Firm-wide obligation
Confidentiality & client informationConfidentiality and client information
Work through the confidentiality questions in the professional guidance that applies before any client file is uploaded. The terms of the tool are the evidence. The documents stay out until those questions are answered.
Key facts
- Tasks covered
- 5
- Tasks with a step-by-step checklist
- 1
- Local differences
- 2 jurisdictions where this area changes
Jurisdiction
Tasks
GreenLawyer reviewYellowClose supervisionRedLawyer-led
| Task | How AI is used | Human involvement | What the lawyer must review |
|---|---|---|---|
| Decide whether client material can go into a tool | Organise the provider’s terms against the confidentiality questions in current professional guidance, using only the terms, not the client file. | YellowClose supervision |
|
| Decide whether client material can go into a Queensland tool | Organise the provider’s terms against the confidentiality questions in Guidance Statement No. 37, using only the terms, not the client file. | YellowClose supervision |
|
| Decide whether US client material can go into a tool | Classify each document as public, confidential under Rule 1.6, PHI, tax-return information, or California consumer personal information. | YellowClose supervision |
|
| Decide whether New Zealand client material can go into a tool | Classify each proposed input as public, personal, confidential, privileged or suppressed. | YellowClose supervision |
|
| Build an inventory of tools that can see client material | From the firm's subscriptions, browser extensions and approved-tool list, produce an inventory of systems that can access client files, with current terms linked. | YellowClose supervision |
|
| Compare a provider's terms on storage, training and subprocessors | Extract retention, training-on-customer-data, subprocessor and deletion terms into a table against the confidentiality questions in the professional guidance. | YellowClose supervision |
|
| Draft an information-barrier protocol from the conflict papers | Produce a first-draft barrier protocol listing people, systems and folders that must be kept apart, from the conflict papers the lawyer has approved. | YellowClose supervision |
|
| Build an upload checklist for a matter before any file goes into a tool | From the matter type and the approved-tool list, produce a checklist of what may be uploaded, what must be redacted, and which tool is permitted. | YellowClose supervision |
|
What changes in New Zealand
| Topic | What changes |
|---|---|
| Conduct rules | Chapter 8 of the Conduct and Client Care Rules. The Law Society says client or privileged material in a public tool may breach it. |
| Court guidelines | Generally do not enter anything not already public. Never enter private, confidential, suppressed or privileged information. Report suppressed disclosures to the registry. |
| Privacy | Privacy Act 2020 applies to personal information, including IPP 12 for overseas processing. |
| Practice | Consider client consent. Use fictional data for testing. |
| Limits on AI assistance |
|
- Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008 · 2026-09-23
- Courts of New Zealand: GenAI guidelines — Lawyers (7 December 2023) · 2026-09-23
- NZLS: Generative AI guidance for lawyers (March 2024) · 2026-09-23
- OPC: Generative artificial intelligence (15 June 2023) · 2026-09-23
- OPC: Privacy Act 2020 information privacy principles · 2026-09-23
What changes in United States
Known here as: Confidentiality and client information
| Topic | What changes |
|---|---|
| Rule 1.6(c) | Make reasonable efforts to prevent unauthorised disclosure of, or access to, information relating to the representation. |
| Ethics opinions | Formal Opinion 512, Florida 24-1, California's guidance, Texas 705 and D.C. 388: no public or self-learning tool unless terms and security are adequate or the client consents. |
| Other duties | Work product (Rule 26(b)(3)(B)); HIPAA; tax-return information (IRC §§ 6713, 7216); CCPA. |
| Before any input | Read retention, training and subprocessor terms. Supervisors set the policy (Rules 5.1 and 5.3), including for agentic tools. |
| Limits on AI assistance |
|
- ABA Model Rule 1.6, Confidentiality of Information · 2026-09-23
- ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024) · 2026-09-23
- Florida Bar Ethics Opinion 24-1 · 2026-09-23
- State Bar of California, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026) · 2026-09-23
- Texas Professional Ethics Committee Opinion 705 (February 2025) · 2026-09-23
- District of Columbia Bar Ethics Opinion 388 · 2026-09-23
- HHS: HIPAA covered entities and business associates · 2026-09-23
- IRS Office of Professional Responsibility, Issue 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice · 2026-09-23
- California Attorney General: California Consumer Privacy Act (CCPA) · 2026-09-23
- Federal Rule of Civil Procedure 26 · 2026-09-23
Precedents for this area
- AI confidentiality rules for staff (short form of the firm AI policy) (Policy, AI use Yellow). Short-form confidentiality rules drawn from the firm's master AI use policy: which information classes may go into which tools, court-restricted material, privilege and barriers, client choices, note-takers and agents, and incident reporting, with an upload checklist.
- Staff and contractor AI confidentiality undertaking and acknowledgement (Form, AI use Yellow). A signed undertaking by each lawyer, staff member and contractor to follow the firm's AI confidentiality controls: approved tools only, no personal accounts, no bypassing controls or barriers, verification, incident reporting, monitoring and duties after leaving.
- AI vendor confidentiality and privilege questions (short form of the vendor due-diligence questionnaire) (Checklist, AI use Yellow). Short-form vendor questions on confidentiality only: training and other use of firm data, retention and deletion, location and sub-processors, matter access and information barriers, court conditions for restricted material, confidentiality terms and incident notice.
- Engagement clause: client authority for AI processing of confidential information (rider to the AI engagement clauses) (Clause, AI use Yellow). Confidentiality rider for the engagement letter: the firm's safeguards for AI processing, the client's express, limited or refused authority under ASCR r 9.2.1, and overseas processing. Use with the AI engagement and costs clauses, not instead of them.
- AI data incident steps (confidentiality short form of the AI incident response procedure) (Policy, AI use Yellow). Confidentiality steps for AI incidents that expose information (public chatbots, wrong workspaces, vendor leaks, misdirecting agents, restricted court material, note-taker bots), with the privilege, privacy, court-order and barrier assessment. Runs inside the master procedure.
All precedents for Confidentiality & client information. Signed-in accounts can read the full text.