Firm-wide obligation
AI decision systemsAI decision systems (the firm’s and clients’)
Identify the decision, affected people and consequences before deploying an automated system. Review evidence of performance, possible discriminatory effects, privacy requirements and a workable route for human intervention.
Key facts
- Tasks covered
- 4
- Tasks with a step-by-step checklist
- 1
- Local differences
- 2 jurisdictions where this area changes
Jurisdiction
Tasks
GreenLawyer reviewYellowClose supervisionRedLawyer-led
| Task | How AI is used | Human involvement | What the lawyer must review |
|---|---|---|---|
| Map automated decisions that affect individuals in the firm's or client's system | From the system description, list decisions, personal-information inputs, whether a human can override, and what the privacy notice currently says. | RedLawyer-led |
|
| Advise on a client’s automated decision system under EEOC and Colorado ADMT sources | Map the system to hiring, credit, housing or other consequential decisions and to developer vs deployer. | RedLawyer-led |
|
| Advise on an automated decision system under the Privacy Act 2020 | Map personal-information flows, decision points and human-review steps from the client's description. | RedLawyer-led |
|
| Build a legal-risk table for a client's AI system | From the system papers, list candidate privacy, consumer, discrimination and sector issues with the documents that support each row. | YellowClose supervision |
|
| Draft a privacy-impact or algorithmic-impact assessment for the system | Structure an impact assessment from the system description: flows, affected people, risks, mitigations and sign-off questions. | YellowClose supervision |
|
| Compare the system's outputs on a test set for disparate results | From a lawyer-approved test set, tabulate outcomes by the attributes the lawyer has listed and mark unexplained differences. | YellowClose supervision |
|
What changes in New Zealand
| Topic | What changes |
|---|---|
| Governing law | Privacy Act 2020, which is technology-neutral. No Australian ADM statutory overlay unless a New Zealand sector statute says so. |
| Commissioner expects | Senior-leadership approval, a necessity review, a privacy or algorithmic impact assessment, and engagement with Māori where taonga information is affected. |
| Accuracy and use | Procedures for accuracy, access and correction; human review before acting. IPP 8 and IPP 10 apply when personal information is reused to train or decide. |
| Limits on AI assistance |
|
What changes in United States
Known here as: AI decision systems (the firm’s and clients’)
| Topic | What changes |
|---|---|
| Employment | The EEOC says federal discrimination statutes apply to AI in employment decisions. |
| Colorado | From 1 January 2027, SB26-189 duties for developers and deployers of ADMT that materially influences consequential decisions. |
| Other duties | State privacy statutes; California's guidance on biased outputs and Rule 8.4.1. Formal Opinion 512 governs the firm's own tools. |
- EEOC, What is the EEOC’s role in AI? (29 April 2024) · 2026-09-23
- Colorado Senate Bill 26-189 (became law 14 May 2026) · 2026-09-23
- Colorado Attorney General: Automated Decision-Making Technology and Chatbot Safety rulemaking · 2026-09-23
- State Bar of California, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026) · 2026-09-23
- ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024) · 2026-09-23
Precedents for this area
- Law firm AI use policy (master firm policy) (Policy, AI use Yellow). The master AI use policy for an Australian law practice: governance, approved tools, information classes, permitted uses by risk level, verification, court requirements, clients, billing, decisions about people, incidents, training and review.
- Approved AI tools register (template with field guide) (Form, AI use Yellow). Register template recording every AI tool and embedded AI feature the firm uses: owner, approved uses, information classes, data location, training and retention terms, risk rating, assessments, approvals and review dates.
- AI vendor due-diligence questionnaire for law firms (master version) (Checklist, AI use Yellow). Master questionnaire to send to AI vendors before approval: model and hosting, use of firm data, confidentiality, privilege, matter access and court-order fit, security, privacy and cross-border transfers, accuracy, bias, human oversight, agentic features, IP and contract terms.
- AI incident response procedure for law firms (master procedure for all AI incidents) (Policy, AI use Red). Master procedure for detecting, containing, assessing and remedying every kind of AI incident: fabricated citations reaching a court, client data in unapproved tools, harmful outputs from client-facing tools, biased decisions, deepfake impersonation and vendor breaches.
- AI decision system impact and fairness assessment (firm or client systems) (Form, AI use Yellow). Assessment form for any AI or automated system that makes or informs decisions about people: maps decisions and affected people, data, legal risks (privacy, discrimination, consumer, sector rules, EU AI Act), testing, human review, transparency and sign-off.
- Privacy policy clause on automated decisions (APP 1.7 to 1.9, from 10 December 2026) (Clause, AI use Yellow). Privacy policy wording describing the kinds of personal information used, and the kinds of significant decisions made solely or substantially and directly by computer programs, as APP entities must from 10 December 2026, with a short mapping guide and law-firm examples.
All precedents for AI decision systems. Signed-in accounts can read the full text.