Feeding client information into an AI tool is a transfer of confidential information to a third-party service provider — the same legal character as cloud storage or an outsourced transcription service, with one critical twist: some AI services use customer inputs to train their models. Under ABA Model Rule 1.6(c), lawyers must make reasonable efforts to prevent unauthorized disclosure; under FLSC Model Code Rule 3.3-1 and Canadian privacy law (PIPEDA and provincial statutes), the duty is equally strict. Whether a given tool is a permissible confidant therefore turns almost entirely on its data terms: a consumer chatbot that may retain and train on your prompt is categorically different from an enterprise deployment contractually barred from doing either.
The privilege analysis runs parallel. Solicitor-client privilege and attorney-client privilege survive disclosure to agents reasonably necessary to the representation — which is why using Westlaw or a copy service never waived anything. A well-papered enterprise AI tool fits that agent model. A consumer tool whose terms grant broad usage rights sits on far shakier ground, and while no court has yet held that pasting privileged facts into a consumer chatbot waived privilege, no lawyer wants to be the test case. ABA Formal Opinion 512 draws the operative line: before inputting information relating to a representation into a self-learning tool, obtain the client's informed consent — and understand the tool's terms well enough to explain them.
This is the confidentiality backbone of our AI in Legal Practice library; the general adoption question is covered in Can Lawyers Use ChatGPT?.
The distinctions that determine whether a tool is defensible for client work:
Two operational corollaries follow from the tier distinction. First, account governance is a confidentiality control: firm-managed workspaces let administrators enforce no-training settings, restrict integrations, and audit usage, while personal accounts make every one of those representations unverifiable. Second, the tier analysis extends to embedded AI — the assistant inside your word processor, email client, or practice-management platform processes client content under whatever terms that vendor negotiated with its model provider, and those subprocessor chains belong in the same diligence file as any standalone tool. The quiet AI in tools you already own is where most unexamined disclosure actually happens.
The rule of thumb regulators keep converging on: consumer AI for general knowledge and non-client text; enterprise AI, after diligence, for client work. Law society cloud guidance in Ontario and BC has required this style of vendor analysis since long before generative AI — the questionnaire just has new questions.
A defensible AI vendor file answers, in writing: Does the vendor train on our inputs, ever, including for fine-tuning or evaluation? What is the retention period for prompts, outputs, and logs, and can we set it? Who can access our data, under what circumstances, and is human review of inputs possible? Where is data processed and stored, and can we require a region? What subprocessors (including the underlying model provider) touch the data, and do their terms match? Is there a SOC 2 Type II report, and current penetration testing? What happens to our data on termination? Will the vendor sign a DPA, and — for firms with regulated clients — flow down HIPAA, PIPEDA, or GDPR obligations? How are security incidents reported and how fast?
Treat vendor answers as contract terms, not marketing. "We don't train on your data" in a sales deck is worthless if the signed terms reserve the right to use content to "improve services"; retention "controls" that exist only in a settings page can change with a product update. The diligence file should hold the executed agreement, the DPA, the SOC 2 report, and dated screenshots of any configuration the firm relies on — because when a client's general counsel or your regulator asks how client data was protected, the answer must be documents, and because vendor terms change often enough that an annual re-review belongs on the compliance calendar beside trust-account reconciliation.
Anonymization deserves a special caution. Stripping names is rarely enough: a fact pattern with dates, amounts, and a distinctive industry can identify a client to anyone who knows the market, and re-identification risk is exactly the kind of technological limitation the competence duty expects lawyers to understand. Genuine anonymization means abstracting the facts until the scenario is generic — at which point a consumer tool may be acceptable for a conceptual question. If abstraction would gut the usefulness of the query, that query belongs in an enterprise tool.
Special categories raise the floor. Matters involving health information, minors, sexual assault complainants, national-security or sealed materials, and trade secrets carry statutory and court-ordered confidentiality obligations that sit on top of professional rules — HIPAA business-associate requirements in the US, health-privacy statutes and publication bans in Canada — and several of these regimes are simply incompatible with any tool that cannot sign the corresponding agreement. The firm policy should name these categories explicitly and route them to a shorter approved-tool list, or to no tool at all, rather than trusting individual judgment under deadline pressure.
Engagement-letter practice is converging on a technology clause that does three things: discloses that the firm uses AI tools under confidentiality-protective agreements in delivering services; commits that no client information is placed in tools that train on inputs; and invites the client to discuss restrictions (some institutional clients now send their own outside-counsel AI guidelines demanding exactly these commitments — in-house legal departments are ahead of many firms here). Where a specific use goes beyond that baseline — say, a self-learning tool would materially help the matter — Op. 512-style informed consent means a specific conversation, not a form.
Internally, the policy stack looks like: approved-tool list with tier requirements; prohibited-input rules everyone can recite; verification duties for output (see AI hallucinations in legal research); training at onboarding and annually; and an incident procedure for the day someone pastes the wrong thing into the wrong box — prompt assessment, client notification analysis, and regulator guidance check. Confidentiality discipline, like every AI guardrail, is ultimately a systems problem. Firms that build systems well tend to win on both sides of AI — including being the firm AI engines recommend, which you can test with the free AI Visibility Checker or plan properly with a LexScale.ai strategy call.
LexScale.ai helps law firms across Canada and the United States adopt AI for growth — from client-facing intake and content systems to the visibility that puts your firm inside AI answers.
Book a Free Strategy Call →This article is general information, not legal or ethics advice. Professional-conduct rules on AI are evolving and vary by jurisdiction — always verify current requirements with your state bar, law society, or regulator before adopting any AI workflow.
Related Articles
Court Rules on AI in Filings: US & Canada Guide · Billing Ethics for AI-Assisted Legal Work · AI Contract Drafting for Lawyers: What Works · AI Document Review & Discovery: From TAR to LLMs · AI Hallucinations in Legal Research: Risks & Fixes · Bar Rules on AI for Lawyers: US & Canada Guidance
Ready to grow your firm with AI?