Queensland Law Society Guidance Statement No. 37
Guidance Statement No. 37 is for Queensland solicitors. It has no legislative effect. It is a standard of good practice.
Guidance Statement No. 37 is a framework for responsible AI use in Queensland legal practice. It has no legislative effect.
MaintainedLast reviewed
Key facts
- Issued by
- Queensland Law Society
- Sources listed
- 1
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
Guidance Statement No. 37 is issued by the Queensland Law Society’s Ethics and Practice Centre for solicitors. Its purpose is to give Queensland legal practitioners a framework for the responsible and ethical use of AI. The Society says the statement has no legislative or statutory effect. Having regard to it may make it easier to account for one’s actions if a complaint is made. It is not legal advice, and it is not necessarily a defence to a conduct complaint. The Society says it represents a standard of good practice.
The Society does not seek to discourage AI, and it does not say AI is incompatible with ethical duties. It says use must sit inside guardrails. It names Australian Solicitors’ Conduct Rules 4, 5, 9, 17, 19 and 37 as imposing professional obligations, and it says fiduciary obligations matter when a third party is given access to client data.
Who it applies to
The statement is for Queensland solicitors and law practices. Solicitors elsewhere can read it. Their own society’s guidance and their own conduct rules are what bind them.
What it asks of a law firm using AI
- Competence: if a practitioner uses AI, or permits its use, they must ensure that they and relevant staff have, or can call on, the skills to use it appropriately. That includes knowing the tool’s limits, being able to tell that a service has an AI component, and knowing enough of the law and the facts to see an error.
- Confidentiality: practitioners should take reasonable steps so that an AI tool does not misuse access to confidential data or unduly expose it. The statement separates high-risk or personally identifiable information from the commercial value in client data.
- The statement says that where the user agreement does not address data use and model training, a proper risk assessment is unlikely to be possible and the tool should be avoided.
- The risk assessment asks where the data is processed, how and where it is stored, who has access and for what purpose, and whether the provider gives an express confidentiality guarantee beyond the uses the terms allow. If the agreement does not clearly answer those questions, the statement says practitioners should be very hesitant before allowing any access to confidential data.
- The statement says practitioners should consider whether the terms are incompatible with keeping the material confidential, and whether the provider’s cybersecurity methodology is certified or audited. Certification is one question on that list. It is not a safe-harbour.
- Disclosure: where feasible, clients should be advised if an AI tool will be used on their work. The more significant the AI contribution, the more stringent the obligation to bring it to the client’s attention. The statement says that where the tool will do substantial work that would ordinarily be done manually, the client should be told, including the types of data the system will see and how risks will be managed. For court, it says that in addition to any practice direction, reasonable efforts should be made to disclose AI involvement in material supplied in proceedings, and to outline the controls, if called on.
- Supervision: AI is an aid, not a replacement for professional judgement. The practitioner remains responsible. An error in the system may explain a failure. The statement says it does not absolve negligent service or misleading a third party.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | The statement says AI can lessen the burden of routine work. It does not treat that saving as a reason to drop competence, confidentiality or supervision. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | The statement’s account of hallucination is that current AI does not understand the content it generates and cannot be relied on to validate its own output, including fictional case references. Checking the output is the effectiveness control. The statement says the check does not always mean redoing every step by hand, and that close supervision at the start, and regular auditing, are essential. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | The four questions — where processed, where stored, who has access, and whether confidentiality is expressly guaranteed — are the statement’s due diligence. An agreement that is silent on training is, in the statement’s words, a reason to avoid the tool. |
| Confidentiality Whether client and other confidential information can go into the tool. | Rule 9 is one of the rules the statement says applies. The operational test is the one quoted above: avoid the tool if training and data use are not in the agreement, and be very hesitant if location, access and an express confidentiality guarantee are not clear. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | “Where feasible, clients should be advised” is the statement’s disclosure sentence, tightened as the AI contribution becomes more significant, and tightened again for substantial tranches of work and for material used in court. It is not a ban on mentioning AI, and it is not a claim that silence is always acceptable. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | The statement asks whether the provider’s cybersecurity methodology is certified or audited. That is one factor in the confidentiality risk assessment. A certificate does not answer the training question, and a missing certificate is not the only reason to refuse a tool. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | “Where is the data being processed?” and “How and where is the data being stored?” are two of the statement’s questions. An unanswered pair is a reason to be very hesitant. The statement does not publish a list of approved countries. |
Sources
Checked 2026-10-10. Issued by Queensland Law Society.