Memo · AI decision systems
File note of a generative AI confidentiality incident (United States)
An internal note made the day the firm learns that information relating to a representation may have been put into a tool in breach of the policy, or that a provider reported unauthorized access.
- Kind
- Memo. An internal or advice memo.
- Where it applies
- United States
- AI use
- Red You write the text. The tool writes nothing into the document. Where permitted, it may check, clarify or collect data, and anything it checks or collects is verified.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the 4 authorities it cites, for United States.
- Version
- 1
- Source
- Written for this library
When to use it
Use the day the firm knows of a possible unauthorized input or a provider notice. It records facts for the lawyer who will decide what Rule 1.6 requires. It is not a notice to the client and not a notice to a regulator.
Used for these tasks
- Map automated decisions that affect individuals in the firm's or client's system
- Build a legal-risk table for a client's AI system
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
The lawyer writes what happened and what will be said to the client. A tool may attach the provider's notice and list names that appear in it. It writes nothing that is sent out.
AI may
- Attach the provider notice and list the dates and system names printed on it
- List matters whose files were open in the tool session, from the firm's own log
AI must not
- Must not decide whether Rule 1.6 requires a disclosure to the client
- Must not draft the client notice or a notice to a regulator
- Must not paste the affected information back into the same tool to investigate it
The lawyer checks
- A named lawyer owns the incident the same day
- Further use of the tool on the affected matters is stopped until that lawyer says otherwise
- Any notice to a client or a regulator is a separate document the lawyer writes after reading the duties that apply
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in AI decision systems
- Inventory of automated decisions that affect individuals
- Law firm AI use policy (master firm policy)
- Law firm generative AI use policy (United States)
- Approved AI tools register (template with field guide)
- Record of a test for different results across groups
- Approval and training record for a generative AI tool (United States)
- AI vendor due-diligence questionnaire for law firms (master version)
- Legal risk table for a client's AI system
- How to mark generative AI output in the file (United States)
- AI incident response procedure for law firms (master procedure for all AI incidents)
- Record that a person reviewed an automated output
- AI decision system impact and fairness assessment (firm or client systems)
- Reassessment when a model, purpose or provider changes
- Privacy policy clause on automated decisions (APP 1.7 to 1.9, from 10 December 2026)
All precedents for AI decision systems · Tasks and AI use in this area