--- title: "Confidentiality & client information" url: "https://ailawframework.com/obligations/confidentiality-and-client-information" type: "obligation" site: "AI Law Framework" id: "A51" task_count: 5 last_reviewed: "2026-09-23" --- # Confidentiality & client information > Work through the confidentiality questions in the professional guidance that applies before any client file is uploaded. The terms of the tool are the evidence. The documents stay out until those questions are answered. Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information Last reviewed: 2026-09-23 Site index for agents: https://ailawframework.com/llms.txt Also covers: Client confidentiality, information barriers, provider terms, professional secrecy, QLS Guidance Statement No. 37 This page is a firm-wide obligation, not a practice area. It holds the confidentiality questions that apply before client material goes into a tool. The Queensland Law Society Guidance Statement No. 37 is the worked example. Other societies and forums have their own questions. Name the instrument that applies to the file. ## Key facts - Tasks: 5 - Green: 0, Yellow: 5, Red: 0 - Levels: Green is AI drafts and the lawyer checks; Yellow is lawyer and AI draft together; Red is the lawyer writes and AI may only check, clarify or collect data. ## Principles - **Ask the confidentiality questions first**: Read the current professional guidance. If the provider’s terms do not say how confidential data is stored, reused and shared, do not upload. - **Anonymising names is not a full answer**: Removing a name does not make a file public. Privilege, safety and suppression still apply. - **Record the decision**: Write down whether the terms are clear enough. Revisit the note if the provider changes the terms or the tool. ## Checklist - Name the professional guidance that applies to this practice. - Answer its confidentiality questions from the current terms, in writing. - If the answers are unclear, do not upload confidential material. - Revisit the note if the provider or the tool changes. ## Restrictions - Do not put client material into a public tool to “see if it works”. ## Jurisdiction note Guidance Statement No. 37 is a Queensland example. Confirm the instrument that applies to the practising certificate and the file. ## Basis Planning guidance. Confirm the current professional guidance before reliance. ## What this obligation is Confidentiality is a firm-wide obligation. It is not a litigation task and it is not a chatbot product page. Ask the current professional questions before client material goes into a tool. ## Review checklist - Name the professional guidance that applies to this practice. - Answer its confidentiality questions from the current terms, in writing. - If the answers are unclear, do not upload confidential material. - Revisit the note if the provider or the tool changes. ## Tasks (5) | Task | Level | How AI is used | What the lawyer must review | | --- | --- | --- | --- | | [Decide whether client material can go into a tool](https://ailawframework.com/obligations/confidentiality-and-client-information/decide-whether-client-material-can-go-into-a-tool.md) | Yellow | Organise the provider’s terms against the confidentiality questions in current professional guidance, using only the terms, not the client file. | Check the terms answer how confidential data is stored, reused and shared Do not upload the file if they do not Record the decision | | Build an inventory of tools that can see client material | Yellow | From the firm's subscriptions, browser extensions and approved-tool list, produce an inventory of systems that can access client files, with current terms… | Include shadow tools the lawyers actually use Check translators and grammar tools: each is still a disclosure path | | Compare a provider's terms on storage, training and subprocessors | Yellow | Extract retention, training-on-customer-data, subprocessor and deletion terms into a table against the confidentiality questions in the professional guidance. | Read the current terms, not a summary Record the version and date relied on: terms change Do not upload if storage, reuse or sharing is unclear | | Draft an information-barrier protocol from the conflict papers | Yellow | Produce a first-draft barrier protocol listing people, systems and folders that must be kept apart, from the conflict papers the lawyer has approved. | Confirm access lists before the second matter opens Check the document-management system can enforce the barrier | | Build an upload checklist for a matter before any file goes into a tool | Yellow | From the matter type and the approved-tool list, produce a checklist of what may be uploaded, what must be redacted, and which tool is permitted. | Do not upload unless the terms and matter sensitivity clearly allow it Record the decision on the file | ## Jurisdiction notes ### New Zealand #### Conduct rules Chapter 8 of the Conduct and Client Care Rules. The Law Society says client or privileged material in a public tool may breach it. #### Court guidelines Generally do not enter anything not already public. Never enter private, confidential, suppressed or privileged information. Report suppressed disclosures to the registry. #### Privacy Privacy Act 2020 applies to personal information, including IPP 12 for overseas processing. #### Practice Consider client consent. Use fictional data for testing. - Do not enter private, confidential, suppressed or privileged material into a public chatbot. Sources: - [Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008](https://www.legislation.govt.nz/secondary-legislation/pco-drafted/2008/214/en/latest/) (checked 2026-09-23) - [Courts of New Zealand: GenAI guidelines — Lawyers (7 December 2023)](https://www.courtsofnz.govt.nz/assets/6-Going-to-Court/practice-directions/practice-guidelines/all-benches/20231207-GenAI-Guidelines-Lawyers.pdf) (checked 2026-09-23) - [NZLS: Generative AI guidance for lawyers (March 2024)](https://www.lawsociety.org.nz/professional-practice/rules-and-maintaining-professional-standards/generative-ai-guidance-for-lawyers/) (checked 2026-09-23) - [OPC: Generative artificial intelligence (15 June 2023)](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/generative-artificial-intelligence/) (checked 2026-09-23) - [OPC: Privacy Act 2020 information privacy principles](https://www.privacy.org.nz/privacy-principles/) (checked 2026-09-23) ### United States Local name: Confidentiality and client information #### Rule 1.6(c) Make reasonable efforts to prevent unauthorised disclosure of, or access to, information relating to the representation. #### Ethics opinions Formal Opinion 512, Florida 24-1, California's guidance, Texas 705 and D.C. 388: no public or self-learning tool unless terms and security are adequate or the client consents. #### Other duties Work product (Rule 26(b)(3)(B)); HIPAA; tax-return information (IRC §§ 6713, 7216); CCPA. #### Before any input Read retention, training and subprocessor terms. Supervisors set the policy (Rules 5.1 and 5.3), including for agentic tools. - Do not put information relating to the representation into a public generative tool as a default workflow. Sources: - [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-09-23) - [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23) - [Florida Bar Ethics Opinion 24-1](https://www.floridabar.org/etopinions/opinion-24-1/) (checked 2026-09-23) - [State Bar of California, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026)](https://www.calbar.ca.gov/Portals/0/documents/ethics/Generative-AI-Practical-Guidance.pdf) (checked 2026-09-23) - [Texas Professional Ethics Committee Opinion 705 (February 2025)](https://www.legalethicstexas.com/resources/opinions/opinion-705/) (checked 2026-09-23) - [District of Columbia Bar Ethics Opinion 388](https://www.dcbar.org/for-lawyers/legal-ethics/ethics-opinions-210-present/ethics-opinion-388) (checked 2026-09-23) - [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-09-23) - [IRS Office of Professional Responsibility, Issue 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice](https://www.irs.gov/pub/opr-taxpros/issue-number-2026-19-introductory-guidelines-for-responsible-ai-use-in-federal-tax-practice.pdf) (checked 2026-09-23) - [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-09-23) - [Federal Rule of Civil Procedure 26](https://www.law.cornell.edu/rules/frcp/rule_26) (checked 2026-09-23) ## Sources - [Queensland Law Society Guidance Statement No. 37: Artificial intelligence in legal practice](https://www.qls.com.au/practising-law-in-qld/ethics/guidance-statements/no-37-artificial-intelligence-in-legal-practice) (checked 2026-09-22) *Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*