---
title: "Build a matter upload checklist before any file goes into a tool"
url: "https://ailawframework.com/obligations/confidentiality-and-client-information/build-an-upload-checklist-for-a-matter-before-any-file-goes-into-a-tool/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A51-A20260923-4-US"
practice_area: "Confidentiality & client information"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Build a matter upload checklist before any file goes into a tool

> For the categories the lawyer names, list whether the material is information relating to a representation, work product, or protected health information, and the restriction the lawyer has already marked.…

Canonical page: https://ailawframework.com/obligations/confidentiality-and-client-information/build-an-upload-checklist-for-a-matter-before-any-file-goes-into-a-tool/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Confidentiality & client information](https://ailawframework.com/obligations/confidentiality-and-client-information.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | For the categories the lawyer names, list whether the material is information relating to a representation, work product, or protected health information, and the restriction the lawyer has already marked. Do not upload anything. |
| What the lawyer must review | Comment 18 to Model Rule 1.6 requires competent safeguards against unauthorised access and inadvertent disclosure. Formal Opinion 512 treats input of information relating to the representation into a self-learning tool as a confidentiality problem unless the client gives informed consent or the disclosure is impliedly authorised. A covered entity or business associate may not use or disclose protected health information except as 45 CFR § 164.502 permits or requires. You decide the category and whether the tool is allowed to see it. |
| Written for | United States |
| Applies to | [Build an upload checklist for a matter before any file goes into a tool](https://ailawframework.com/obligations/confidentiality-and-client-information/build-an-upload-checklist-for-a-matter-before-any-file-goes-into-a-tool.md) |

## Checking plan

- What the AI does: For the categories the lawyer names, list whether the material is information relating to a representation, work product, or protected health information, and the restriction the lawyer has already marked. Do not upload anything.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- 45 CFR § 164.502(a) is the general rule. The HHS covered-entity page points to the definitions in 45 CFR § 160.103, which this check did not open.
- D.C. Opinion 388 treats a lawyer's mental impressions as work product that should not be handed to a third-party tool without a proper basis.

## Sources

- [ABA Model Rule 1.6, Comment](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)
- [45 CFR § 164.502 (uses and disclosures of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Checklist before any file on a matter goes into a tool](https://ailawframework.com/precedents/confidentiality-and-client-information/matter-tool-upload-checklist.md) | Checklist | Yellow | Matter-by-matter checklist before a document is put into a tool: confidentiality, court limits, personal information, overseas handling, the client's instructions, and any information barrier. |
| [Protocol before using a self-learning generative AI tool (United States)](https://ailawframework.com/precedents/confidentiality-and-client-information/us-self-learning-gai-confidentiality-protocol.md) | Checklist | Yellow | A check before anyone puts information relating to a representation into a generative AI tool that may learn from inputs or reveal them in later output, including to someone behind an ethical wall. |
| [Staff undertaking on unapproved generative AI tools (United States)](https://ailawframework.com/precedents/confidentiality-and-client-information/us-staff-undertaking-unapproved-gai.md) | Letter | Yellow | A short undertaking by a lawyer or staff member not to put firm or client information into a generative AI tool the firm has not approved, and to tell a supervisor if that happens. |
| [Check before using a hypothetical in a generative AI tool (United States)](https://ailawframework.com/precedents/confidentiality-and-client-information/us-hypothetical-prompt-check.md) | Checklist | Yellow | A check that a prompt is a true hypothetical under Rule 1.6 Comment [4]: no reasonable likelihood that the tool, or a later reader of the output, could identify the client or the situation. |
| [Confidentiality undertaking for an external reviewer or expert](https://ailawframework.com/precedents/confidentiality-and-client-information/external-confidentiality-undertaking.md) | Letter | Yellow | Undertaking by a person outside the practice who will see client material, limiting use to a stated purpose and prohibiting upload to a tool the practice has not approved for that material. |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*