Checklist · Confidentiality & client information
AI vendor confidentiality and privilege questions (short form of the vendor due-diligence questionnaire)
Short-form vendor questions on confidentiality only: training and other use of firm data, retention and deletion, location and sub-processors, matter access and information barriers, court conditions for restricted material, confidentiality terms and incident notice.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia, New South Wales
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked on 17 October 2026 against the 6 authorities it cites, for Australia and New South Wales.
- Version
- 1
- Source
- Written for this library
When to use it
Use for a new AI feature in an already-approved product, at renewal or on a model or terms change, or for a narrow tool where only confidentiality questions arise. For a new vendor, send the master AI vendor due-diligence questionnaire, which includes these questions.
How AI may be used
AI may extract the vendor's terms and answers into the scoring table and flag gaps. A lawyer reads the contract, scores the risk and decides whether the tool is approved, and for which data classes.
AI may
- Extract retention, training, sub-processor, location and incident terms from the vendor's documents into Part H with clause references.
- Flag inconsistencies between the vendor's questionnaire answers and its contract or online terms.
- Track vendor changes (new sub-processors, model changes) against the approved profile.
AI must not
- Must not score the vendor or approve the tool.
- Must not be given client data to test the vendor's tool before approval.
- Must not rely on the vendor's security or privacy web pages as contractual commitments.
The lawyer checks
- Every "yes" on training, retention and location is backed by a contract clause.
- The para 9A and GPN-AI para 4.15 conditions are met before the tool is approved for restricted material.
- Information barriers and matter permissions are enforced by the tool, and this was tested.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Confidentiality & client information
- AI confidentiality rules for staff (short form of the firm AI policy)
- Staff and contractor AI confidentiality undertaking and acknowledgement
- Engagement clause: client authority for AI processing of confidential information (rider to the AI engagement clauses)
- AI data incident steps (confidentiality short form of the AI incident response procedure)
All precedents for Confidentiality & client information · Tasks and AI use in this area