---
title: "AI data incident steps (confidentiality short form of the AI incident response procedure)"
url: "https://ailawframework.com/precedents/confidentiality-and-client-information/ai-data-incident-response-plan"
type: "precedent"
site: "AI Law Framework"
id: "a51-ai-data-incident-response-plan"
area_id: "A51"
kind: "policy"
ai_level: "yellow"
version: 1
law_stated_as_at: "2026-10-17"
---

# AI data incident steps (confidentiality short form of the AI incident response procedure)

> Confidentiality steps for AI incidents that expose information (public chatbots, wrong workspaces, vendor leaks, misdirecting agents, restricted court material, note-taker bots), with the privilege, privacy,…

Canonical page: https://ailawframework.com/precedents/confidentiality-and-client-information/ai-data-incident-response-plan  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

Confidentiality steps for AI incidents that expose information (public chatbots, wrong workspaces, vendor leaks, misdirecting agents, restricted court material, note-taker bots), with the privilege, privacy, court-order and barrier assessment. Runs inside the master procedure.

## Key facts

- Kind: Policy. A policy or procedure for a firm or client.
- Practice area: [Confidentiality & client information](https://ailawframework.com/precedents/confidentiality-and-client-information.md)
- Jurisdictions: Australia, New South Wales
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the 6 authorities it cites, for Australia and New South Wales.

## When to use it

Use inside the master AI incident response procedure whenever an AI incident involves client, privileged, personal or restricted information, alongside the data breach response plan. It does not replace the Notifiable Data Breaches assessment or the master procedure's court-correction step.

## How AI may be used

AI may help build an incident chronology in an approved tool and draft internal updates. The incident lead, the matter partner and the privacy officer decide containment, notification to clients, courts, insurers and the OAIC.

**AI may:**

- In an approved tool, assemble a chronology of the incident from logs and emails, citing each source.
- Draft internal status updates and a lessons-learned report for review.
- Search the approved tools' audit logs for other uploads by the same user or of the same file.

**AI must not:**

- Must not decide whether the incident is an eligible data breach, whether privilege is lost, or whether to tell a client or court.
- Must not draft communications to clients, courts, the OAIC or insurers except as a first draft for the partner to rewrite.
- Must not be the same tool that caused the incident, unless IT has cleared it.

**The lawyer checks:**

- The vendor has confirmed deletion in writing, or the risk is recorded.
- Each affected client has been considered for notification, and the decision recorded.
- Any court order or practice note breach has been assessed and, where needed, raised with the court.

## Authorities

- [Privacy Act 1988 (Cth) Pt IIIC, including ss 26WH, 26WK and 26WL (notifiable data breaches)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 r 9 (confidentiality) and r 19.2 (correcting misleading statements to the court)](https://legislation.nsw.gov.au/view/html/inforce/current/sl-2015-0244)
- [Evidence Act 1995 (Cth) s 122 (loss of client legal privilege)](https://www.legislation.gov.au/C2004A04858/latest/text)
- [Federal Court of Australia, Use of Generative Artificial Intelligence Practice Note (GPN-AI) (16 April 2026) paras 4.13 to 4.15 and 5.1](https://www.fedcourt.gov.au/law-and-practice/practice-documents/practice-notes/gpn-ai)
- [Supreme Court of NSW Practice Note SC Gen 23 – Use of Generative Artificial Intelligence (Gen AI) para 9A](https://supremecourt.nsw.gov.au/documents/Practice-and-Procedure/Practice-Notes/general/current/PN_SC_Gen_23.pdf)
- [OAIC, Data breach preparation and response](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response)

## Official form

[Official form](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/confidentiality-and-client-information/ai-data-incident-response-plan and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*