Confidentiality, privilege and AI: a governance playbook for Australian firms

Practitioners on r/auslaw have been comparing notes on a new problem: clients pasting the firm’s advice into AI tools. One firm said it will add a term to its client agreement. The term warns that feeding the firm’s advice into AI could waive legal professional privilege, and that cost estimates will likely rise if the firm has to deal with the consequences (r/auslaw). In the same thread, practitioners describe opposing submissions that were clearly AI-generated at several stages of a matter.

Before a firm tells clients how to handle AI, or fills in a panel questionnaire, its own AI use needs to hold up. This post closes our Practical AI for Law Firms series with the controls we would put in place before any AI system touches client material.

Confidentiality is the thing to protect

Privilege rests on confidentiality. If you disclose privileged material to a third party in a way that doesn’t fit with keeping it confidential, you put the privilege at risk, and a cloud AI service is a third party. For any service, you need to be able to explain to a court or a client who can see the material, where it is stored, how long it is kept, and whether it ends up training a model that other customers use.

Consumer chat tools are where most of the risk sits. Their terms and retention defaults change from plan to plan, and staff on personal accounts are outside any agreement the firm has signed. A policy that blocks personal AI accounts on firm devices and gives people an approved tool will work better than a memo asking everyone to be careful.

What to get in writing from a vendor

Enterprise API and workplace plans from the large providers usually have better terms than their consumer products. “Usually” is a weak basis for handling client data. Put these points in the contract or data processing addendum, because a vendor FAQ can change without notice:

• No training on your inputs or outputs as the default for your account, so nobody has to remember to opt out.
• The retention period for prompts and completions, including any abuse-monitoring logs, and whether you can set it to zero.
• Whether vendor staff can review content flagged by safety systems, and from which countries.
• Where the data is processed and stored. The large cloud platforms have Australian regions, but some models are only offered offshore, so check each model you plan to use.
• The subprocessor list and how much notice you get before it changes.
• Breach notification terms that let you meet your obligations under the Notifiable Data Breaches scheme.

In early October the Australian Government outlined plans to make AI companies prove their safety systems work (r/australia). Until that becomes enforceable rules, what you can rely on is what the contract says. Ask for the vendor’s current audit reports, such as SOC 2 or ISO 27001, and keep copies with the approval record.

API or a model you host

Firms have two realistic options. A hosted API from a major provider in an Australian region gives you the strongest models with little setup and per-token pricing. In return you depend on the contract and on vendor controls you can’t inspect.

An open-weight model on hardware you control, either on-premises or in a dedicated cloud tenancy, keeps material inside your environment. The trade-offs are real. These models are weaker on long, complex documents. The GPUs are a capital cost or an ongoing rental. And someone has to patch and monitor the stack for as long as you run it.

For most mid-size firms we would start with an Australian-region API on enterprise terms, and use a self-hosted model for matters where the client or a court order rules out third-party processing. Build the routing per matter from day one. Then moving a matter to the local model is a configuration change.

Segregate by matter

The internal risk is easy to miss. A firm-wide search assistant can retrieve a document from a matter the user is walled off from, and then summarise it in plain English. The design we use treats each matter as its own boundary:

• One vector index per matter, or one partition with a filter that the code always applies. There is no firm-wide index of client documents.
• Access checks at query time against the same ethical-walls source the document management system uses.
• The matter ID is attached to every prompt, retrieval and log entry.
• A routing setting on each matter: any approved API, Australian region only, or local model only.
• Retention follows the matter’s file retention. When the file is destroyed, its index and AI logs go with it.

The retrieval layer is where a wall either holds or fails, so the check sits there and doesn’t depend on the prompt:

async function retrieveForMatter(user: User, matterId: string, query: string): Promise<Hit[]> {
  const allowed = await walls.canAccess(user.id, matterId);
  if (!allowed) {
    await audit.log({ userId: user.id, matterId, event: "access-denied" });
    throw new ForbiddenError(matterId);
  }
  const index = indexes.forMatter(matterId);
  const hits = await index.search(query, { top: 8 });
  await audit.log({ userId: user.id, matterId, event: "retrieve", docIds: hits.map(h => h.id) });
  return hits;
}

Logs you can produce on request

Courts expect practitioners to stand behind what they file, and the r/auslaw thread shows the other side can already spot AI-drafted material. Read the current practice notes for every court you appear in. For each matter, record the tool, the model version, the source documents it retrieved, who reviewed the output, and what was filed. Then, if a judge or opponent asks how a document was prepared, you can answer from records. Those logs contain privileged content too, so keep them in the same storage and under the same access model as the matter.

The Australian Government is also weighing mandatory AI incident reporting (r/deeplearning). Decide now what counts as an AI incident at your firm and who records it. Retrieval from the wrong matter counts. So does a hallucinated authority that reaches a client draft, and so does client data sent to an unapproved service. With a register already running, a future reporting obligation becomes an export from that register.

Panel and insurer questionnaires

Expect client panels and professional indemnity insurers to ask more detailed AI questions. Commercial pressure is building as well. Deloitte has faced a second accusation of AI use in Australia within 12 months, and commenters on that story point out that professional services firms depend on public trust (r/auscorp). Australian business owners also report that clients are getting sceptical about AI tools (r/ausbusiness).

Keep a governance pack ready so each questionnaire draws on the same documents:

• The approved tools list, with the contract terms for each.
• A data flow diagram that shows where client material goes and which region it stays in.
• An explanation of matter segregation and ethical walls in the AI systems.
• The human review policy: a lawyer approves every AI-assisted output before it goes to a client or a court.
• The incident register and the firm’s AI disclosure wording for engagement letters.

Say in your engagement letters how the firm uses AI. Clients who hear it from you first are less likely to raise it later as a complaint.

When clients feed your advice into AI

The r/auslaw firm’s approach is sensible: add a clause that explains the privilege risk and the cost consequences. Pair it with a practical alternative. If a client wants a plain-language summary of your advice, they can get one through the firm’s controlled system rather than a consumer chatbot.

Costs and limits

Contract terms reduce risk, but some always remains, because you are trusting controls you can’t audit yourself. Self-hosting removes the third party and adds hardware and an operations workload. Per-matter indexes cost more storage. Firm-wide precedent search then needs its own curated corpus of cleared documents. None of this settles questions about privilege and AI that the courts haven’t decided yet. Your risk partner should sign off on the firm’s position before anything goes live.

PicNet builds production AI systems for Australian organisations, and our managers are engineers who can work through this design with your risk partner. Talk to us about what a first project could look like.