--- title: "In-House / General Counsel" url: "https://ailawframework.com/practice/in-house-general-counsel" type: "practice_area" site: "AI Law Framework" id: "A40" task_count: 22 last_reviewed: "2026-10-10" --- # In-House / General Counsel > Set the business objective, legal scope and decision owner before delegating work. Verify inputs across the organisation, protect privileged material and record the conditions for advice, escalation and approval. Canonical page: https://ailawframework.com/practice/in-house-general-counsel Last reviewed: 2026-10-10 Site index for agents: https://ailawframework.com/llms.txt Also covers: General Counsel, Corporate Counsel, Legal Counsel, Chief Legal Officer (CLO), Company Counsel, Legal Operations, In-House Legal Team, Group General Counsel and Company Secretary ## Key facts - Tasks: 22 - Green: 4, Yellow: 16, Red: 2 - Levels: Green is AI drafts and the lawyer checks; Yellow is lawyer and AI draft together; Red is the lawyer writes and AI may only check, clarify or collect data. ## Principles - **Define the matter**: Confirm the client’s instructions, jurisdiction, intended output and the information available before dividing the work. - **Verify the authorities**: Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference. - **Reconcile the figures**: Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts. ## Checklist - Open each relied-on authority independently. Confirm its existence, current status, proposition and any quotation or pinpoint reference. - Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts. - Calculate operative dates independently from the current rule and actual triggering event. Check exceptions and record the verified deadline. - Check the current court or regulator requirements, prescribed form and attachments for the intended document and filing. - Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions. - Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions. - Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time. - Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use. ## Restrictions - Confirm firm, client and applicable court or professional restrictions before using any AI feature. ## Jurisdiction note Apply this guidance to the actual matter and jurisdiction. Confirm current requirements before relying on an example. ## Basis Practice guidance supports planning; the responsible lawyer confirms the scope, evidence and review requirements for the matter. Also covers: General Counsel, Corporate Counsel, Legal Counsel, Chief Legal Officer (CLO), Company Counsel, Legal Operations, In-House Legal Team, Group General Counsel and Company Secretary The in-house General Counsel function spans every legal discipline that touches the enterprise — contracts, employment, regulatory compliance, M&A, dispute management, board advice and IP — operating under the same ASCR obligations as private-practice solicitors while simultaneously managing the organisation's AI governance exposure as a corporate risk matter. The GC function faces a compounded AI risk profile: high-volume, time-pressured workloads create strong adoption incentives, but the breadth of subject matter (contract, employment, regulatory, corporate law simultaneously) means any single hallucination can propagate across legal, compliance and board-reporting functions before a lawyer verifies it. Where the GC also holds the Company Secretary role, the Federal Court's findings in ASIC v Bekier [2026] FCA 196 confirm personal exposure under Corporations Act 2001 (Cth) s 180(1) if material compliance and legal risks — including AI governance failures — are not independently assessed and escalated to the board. ## Limits on AI assistance Red lines — never in this area ## Limits on AI assistance AI must never be the sole source of authority for any case citation, statutory provision or regulatory obligation used in legal advice, board papers, external correspondence or any court-adjacent document — every authority must be independently verified on AustLII, Westlaw AU or LexisNexis AU before use. Public LLMs hallucinate 58–88% of case citations on federal-law queries (Dahl et al.); specialist legal AI tools hallucinate 17–33% (Magesh et al.). AI must never draft or finalise a notifiable data breach (NDB) assessment or notification to the OAIC — the 'serious harm' threshold assessment under s 26WE of the Privacy Act 1988 (Cth) requires qualified lawyer judgment applied to the specific facts of the incident. AI must never classify documents as privileged or not privileged for a privilege log to be produced in litigation, regulatory investigation or compulsory notice response — privilege classification is a non-delegable legal judgment under Australian law (Esso Australia Resources v FCT (1999) 201 CLR 49; dominant-purpose test). AI must never process privileged client documents, board legal advice, litigation strategy, investigation materials or data room documents through a public or consumer-grade AI platform (e.g. public ChatGPT, consumer Gemini, Copilot without enterprise data-protection terms) — this risks privilege waiver under Australian objective-waiver principles and breach of APP 11 security obligations and any applicable data room NDA (Clayton Utz, April 2026; Law Society NSW January 2026 Guide). AI must never be used to set, confirm or override a limitation period, statutory opt-in or opt-out deadline, regulatory notification deadline, or court filing deadline without independent confirmation against the primary instrument — AI training cutoffs and hallucination of operative dates are documented failure modes with direct client-harm consequences. AI must never generate employment law advice on specific individual circumstances (disciplinary action, protected-attribute discrimination, unfair dismissal risk assessment, general protections claims) without lawyer review — instrument misidentification and Fair Work Act misstatements are a documented AI failure mode in Australian practice (Deysel v Electra Lift Co [2025] FWC 2289). AI-generated content — including AI-drafted board papers, internal legal memos and compliance certificates — must never be represented to the board, executives or regulators as the product of independent legal analysis unless a lawyer has substantively reviewed, corrected and adopted the content as their own work. Where the GC is also Company Secretary, ASIC v Bekier [2026] FCA 196 confirms that failing to exercise independent judgment in assessing and escalating material compliance risks is a personal breach of Corporations Act 2001 (Cth) s 180(1). AI must never autonomously approve, execute or recommend execution of any contract, deed, guarantee, settlement deed or instrument — commercial and legal commitments remain the exclusive authority of authorised human signatories. AI must never draft or finalise a response to a statutory investigation notice (s 155 CCA, s 912C Corporations Act, ATO s 264, AFP production order) — the accuracy and completeness of investigation responses carry criminal contempt and obstruction-of-justice exposure that cannot be delegated to AI output. AI must never be used to assess ACCC mandatory pre-merger notification obligations on transactions signed or expected to complete from 1 January 2026 — any AI tool trained before late 2025 will apply the repealed voluntary notification framework and will not reflect the mandatory suspensory regime operative under Part IVA of the Competition and Consumer Act 2010 (Cth). - AI must never be the sole source of authority for any case citation, statutory provision or regulatory obligation used in legal advice, board papers, external correspondence or any court-adjacent document — every authority must be independently verified on AustLII, Westlaw AU or LexisNexis AU before use. Public LLMs hallucinate 58–88% of case citations on federal-law queries (Dahl et al.); specialist legal AI tools hallucinate 17–33% (Magesh et al.). - AI must never draft or finalise a notifiable data breach (NDB) assessment or notification to the OAIC — the 'serious harm' threshold assessment under s 26WE of the Privacy Act 1988 (Cth) requires qualified lawyer judgment applied to the specific facts of the incident. - AI must never classify documents as privileged or not privileged for a privilege log to be produced in litigation, regulatory investigation or compulsory notice response — privilege classification is a non-delegable legal judgment under Australian law (Esso Australia Resources v FCT (1999) 201 CLR 49; dominant-purpose test). - AI must never process privileged client documents, board legal advice, litigation strategy, investigation materials or data room documents through a public or consumer-grade AI platform (e.g. public ChatGPT, consumer Gemini, Copilot without enterprise data-protection terms) — this risks privilege waiver under Australian objective-waiver principles and breach of APP 11 security obligations and any applicable data room NDA (Clayton Utz, April 2026; Law Society NSW January 2026 Guide). - AI must never be used to set, confirm or override a limitation period, statutory opt-in or opt-out deadline, regulatory notification deadline, or court filing deadline without independent confirmation against the primary instrument — AI training cutoffs and hallucination of operative dates are documented failure modes with direct client-harm consequences. - AI must never generate employment law advice on specific individual circumstances (disciplinary action, protected-attribute discrimination, unfair dismissal risk assessment, general protections claims) without lawyer review — instrument misidentification and Fair Work Act misstatements are a documented AI failure mode in Australian practice (Deysel v Electra Lift Co [2025] FWC 2289). - AI-generated content — including AI-drafted board papers, internal legal memos and compliance certificates — must never be represented to the board, executives or regulators as the product of independent legal analysis unless a lawyer has substantively reviewed, corrected and adopted the content as their own work. Where the GC is also Company Secretary, ASIC v Bekier [2026] FCA 196 confirms that failing to exercise independent judgment in assessing and escalating material compliance risks is a personal breach of Corporations Act 2001 (Cth) s 180(1). - AI must never autonomously approve, execute or recommend execution of any contract, deed, guarantee, settlement deed or instrument — commercial and legal commitments remain the exclusive authority of authorised human signatories. - AI must never draft or finalise a response to a statutory investigation notice (s 155 CCA, s 912C Corporations Act, ATO s 264, AFP production order) — the accuracy and completeness of investigation responses carry criminal contempt and obstruction-of-justice exposure that cannot be delegated to AI output. - AI must never be used to assess ACCC mandatory pre-merger notification obligations on transactions signed or expected to complete from 1 January 2026 — any AI tool trained before late 2025 will apply the repealed voluntary notification framework and will not reflect the mandatory suspensory regime operative under Part IVA of the Competition and Consumer Act 2010 (Cth). ## Jurisdiction-specific considerations Australian traps ## Jurisdiction-specific considerations ASCR Rule 9 (confidentiality): Uploading client, counterparty or employer confidential information — including legal advice summaries, data room materials or litigation strategy — to a public AI platform is 'akin to putting it in the public domain' (Law Society NSW, Solicitor's Guide to Responsible Use of AI, January 2026). In-house lawyers who are admitted solicitors remain bound by Rule 9 in respect of their employer-client. ASCR Rule 4.1 (candour to courts and tribunals): AI-generated case citations submitted in any court or tribunal document without independent verification constitute a breach of the candour obligation. The VLSB+C disciplinary outcome involving solicitor Dayal (Handa & Mallick [2024] FedCFamC2F 957 — two-year supervised practice restriction for submitting hallucinated authorities) establishes that ignorance of AI tool limitations is no defence. GC functions briefing external counsel must verify that external counsel's AI protocols meet this standard. Legal professional privilege — dominant purpose test (Esso Australia Resources v FCT (1999) 201 CLR 49): Australian courts apply an objective waiver standard — processing privileged communications through a public AI platform that retains inputs can waive privilege regardless of intent (Clayton Utz, April 2026). Business units routinely upload legal advice summaries to productivity AI tools without legal supervision; the GC function must implement technical and policy controls to prevent this, not merely publish a written prohibition. Corporations Act 2001 (Cth) s 180(1) — GC/Company Secretary as officer: ASIC v Bekier [2026] FCA 196 (Federal Court, Justice Lee, 5 March 2026) found the Group General Counsel and Company Secretary of Star Entertainment personally breached s 180(1) by failing to escalate material legal and compliance risks to the board. The court rejected a delineation between the GC's advisory role and the Company Secretary's board-reporting function. Where a GC holds both roles, AI-generated compliance advice that is not independently assessed and escalated carries personal s 180(1) exposure. Privacy Act 1988 (Cth) APP 1.7–1.9 — Automated Decision-Making transparency obligation: Commences 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024. Organisations using personal information in AI-automated decisions that could significantly affect individual rights must disclose this in their privacy policy. OAIC guidance consultation closed 15 June 2026; guidance expected September 2026. OAIC now has power to issue infringement notices and civil penalty notices for non-compliant privacy policies from December 2026. GC function must identify all ADM uses and update privacy policies before the operative date. ACCC mandatory pre-merger notification regime — Part IVA Competition and Consumer Act 2010 (Cth): Operative from 1 January 2026 (mandatory and suspensory: completion before clearance is prohibited). Threshold: acquirer Australian revenue ≥ A$200 million and transaction/market value ≥ A$200 million. From 1 April 2026, expanded rules capture a broader range of asset acquisitions and creeping/serial acquisitions. Any AI due diligence tool trained before late 2025 will apply the repealed voluntary notification framework — independent legal verification is mandatory for every M&A transaction from 2026. FIRB — annual threshold changes and national security designation: FIRB monetary thresholds change annually with CPI (2026 general threshold: A$347 million for non-FTA investors; $0 threshold for national security businesses). National security businesses (critical infrastructure, telecommunications, defence, data storage) require FIRB approval for any direct interest acquisition regardless of value. AI tools will apply stale thresholds. All FIRB assessments require independent verification against current FIRB guidance at the time of transaction. NSW Supreme Court Practice Note SC Gen 23 (operative from 3 February 2025): Generative AI must not be used to generate the content of affidavits, witness statements or expert reports without leave of court. Disclosure that AI was not used is required in those documents. GC functions must ensure external counsel engaged in NSW proceedings comply; non-compliance has cost and disciplinary consequences. Other Australian courts are developing equivalent protocols — the Law Society NSW AI Hub maintains a current list. Fair Work Act 2009 (Cth) — consultation obligations (Part 6-2): AI-drafted restructuring communications frequently omit the mandatory genuine consultation requirement before redundancy decisions. Failure to consult is an independent ground of unfair dismissal and adverse action, separate from entitlement calculation errors. The specific enterprise agreement or modern award may impose additional consultation steps beyond the NES minimum — AI misidentification of the applicable instrument is a documented failure mode (Deysel v Electra Lift Co [2025] FWC 2289). Australian Privacy Act 1988 (Cth) APP 11 and APP 8 — security and cross-border disclosure: GC function must ensure AI vendor agreements address APP 11 security obligations and, where AI processing occurs offshore, APP 8 cross-border disclosure obligations. OAIC published specific guidance on commercially available AI products (21 October 2024) — this is the operative standard for vendor due diligence and must be applied to every AI tool in the organisation's approved-tools list. Voluntary AI Safety Standard (Department of Industry, Science and Resources, October 2025 Guidance for AI Adoption): Australia's current policy framework relies on 10 voluntary guardrails and existing sector regulators, not a standalone AI Act (National AI Plan, December 2025). However, ASIC's 2025–26 Corporate Plan identifies AI governance as a supervision priority and describes 2026 as a 'Year of Accountability' — voluntary standards can be used by ASIC and other regulators as a benchmark for assessing governance adequacy in enforcement action. - ASCR Rule 9 (confidentiality): Uploading client, counterparty or employer confidential information — including legal advice summaries, data room materials or litigation strategy — to a public AI platform is 'akin to putting it in the public domain' (Law Society NSW, Solicitor's Guide to Responsible Use of AI, January 2026). In-house lawyers who are admitted solicitors remain bound by Rule 9 in respect of their employer-client. - ASCR Rule 4.1 (candour to courts and tribunals): AI-generated case citations submitted in any court or tribunal document without independent verification constitute a breach of the candour obligation. The VLSB+C disciplinary outcome involving solicitor Dayal (Handa & Mallick [2024] FedCFamC2F 957 — two-year supervised practice restriction for submitting hallucinated authorities) establishes that ignorance of AI tool limitations is no defence. GC functions briefing external counsel must verify that external counsel's AI protocols meet this standard. - Legal professional privilege — dominant purpose test (Esso Australia Resources v FCT (1999) 201 CLR 49): Australian courts apply an objective waiver standard — processing privileged communications through a public AI platform that retains inputs can waive privilege regardless of intent (Clayton Utz, April 2026). Business units routinely upload legal advice summaries to productivity AI tools without legal supervision; the GC function must implement technical and policy controls to prevent this, not merely publish a written prohibition. - Corporations Act 2001 (Cth) s 180(1) — GC/Company Secretary as officer: ASIC v Bekier [2026] FCA 196 (Federal Court, Justice Lee, 5 March 2026) found the Group General Counsel and Company Secretary of Star Entertainment personally breached s 180(1) by failing to escalate material legal and compliance risks to the board. The court rejected a delineation between the GC's advisory role and the Company Secretary's board-reporting function. Where a GC holds both roles, AI-generated compliance advice that is not independently assessed and escalated carries personal s 180(1) exposure. - Privacy Act 1988 (Cth) APP 1.7–1.9 — Automated Decision-Making transparency obligation: Commences 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024. Organisations using personal information in AI-automated decisions that could significantly affect individual rights must disclose this in their privacy policy. OAIC guidance consultation closed 15 June 2026; guidance expected September 2026. OAIC now has power to issue infringement notices and civil penalty notices for non-compliant privacy policies from December 2026. GC function must identify all ADM uses and update privacy policies before the operative date. - ACCC mandatory pre-merger notification regime — Part IVA Competition and Consumer Act 2010 (Cth): Operative from 1 January 2026 (mandatory and suspensory: completion before clearance is prohibited). Threshold: acquirer Australian revenue ≥ A$200 million and transaction/market value ≥ A$200 million. From 1 April 2026, expanded rules capture a broader range of asset acquisitions and creeping/serial acquisitions. Any AI due diligence tool trained before late 2025 will apply the repealed voluntary notification framework — independent legal verification is mandatory for every M&A transaction from 2026. - FIRB — annual threshold changes and national security designation: FIRB monetary thresholds change annually with CPI (2026 general threshold: A$347 million for non-FTA investors; $0 threshold for national security businesses). National security businesses (critical infrastructure, telecommunications, defence, data storage) require FIRB approval for any direct interest acquisition regardless of value. AI tools will apply stale thresholds. All FIRB assessments require independent verification against current FIRB guidance at the time of transaction. - NSW Supreme Court Practice Note SC Gen 23 (operative from 3 February 2025): Generative AI must not be used to generate the content of affidavits, witness statements or expert reports without leave of court. Disclosure that AI was not used is required in those documents. GC functions must ensure external counsel engaged in NSW proceedings comply; non-compliance has cost and disciplinary consequences. Other Australian courts are developing equivalent protocols — the Law Society NSW AI Hub maintains a current list. - Fair Work Act 2009 (Cth) — consultation obligations (Part 6-2): AI-drafted restructuring communications frequently omit the mandatory genuine consultation requirement before redundancy decisions. Failure to consult is an independent ground of unfair dismissal and adverse action, separate from entitlement calculation errors. The specific enterprise agreement or modern award may impose additional consultation steps beyond the NES minimum — AI misidentification of the applicable instrument is a documented failure mode (Deysel v Electra Lift Co [2025] FWC 2289). - Australian Privacy Act 1988 (Cth) APP 11 and APP 8 — security and cross-border disclosure: GC function must ensure AI vendor agreements address APP 11 security obligations and, where AI processing occurs offshore, APP 8 cross-border disclosure obligations. OAIC published specific guidance on commercially available AI products (21 October 2024) — this is the operative standard for vendor due diligence and must be applied to every AI tool in the organisation's approved-tools list. - Voluntary AI Safety Standard (Department of Industry, Science and Resources, October 2025 Guidance for AI Adoption): Australia's current policy framework relies on 10 voluntary guardrails and existing sector regulators, not a standalone AI Act (National AI Plan, December 2025). However, ASIC's 2025–26 Corporate Plan identifies AI governance as a supervision priority and describes 2026 as a 'Year of Accountability' — voluntary standards can be used by ASIC and other regulators as a benchmark for assessing governance adequacy in enforcement action. ## Risks to address How it goes wrong ## Risks to address Hallucinated case authority in internal legal advice propagating to board papers: AI generates a plausible Australian citation (complete with medium-neutral citation) that does not exist or does not stand for the proposition cited. The GC incorporates it into a compliance advice memo, which is then included in a board paper provided to regulators as the basis for a compliance position. The hallucination is discovered when a regulator cannot locate the case. (Empirical base: public LLMs hallucinate 58–88% of federal case citations — Dahl et al.; specialist tools 17–33% — Magesh et al.) Operative date confusion on new legislation: AI summarises the Privacy and Other Legislation Amendment Act 2024 as 'operative from December 2024' — conflating Royal Assent (10 December 2024) with the ADM transparency obligation commencement (10 December 2026). Organisation treats the obligation as already discharged, misses the actual deadline and faces OAIC civil penalty and infringement notice exposure from December 2026. Privilege waiver through business-unit upload of AI-simplified legal advice: a finance analyst uploads a legal opinion on litigation strategy to a consumer-grade AI tool to produce a CFO summary. The platform's terms permit retention and model-training use. In subsequent litigation, opposing counsel obtains the AI interaction log via subpoena and successfully argues objective waiver under Australian principles — privilege is permanently lost over the underlying advice. ACCC mandatory notification miss on post-January 2026 transaction: AI due diligence tool trained before late 2025 assesses a transaction and advises that ACCC notification is not required, applying the pre-2026 voluntary notification framework. The transaction is completed without mandatory notification. The organisation is required to unwind the acquisition or apply for retrospective clearance under Part IVA of the Competition and Consumer Act 2010 (Cth), with associated commercial disruption and potential civil penalties. M&A deemed change-of-control clause miss at data room scale: AI review of a multi-hundred-document data room classifies a contract as 'no material change-of-control provision.' The contract contains a buried deemed change-of-control trigger activated by acquisition of 20% of shares. Post-completion, the counterparty terminates a material revenue contract. AI error rates on specific legal clause identification in due diligence contexts are documented at 69–88% (Magesh et al.) — this is not a hypothetical risk. FIRB threshold applied at wrong year's figure: AI assesses a foreign acquisition against a $339 million general threshold (2025 figures) without flagging that the 2026 threshold is $347 million, or conversely applies an incorrect threshold for a national security sector target where the threshold is $0. The resulting advice misstates the approval obligation, and the transaction proceeds without required FIRB approval. - Hallucinated case authority in internal legal advice propagating to board papers: AI generates a plausible Australian citation (complete with medium-neutral citation) that does not exist or does not stand for the proposition cited. The GC incorporates it into a compliance advice memo, which is then included in a board paper provided to regulators as the basis for a compliance position. The hallucination is discovered when a regulator cannot locate the case. (Empirical base: public LLMs hallucinate 58–88% of federal case citations — Dahl et al.; specialist tools 17–33% — Magesh et al.) - Operative date confusion on new legislation: AI summarises the Privacy and Other Legislation Amendment Act 2024 as 'operative from December 2024' — conflating Royal Assent (10 December 2024) with the ADM transparency obligation commencement (10 December 2026). Organisation treats the obligation as already discharged, misses the actual deadline and faces OAIC civil penalty and infringement notice exposure from December 2026. - Privilege waiver through business-unit upload of AI-simplified legal advice: a finance analyst uploads a legal opinion on litigation strategy to a consumer-grade AI tool to produce a CFO summary. The platform's terms permit retention and model-training use. In subsequent litigation, opposing counsel obtains the AI interaction log via subpoena and successfully argues objective waiver under Australian principles — privilege is permanently lost over the underlying advice. - ACCC mandatory notification miss on post-January 2026 transaction: AI due diligence tool trained before late 2025 assesses a transaction and advises that ACCC notification is not required, applying the pre-2026 voluntary notification framework. The transaction is completed without mandatory notification. The organisation is required to unwind the acquisition or apply for retrospective clearance under Part IVA of the Competition and Consumer Act 2010 (Cth), with associated commercial disruption and potential civil penalties. - M&A deemed change-of-control clause miss at data room scale: AI review of a multi-hundred-document data room classifies a contract as 'no material change-of-control provision.' The contract contains a buried deemed change-of-control trigger activated by acquisition of 20% of shares. Post-completion, the counterparty terminates a material revenue contract. AI error rates on specific legal clause identification in due diligence contexts are documented at 69–88% (Magesh et al.) — this is not a hypothetical risk. - FIRB threshold applied at wrong year's figure: AI assesses a foreign acquisition against a $339 million general threshold (2025 figures) without flagging that the 2026 threshold is $347 million, or conversely applies an incorrect threshold for a national security sector target where the threshold is $0. The resulting advice misstates the approval obligation, and the transaction proceeds without required FIRB approval. ## Review checklist The lawyer's review checklist ## Review checklist Source verification: every case name, statutory provision, regulatory threshold, limitation period or numerical obligation in AI output has been independently confirmed on AustLII, Westlaw AU or LexisNexis AU — not accepted from AI output alone; any citation not immediately located on a primary database is treated as a likely hallucination and removed. Privilege hygiene: confirm no confidential legal advice, privileged communication, data room document, investigation material or litigation strategy has been processed through a public or non-enterprise AI tool; verify the AI platform's data terms contractually prohibit retention and training use of input data. Date accuracy: every operative date, commencement date, notice period, renewal deadline, limitation period or court filing deadline extracted by AI has been confirmed against the primary source instrument — not the AI summary; Royal Assent date vs commencement date discrepancies must be explicitly checked (Privacy and Other Legislation Amendment Act 2024 is the current operative example). Applicable law and instrument check: the AI has correctly identified the federal and state/territory laws, modern awards, enterprise agreements, court rules and regulatory regimes governing this specific matter for this organisation's industry, jurisdiction and entity type — not a generic or out-of-date version; AI-identified instruments must be confirmed to be in force as at the relevant date. ACCC/FIRB/ASIC regulatory threshold check: for any M&A transaction, the ACCC mandatory pre-merger notification threshold and FIRB thresholds have been independently verified against current ACCC and FIRB guidance (not AI training data), noting that thresholds changed on 1 January 2026 and are updated annually. s 180 and board-reporting check (for GC/Company Secretary): where the GC also holds Company Secretary duties, AI-generated board papers and compliance reports have been substantively reviewed to ensure material legal and compliance risks are accurately characterised and escalated — applying the ASIC v Bekier [2026] FCA 196 standard of independent officer judgment. ASCR compliance checkpoint: the lawyer has exercised independent professional judgment on the substantive legal question and adopted the AI output as their own work; the AI has assisted, not replaced, the legal analysis; for any document going to a court, tribunal, regulator or external counterparty, the lawyer can attest to its accuracy without qualification. Data handling log: the AI tool used, the data inputted (with classification level: confidential / privileged / public), the date and the reviewing lawyer are recorded in the matter file — this creates the audit trail required if a privilege waiver question, OAIC investigation or ASIC inquiry arises later. - Source verification: every case name, statutory provision, regulatory threshold, limitation period or numerical obligation in AI output has been independently confirmed on AustLII, Westlaw AU or LexisNexis AU — not accepted from AI output alone; any citation not immediately located on a primary database is treated as a likely hallucination and removed. - Privilege hygiene: confirm no confidential legal advice, privileged communication, data room document, investigation material or litigation strategy has been processed through a public or non-enterprise AI tool; verify the AI platform's data terms contractually prohibit retention and training use of input data. - Date accuracy: every operative date, commencement date, notice period, renewal deadline, limitation period or court filing deadline extracted by AI has been confirmed against the primary source instrument — not the AI summary; Royal Assent date vs commencement date discrepancies must be explicitly checked (Privacy and Other Legislation Amendment Act 2024 is the current operative example). - Applicable law and instrument check: the AI has correctly identified the federal and state/territory laws, modern awards, enterprise agreements, court rules and regulatory regimes governing this specific matter for this organisation's industry, jurisdiction and entity type — not a generic or out-of-date version; AI-identified instruments must be confirmed to be in force as at the relevant date. - ACCC/FIRB/ASIC regulatory threshold check: for any M&A transaction, the ACCC mandatory pre-merger notification threshold and FIRB thresholds have been independently verified against current ACCC and FIRB guidance (not AI training data), noting that thresholds changed on 1 January 2026 and are updated annually. - s 180 and board-reporting check (for GC/Company Secretary): where the GC also holds Company Secretary duties, AI-generated board papers and compliance reports have been substantively reviewed to ensure material legal and compliance risks are accurately characterised and escalated — applying the ASIC v Bekier [2026] FCA 196 standard of independent officer judgment. - ASCR compliance checkpoint: the lawyer has exercised independent professional judgment on the substantive legal question and adopted the AI output as their own work; the AI has assisted, not replaced, the legal analysis; for any document going to a court, tribunal, regulator or external counterparty, the lawyer can attest to its accuracy without qualification. - Data handling log: the AI tool used, the data inputted (with classification level: confidential / privileged / public), the date and the reviewing lawyer are recorded in the matter file — this creates the audit trail required if a privilege waiver question, OAIC investigation or ASIC inquiry arises later. ## Tasks (22) | Task | Level | How AI is used | What the lawyer must review | | --- | --- | --- | --- | | Review an NDA, supply, SaaS or services contract against the playbook | Yellow | Compare the paper to the organisation's playbook, flag missing liability, IP, data and termination protections, and propose mark-up. | Read unflagged clauses for interaction effects Approve every tracked change before it goes back to the business | | Extract dates and obligations from a signed contract into a tracker | Yellow | Pull renewal windows, notice periods, audit rights, price reviews and payment milestones into a table with clause references. | Check every date against the signed text, including relative triggers Check day and month order: a transposed day loses a renewal | | [Build a regulatory-change table for the jurisdictions the business operates in](https://ailawframework.com/practice/in-house-general-counsel/build-a-regulatory-change-table-for-the-jurisdictions-the-business-opera.md) | Yellow | From the sources the lawyer has selected, list changes that appear to touch the business, with commencement dates and a note of what still needs a human read. | Confirm the operative date: assent or enactment is not commencement Confirm the change actually applies to this entity | | [Build a buy-side or sell-side legal due-diligence issues list](https://ailawframework.com/practice/in-house-general-counsel/build-a-buy-side-or-sell-side-legal-due-diligence-issues-list.md) | Yellow | From the data room, extract material contracts, change-of-control, litigation and consent items into a risk-ranked issues list with document references. | Open every flagged change-of-control clause, including deemed-control definitions Check for thresholds such as a 20% trigger: missing one is a deal problem | | Draft a board legal-risk paper from the underlying advice | Yellow | Turn the underlying memos into a board-paper section with issues, residual risk and decisions sought, plus a list of points that would distort the advice if… | Check the board paper does not distort the advice Decide privilege and waiver questions yourself | | Build a privilege log from the document set | Red | From the mail and document-system export, extract each item's author, recipients, date, custodian and document type, group email threads and near-duplicates,… | The lawyer decides each privilege claim on the dominant-purpose test and reads back their own descriptions to confirm none discloses the advice or the… | | Draft an external-counsel brief and an invoice check against the engagement | Yellow | Produce a first-draft brief from the email thread and papers, and compare invoices to the fee estimate and scope. | Check the brief matches instructions and does not omit inconvenient facts Do not reduce fees on an invoice review without a human read | | [Draft the organisation's AI-use policy and review an AI-vendor contract](https://ailawframework.com/practice/in-house-general-counsel/draft-the-organisation-s-ai-use-policy-and-review-an-ai-vendor-contract.md) | Yellow | Produce a first-draft acceptable-use policy from the actual tool inventory, and an issues list on the vendor's data, training, indemnity and audit terms. | Check the policy matches the tools the business actually uses Do not adopt a generic policy that ignores shadow AI: it is worse than none | | [Build a hold notice and a response pack for a regulator notice](https://ailawframework.com/practice/in-house-general-counsel/build-a-hold-notice-and-a-response-pack-for-a-regulator-notice.md) | Red | Break the regulator's notice into its numbered demands and, against each one, extract the date range, the entity, the document category, and the compliance… | The lawyer reads the tool's breakdown back against the notice itself — every numbered demand, date range, entity and the compliance date — since nothing else… | | Build a dispute-intake snapshot from the claim papers | Yellow | Extract parties, limitation candidates, hearing dates and a first-pass issues list from the claim documents, with a note of what still needs a quantum… | Decide limitation and forum yourself Do not treat a generated quantum as a reserve | | Triage incoming legal requests into a sorted intake list | Yellow | From the request queue, classify each item, draft a first response to routine ones, and route the rest with a suggested owner and due date. | Decide priority and who owns each matter Do not send a generated response to the business until it is settled | | Draft a first-pass NDA, MSA or SOW from the template and the deal facts | Yellow | Fill the approved template from the business request and list clauses that still need a commercial input. | Check governing law, liability and data terms against the playbook Do not treat a filled template as a signed contract | | Find prior internal advice on a question from the knowledge store | Green | Search the permitted prior-advice store and return the closest memos, positions and clauses with sources, plus a note when nothing on point is found. | Confirm the prior advice is still current and was given to this organisation Do not treat a neighbour's memo as this deal's advice | | Draft a litigation-hold notice from the claim or investigation | Yellow | Produce a hold notice listing systems, custodians and date ranges from the claim or regulator notice. | Check the hold matches the dispute Avoid over-broad and under-broad holds: both create risk | | Evaluate a legal AI tool for the in-house team | Green | Build a requirements and risk matrix (security, data use, accuracy). | GC approves selection. | | Draft the company's internal GenAI acceptable-use policy | Yellow | Draft policy covering approved tools, confidentiality and review. | Lawyer adapts to business and law. | | Triage incoming contract requests | Green | Classify requests by type, risk and urgency into a queue. | Lawyer checks risk classification. | | Summarise board papers for legal risk issues | Yellow | Flag legal risks and privilege issues in board papers. | GC reviews; consider privilege before uploading. | | Build a regulatory-change digest for the business | Yellow | Summarise new laws and regulator updates relevant to the business. | Lawyer verifies each item against the source. | | Run a privilege review of business users' AI use | Yellow | Assess where staff use of AI creates privilege risk. | GC sets policy. | | Build a legal-team GenAI playbook | Green | Draft use cases and guardrails. | GC approves. | | Assess AI-related dispute exposure | Yellow | Map supplier, product and liability exposure. | Lawyer advises. | ## Jurisdiction notes ### Australia #### Professional duties In-house lawyers carry the same ASCR duties as private practitioners, and also manage the organisation's AI governance as a corporate risk. #### Spread of errors One wrong output can pass into compliance and board reporting before a lawyer checks it. Verify before anything leaves the legal team. #### Company secretary Where the GC is also company secretary, ASIC v Bekier [2026] FCA 196 confirms personal exposure under Corporations Act 2001 (Cth) s 180(1) if material risks, including AI governance, are not escalated. ### New Zealand #### Conduct rules The Conduct and Client Care Rules apply to in-house lawyers, including sections specific to in-house practice. #### Privacy and AI Privacy Act 2020 and the Law Society generative-AI guidance. #### Employment Employment Relations Act 2000, not the Fair Work Act. #### Regulators FMA, Commerce Commission, Inland Revenue, WorkSafe and the Privacy Commissioner, not ASIC, the ACCC or the ATO. Sources: - [Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008](https://www.legislation.govt.nz/secondary-legislation/pco-drafted/2008/214/en/latest/) (checked 2026-09-23) - [NZLS: Generative AI guidance for lawyers (March 2024)](https://www.lawsociety.org.nz/professional-practice/rules-and-maintaining-professional-standards/generative-ai-guidance-for-lawyers/) (checked 2026-09-23) - [OPC: Privacy Act 2020 information privacy principles](https://www.privacy.org.nz/privacy-principles/) (checked 2026-09-23) - [Employment Relations Act 2000](https://www.legislation.govt.nz/act/public/2000/24/en/latest/) (checked 2026-09-23) - [Financial Markets Conduct Act 2013](https://www.legislation.govt.nz/act/public/2013/69/en/latest/) (checked 2026-09-23) ### United States Local name: In-house / general counsel #### Ethics The Model Rules apply in-house. Formal Opinion 512, California's 2026 guidance (including agentic AI) and the admitting state's opinion govern company tools. #### Supervision Rules 5.1 and 5.3 cover non-lawyer staff and vendors. #### Privilege US attorney-client privilege and work product, not Australian legal professional privilege. A public tool is still a third party. Sources: - [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23) - [State Bar of California, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026)](https://www.calbar.ca.gov/Portals/0/documents/ethics/Generative-AI-Practical-Guidance.pdf) (checked 2026-09-23) - [ABA Model Rule 5.1, Responsibilities of a Partner or Supervisory Lawyer](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_1_responsibilities_of_a_partner_or_supervisory_lawyer/) (checked 2026-09-23) - [ABA Model Rule 5.3, Responsibilities Regarding Nonlawyer Assistance](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_5_3_responsibilities_regarding_nonlawyer_assistance/) (checked 2026-09-23) - [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-09-23) *Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*