Solicitor confidentiality
Rule 9 is binding conduct law. It is in force under the Uniform Law for solicitors in New South Wales, Victoria and Western Australia, and in Queensland through the Australian Solicitors’ Conduct Rules 2023 (version 2), notified under the Legal Profession Act 2007 (Qld). Elsewhere, check the conduct rules that apply to the solicitor’s own jurisdiction.
Rule 9 forbids disclosure of a client’s confidential information, acquired during the engagement, except in the cases rule 9.2 lists.
MaintainedLast reviewed
Key facts
- Issued by
- Legal Services Council (Uniform Law); adopted rules in other jurisdictions
- Sources listed
- 4
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
Rule 9.1 of the Legal Profession Uniform Law Australian Solicitors’ Conduct Rules 2015 says a solicitor must not disclose any information which is confidential to a client and acquired by the solicitor during the client’s engagement, to any person who is not a solicitor who is a partner, principal, director or employee of the solicitor’s law practice, or a barrister or an employee of, or a person otherwise engaged by, the law practice or an associated entity for the purpose of delivering or administering legal services in relation to the client. The exceptions are in rule 9.2.
Rule 9.2 permits disclosure if the client expressly or impliedly authorises it; if the solicitor is permitted or compelled by law to disclose; if the disclosure is in a confidential setting for the sole purpose of obtaining advice on the solicitor’s legal or ethical obligations; if it is for the sole purpose of avoiding the probable commission of a serious criminal offence; if it is for the purpose of preventing imminent serious physical harm to the client or to another person; or if it is to the insurer of the solicitor, the law practice or an associated entity.
Who it applies to
These rules are in force under the Uniform Law for solicitors in New South Wales, Victoria and Western Australia. The text checked is the New South Wales in-force compilation. The Law Council records the same Australian Solicitors’ Conduct Rules as applying in New South Wales and Victoria from 1 July 2015 and in Western Australia from 1 July 2022. Queensland solicitors are covered too, but through a different instrument: the Australian Solicitors’ Conduct Rules 2023 (version 2), made by the Queensland Law Society and notified as solicitors rules under the Legal Profession Act 2007 (Qld) by the Legal Profession (Australian Solicitors Conduct Rules) Notice 2026 (SL No. 144), which repealed the 2024 Notice. The Queensland register shows inconsistent notification and commencement dates for that Notice, so confirm the version in force on the register. Those are statutory conduct rules, not Society guidance, and Queensland has its own numbering, so read them directly. Queensland Law Society Guidance Statement No. 37 is guidance with no legislative effect; it corroborates that rule 9 matters for AI use but is not the source of the duty. For any other state or territory, read the conduct rules that apply there. The duty of confidentiality is not unique to rule 9, but the wording above is the Uniform Law wording. Do not assume an identical sub-rule number elsewhere without reading that jurisdiction’s instrument.
The Law Society of New South Wales ethics FAQ says the duty continues after the retainer ends, and that on the client’s death it passes to the legal personal representative.
What it asks of a law firm using AI
- Do not disclose client confidential information to a person outside the categories in rule 9.1, unless rule 9.2 applies.
- A provider of an AI tool is not, merely by selling software, a person engaged by the law practice to deliver or administer legal services for that client. If the firm wants to rely on rule 9.1.2, the engagement and the purpose have to match the rule. This page does not advise that a public chatbot meets it.
- Client authorisation under rule 9.2.1 has to be real. A privacy policy the client never saw is not the client’s authority. Implied authority depends on the facts of the retainer. The rule states the exception. It does not say that every client impliedly agrees to a public model.
- Compulsion by law is an exception. The New South Wales ethics FAQ says a request is not compulsion. A vendor’s terms of service are not a law that compels disclosure.
- The December 2024 Uniform Law statement says solicitors cannot safely put confidential, sensitive or privileged client information into a public AI tool. That is the regulators’ application of the duty to those tools. Privilege and confidentiality are related and they are not the same. Losing one is not automatically losing the other. The FAQ says the client may lose privilege. “May” is the FAQ’s word.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | Before client confidential information is put into a tool, the firm has to be able to say who will receive it and on what obligation. That is a confidentiality reading of the contract. It sits inside due diligence because the contract is one of the documents the firm reads. |
| Confidentiality Whether client and other confidential information can go into the tool. | This is the duty. The framework’s confidentiality condition is how the firm records, for a tool and a task, whether client confidential information is allowed into that tool and on what terms. Rule 9 is the reason the condition exists for Uniform Law solicitors. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Telling the client that AI will be used can be how express authority under rule 9.2.1 is obtained, where authority is needed. It can also be required by a court or by a society’s guidance even when rule 9 is not the source. The two should not be collapsed. Authority to disclose information to a vendor is not the same act as telling a court how a document was drafted. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | A certificate does not satisfy rule 9. It may help the firm decide whether a commercial recipient will keep the information secure. The December 2024 statement still requires the contract to be read. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Where the data is stored can change who is “any person” receiving the information, and which country’s law applies to that recipient. The rule does not name a country. An overseas recipient is still a disclosure unless an exception applies. |
Sources
- Legal Profession Uniform Law Australian Solicitors’ Conduct Rules 2015 (NSW), rule 9
- Queensland, Legal Profession (Australian Solicitors Conduct Rules) Notice 2026 (SL No. 144), notifying the Australian Solicitors’ Conduct Rules 2023, version 2 (repeals the 2024 Notice)
- Law Council of Australia, Australian Solicitors’ Conduct Rules
- Law Society of NSW, Ethics FAQs
Checked 2026-10-10. Issued by Legal Services Council (Uniform Law); adopted rules in other jurisdictions.