---
title: "Evaluate an artificial-intelligence know-how vendor against confidentiality duties"
url: "https://ailawframework.com/practice/knowledge-management/evaluate-an-ai-km-vendor/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "KM-B12-25-US"
practice_area: "Knowledge Management"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Evaluate an artificial-intelligence know-how vendor against confidentiality duties

> List what the vendor's documents say about who can access inputs, whether inputs are used to train a model, and where the documents say information is stored. Write no conclusion that the vendor is suitable.

Canonical page: https://ailawframework.com/practice/knowledge-management/evaluate-an-ai-km-vendor/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Knowledge Management](https://ailawframework.com/practice/knowledge-management.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List what the vendor's documents say about who can access inputs, whether inputs are used to train a model, and where the documents say information is stored. Write no conclusion that the vendor is suitable. |
| What the lawyer must review | You decide whether the firm may use the vendor. Model Rule 1.6(a) and (c) prohibit revealing information relating to a representation without a ground in the rule, and require reasonable efforts against unauthorised disclosure or access. ABA Formal Opinion 512 says informed consent is required before a lawyer inputs information relating to a representation into a tool that will not keep it confidential, and that the consent discussion includes who will have access. The opinion also discusses confidentiality measures for a vendor, including configuration, agreements and the lawyer's understanding of the tool. Model Rule 1.1 requires competence in that choice. Comment 6, on retaining lawyers outside the firm, is a different rule. It was not used as the test for a software vendor. You do not send client information to the vendor in order to test it unless Rule 1.6 allows that input. |
| Written for | United States |
| Applies to | [Evaluate an AI KM vendor](https://ailawframework.com/practice/knowledge-management/evaluate-an-ai-km-vendor.md) |

## Checking plan

- What the AI does: List what the vendor's documents say about who can access inputs, whether inputs are used to train a model, and where the documents say information is stored. Write no conclusion that the vendor is suitable.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A missing statement in the vendor's documents is a gap, not a finding that the vendor keeps information confidential.
- No market survey or security certification was opened. Do not add one.

## Sources

- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)
- [ABA Model Rule 1.6, Confidentiality of information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)
- [ABA Model Rule 1.1, Competence](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Privacy due diligence before an AI knowledge vendor is chosen](https://ailawframework.com/precedents/knowledge-management/ai-vendor-privacy-due-diligence.md) | Checklist | Yellow | A worksheet of the privacy questions the OAIC says an organisation should answer before it adopts a commercially available AI product, including training data, security, and who can see the inputs. |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*