verify the contents personally, and must actually do so, so the document is accurate and not likely to mislead the client, the court or another party. - The statement says practices should have a clear, risk-based policy for which tools are used, by whom, for what, and with what information, and how junior and support staff are supervised. It recommends making the policy available to clients on request. - The Society’s ethics FAQ treats the duty of confidentiality as continuing after the retainer ends. Rule 9.2 is the list of exceptions. A request is not compulsion. - The November 2025 Lawcover note says that if the practice has Privacy Act obligations, an eligible data breach must be notified to affected individuals and the OAIC. It also says that holding tax file numbers brings the tax file number rules into play even where the practice is not otherwise an APP entity. - The October 2025 digital-document guidelines say any suspected or actual breach of digital document security must be reported immediately to the firm’s compliance officer, IT department or a principal, and that the firm should document notification to affected clients or regulators where that is required. ## How it maps to this framework | This site’s question | What the instrument says that bears on it | | --- | --- | | Efficiency: Whether the tool saves total human work at the quality the task needs. | The January 2026 guide says that where time-based billing is used and generative AI means a task takes less time, the time saved should be reflected in the bill. That is a costs point. It is not a reason to skip the check. | | Effectiveness: Whether the output is good enough for the task. The catalogue does not score this. | The statement’s competence point is that the solicitor must be able to verify AI-assisted documents and must do so. Hallucinations, including fictitious cases, are the failure the statement is written against. This framework’s effectiveness question is the same worry, scored for a task. | | Due diligence: What the firm has actually read about hosting, training and assurance before it relies on the tool. | Reviewing the contract before client information goes into a commercial tool is the statement’s due diligence. A missing answer on security is not a gap to note later. The statement says the information has to be kept secure. | | Confidentiality: Whether client and other confidential information can go into the tool. | Public tools and client confidential information do not go together, on the statement’s words. Commercial tools depend on the contract. The FAQ’s stronger sentence, that the input is put in the public domain, is stated for generative AI that learns from the input and discloses it onward. | | Disclosure: When the firm tells the client, and where required the court or another party, that AI was used. | The statement recommends making the firm’s AI policy available to clients on request. It also says solicitors should consider being transparent, and properly recording and disclosing to clients, and where necessary or appropriate to the court and other practitioners, when and how AI was used. “Where necessary or appropriate” is the statement’s limit. It is not a rule that every matter requires a disclosure. | | Certifications: ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Neither the statement nor the FAQ treats an ISO or IRAP badge as permission to use a public tool. The question they ask is whether the information will be kept secure. | | Data residency: Where the tool holds data, including whether that place is recorded as Australia. | The digital-document guidelines expect the firm to know which systems hold client documents and how access is controlled. They do not, in the passages checked, name a single permitted country. Pair them with APP 8 where personal information is disclosed overseas. | ## Sources - [Statement on the use of artificial intelligence in Australian legal practice (December 2024)](https://www.lawsociety.com.au/sites/default/files/2024-12/LS4590_PSP_Statement_AI_LawSocietyVersion121224.pdf) - [A solicitor’s guide to responsible use of artificial intelligence (January 2026)](https://www.lawsociety.com.au/sites/default/files/2026-01/20260109%20LS4816_PSU_GuidetoAI_2026-01-08a%20FINALv2.pdf) - [Law Society of NSW, Ethics FAQs](https://www.lawsociety.com.au/practising-law-in-nsw/ethics-and-compliance/ethics/FAQs) - [Law Society of NSW and Lawcover, Data and Cyber Security for Law Practices (November 2025)](https://www.lawsociety.com.au/sites/default/files/2025-12/Law%20Society%20%26%20Lawcover%20-%20Data%20%26%20Cyber%20Security%20for%20Law%20Practices_Nov%202025.pdf) ## Related pages - [Solicitor confidentiality](https://ailawframework.com/frameworks/solicitor-confidentiality.md) - [Law Institute of Victoria AI Hub](https://ailawframework.com/frameworks/law-institute-victoria.md) - [Queensland Law Society Guidance Statement No. 37](https://ailawframework.com/frameworks/queensland-law-society.md) - [Notifiable Data Breaches scheme](https://ailawframework.com/frameworks/notifiable-data-breaches.md)