Can AI Keep Client Data Safer?
For lawyers, the risk is not only a data leak. Entering privileged or court-protected material into the wrong AI tool can waive privilege or breach a court's rules. Australian courts and law societies now draw the line between public and closed tools, and overseas courts have begun to test it. Whether AI is safe with client data depends on the tool's terms, not its intelligence.
On this page
Better: Note and confidence
Low confidenceCourts allow routine use once the data stays containedThe NSW Supreme Court lists chronologies, indexes and document summaries as acceptable uses. This review is about protecting client data; we did not assess whether the output is better than a lawyer's own work.Faster: Note and confidence
Low confidenceCompliance checks come before any time savedIn our reading, reviewing vendor terms, telling clients and keeping records of AI outputs all take time before any summarising gain arrives. We found no independent measure of the net time saved in legal practice.Cheaper: Note and confidence
Low confidenceCompliant use needs closed tools on reviewed termsThe guidance points firms away from public tools and towards closed tools under reviewed contracts. We found no independent data on what that costs a firm, or on the cost of a privilege waiver.Safer: Note and confidence
Governance-gatedSafe only inside a closed tool on terms the lawyer has checkedNSW and Victorian practice notes and law society guidance set the boundary, and a UK tribunal, in a judgment on professional conduct, said uploads to an open tool waive privilege. We found no Australian ruling on waiver, so the line is drawn by guidance, not settled law.The problem, in numbers
Legal professional privilege protects confidential communications made for the dominant purpose of legal advice or litigation. Lose the confidentiality and the privilege can go with it, and waiver is judged by whether the conduct was inconsistent with keeping the communication confidential, not by what the lawyer intended.Source 8 Where a prompt goes is therefore a legal question, not only a security one.
Victorian lawyers are already using tools whose data handling they may not control. In the Victorian legal regulator's 2025 census, 638 of 1,739 lawyers who answered (37%) said they used AI tools in practice. Of those users, 65% used general-purpose tools such as ChatGPT, Claude or Gemini, while legal-specific products such as Lexis+ AI (12%) and Westlaw Precision or CoCounsel (5%) were used far less.Source 1 Only 42% of respondents said their workplace had AI guidelines, and 31% of users were using AI where none existed.Source 1 The census was voluntary (6.4% response rate) and recorded which tools lawyers used, not what they entered.Source 1
What improves, and why
The courts have not banned AI. Subject to its confidentiality limits, the NSW Supreme Court's practice note allows it for chronologies, indexes, witness lists, and summarising or reviewing documents and transcripts.Source 2 The Supreme Court of Victoria says court users can use AI in preparing court documents if they comply with its practice note.Source 3
What has improved is that the boundary is now written down, and it runs between public and closed tools. In Victoria, court users should not put confidential or sensitive information, including anything under a suppression order, into a public AI tool. For a closed tool, they must satisfy themselves, by reading the contract or the privacy settings, that the information stays in a secure environment.Source 3 NSW goes further for material the court itself protects. Suppressed information, documents produced on subpoena, material held under the Harman undertaking and anything under a statutory publication ban must not be entered into any generative AI program unless it stays in a controlled environment, the supplier is bound to confidentiality, it is used only for that proceeding and it is not used to train a model.Source 2
In our reading, that turns vendor choice into a compliance decision. A tool whose terms allow training on inputs cannot meet the NSW conditions for subpoenaed or suppressed material, however capable it is.
The law societies apply the same test to everyday client work. The Law Society of NSW says putting client confidential information into a publicly available generative AI system "is akin to putting it in the public domain", likely a breach of confidentiality that may cost clients their privilege.Source 4 The Queensland Law Society tells solicitors to ask whether a tool's terms of service are compatible with keeping material confidential, and to avoid a tool whose user agreement does not address data use and training.Source 5
Waiver is judged by conduct, not intention. The question is where the privileged material went, and on whose terms.
What the evidence actually says
Law firm commentary in July 2026 reported no authoritative Australian ruling on whether entering privileged material into an AI tool waives privilege.Source 8 The same commentary reports an appellate observation in the Federal Circuit and Family Court that putting court documents into open AI systems may breach statutory bans on publication and could potentially waive privilege.Source 8
Overseas courts have started to address it. In the UK, the Upper Tribunal dealt with a representative who had uploaded Home Office decision letters to an AI platform to summarise them for clients.Source 6 It said that uploading confidential documents to an open tool such as ChatGPT places them in the public domain, breaching client confidentiality and waiving legal privilege, and that such conduct should be referred to the Information Commissioner's Office.Source 6 These were general statements in a professional conduct judgment, not a finding that privilege was lost. It also said closed tools that do not place information in the public domain can be used for summarising without those risks.Source 6
In the US, according to law firm commentary (we could not open the judgment), a federal court in New York held in February 2026 that about 31 documents an executive charged with securities fraud had generated with a consumer AI assistant were neither privileged nor work product.Source 7 The commentary says the court relied on the privacy policy, which let the provider collect inputs, train on them and disclose them to third parties, and treated feeding counsel's advice into a public tool as disclosure to a third party.Source 7 He acted without his lawyers' direction, so in our reading the case is a warning, not a rule for supervised legal work.
In our assessment, both decisions turn on control and contract terms, not on AI as such. We found no data on how often privileged material has been entered into public tools in Australia, and no study showing that closed tools have prevented a waiver.
Where it falls short
Untested at home. The Australian position rests on guidance and an appellate remark, not a ruling.Source 8
"Closed" is a contract claim. Victoria asks lawyers to satisfy themselves from the terms or settings.Source 3 In our reading, if the terms are wrong or change, the risk stays with the lawyer.
Guidance is not being read. In the Victorian census, 60% had read neither the court guidelines nor the regulator's AI statement, including close to half of AI users.Source 1
The rules are moving. Victoria's practice note dates from May 2026, the Federal Court's from April 2026, and the NSW note is under review.Source 2,Source 3,Source 8
Where governance decides the outcome
Write down what never goes into a public tool: privileged communications, suppressed material, documents produced on subpoena or under compulsion, and anything under a statutory publication ban.Source 2,Source 4 Before client material goes into a closed tool, review the contract for how prompts and data are stored, whether inputs train the model and where data is hosted, and give the tool only the data it needs.Source 4,Source 5 Tell clients when AI will be used on their work; the Law Society of NSW asks that clients be aware of and approve it.Source 4,Source 5 Keep records of AI outputs for discovery,Source 4 and be ready to explain to a court which parts of a document AI produced and how they were checked.Source 3
How to think about adoption
Start with the data, not the tool. Sort matter material into what is ordinary, what is confidential, what is privileged and what the court protects, and decide which classes may enter which tools. Choose a closed tool for anything beyond the first class, and read its terms against the NSW conditions: contained, confidential, used for that matter only, never used for training. Record which matters used AI and at whose direction, because privilege claims are stronger the closer the work sits to the lawyer's control.Source 8 Name AI tools in engagement letters.Source 5 Until an Australian court rules, the safest assumption is the view the UK tribunal stated: a public upload is a disclosure.
BFCS.ai does not fabricate figures. The evidence here is court practice notes, law society guidance, one regulator census and a small number of court decisions, two of them overseas and one known to us only through law firm commentary. We found no Australian decision on whether AI use waives privilege and no data on how often privileged material has been entered into AI tools, and we say so where it matters.
Sources
- 1
Legal Services Research Centre, Victorian Legal Services Board and Commissioner, "Generative AI Use in the Legal Profession: Findings from the 2025 Victorian Lawyer Census," 2026. lsbc.vic.gov.au
Back to textWhat we took from it
Voluntary online survey of all Victorian practising certificate holders; 1,887 responded, a 6.4% response rate from 29,537 certificate holders; results weighted by age, gender and certificate type. Of 1,739 who answered yes or no, 638 (37%) used AI tools in practice. Of the 638 users, 65% used general-purpose tools (e.g. ChatGPT, Claude, Google Gemini, Perplexity AI, Copilot Free/Pro Personal), 34% Microsoft 365 Copilot, 13% LEAP, 12% Lexis+ AI, 9% JADE Professional and 5% Westlaw Precision/CoCounsel. 45% of non-users cited data, privacy and security concerns as a reason for not using AI, the reason given most often. Of 1,674 respondents, 703 (42%) reported workplace AI guidelines; of AI users, 63% used AI where guidelines existed, 31% where they did not and 7% were unsure. 60% had read neither the Supreme and County Court guidelines for litigants nor the VLSB+C statement on AI, including close to half of AI users. The census asked which tools lawyers used, not what information they entered into them.
- 2
Supreme Court of New South Wales, Practice Note SC Gen 23, "Use of Generative Artificial Intelligence (Gen AI)," issued 28 January 2025 (replacing the version of 21 November 2024), commenced 3 February 2025. supremecourt.nsw.gov.au
UNSW Centre for the Future of the Legal Profession, "Artificial Intelligence: Practice notes and guidance from Australian courts and legal regulators," current as at 27 October 2026, lists SC Gen 23 as currently under review and lists AI guidance from courts and tribunals in New South Wales, Victoria, Queensland, Western Australia, South Australia and the federal jurisdiction. unsw.edu.au
Back to textWhat we took from it
Paragraph 7(e) warns of the lack of adequate safeguards to preserve the confidentiality, privacy or legal professional privilege of material submitted to a public Gen AI chatbot; paragraph 8 that data entered may be used for training, potentially making confidential information available to others. Paragraph 9A: information subject to non-publication or suppression orders, material covered by the implied (Harman) undertaking, material produced on subpoena, or material subject to a statutory prohibition on publication must not be entered into any Gen AI program unless the practitioner is satisfied it will remain within the controlled environment of the platform, that the supplier is under confidentiality restrictions so the data is not made publicly available and is not used to train any large language model, and that it will be used only in connection with that proceeding. Paragraph 9B permits use for chronologies, indexes, witness lists, briefs, summarising or reviewing documents and transcripts, and written submissions (subject to verification), all subject to paragraph 9A.
- 3
Supreme Court of Victoria, Practice Note SC Gen 25, "The Use of Artificial Intelligence by Court Users," issued and commenced 14 May 2026, replacing the Guidelines for Litigants of May 2024. supremecourt.vic.gov.au
Back to textWhat we took from it
Defines public AI and closed AI (closed tools keep information in a controlled environment, with controls that protect it from being made publicly available or used to train the tool). Paragraph 6.8: information entered into a public AI tool could become publicly available; court users should not enter confidential or sensitive information, including information subject to a non-publication or suppression order, into a public AI tool; lawyers must comply with their obligations to maintain client confidentiality. Paragraph 6.9: for closed tools, users must exercise caution and satisfy themselves, by reviewing the contractual terms or privacy and confidentiality settings, that the information will be kept within a secure environment. Paragraph 6.7: lawyers relying on unverified AI outputs may be referred to the Victorian Legal Services Board and Commissioner and face personal costs orders. Paragraph 7.6: court users must be prepared to identify the portions of court documents produced using AI and explain how the output was verified.
- 4
The Law Society of New South Wales, "A solicitor's guide to responsible use of artificial intelligence," updated January 2026. lawsociety.com.au
Back to textWhat we took from it
Under Solicitor Conduct Rule 9 (confidentiality): placing client confidential information into a publicly available generative AI system "is akin to putting it in the public domain", is likely to be a breach of confidentiality, and clients may lose privilege. Under Rule 19: information produced under compulsion (the Harman undertaking) must not be disclosed when using generative AI. Pre-adoption considerations include a full contract review covering how prompts, queries and data are stored, the principle of least privilege for access to internal documents, ensuring the client is aware of and approves the use of generative AI, and any client requirement for onshore data hosting; post-adoption, if applicable, considering keeping records of each AI output for discovery and retention purposes.
- 5
Queensland Law Society Ethics and Practice Centre, Guidance Statement No. 37, "Artificial Intelligence in Legal Practice," 31 May 2024. qls.com.au
Back to textWhat we took from it
Section 4.2: risk assessment should ask whether the terms of service are incompatible with an intention to keep the material confidential, where data is processed and stored, and whether the provider gives an express guarantee of confidentiality; where data use and model training are not addressed in the user agreement, a proper risk assessment is unlikely to be possible and the tool should be avoided; data obtained under compulsion should not be uploaded to third-party AI tools unless the data owner has been informed. Footnote 7: client legal privilege "is a shield to resist disclosure, not a tool to restore confidentiality". Section 4.3: where feasible, clients should be advised if an AI tool will be used on their work; naming the tools in retainer agreements or letters of engagement may be enough in many cases.
- 6
Upper Tribunal (Immigration and Asylum Chamber), UK and R (Munir) v Secretary of State for the Home Department [2026] UKUT 81 (IAC), promulgated 17 November 2025. caselaw.nationalarchives.gov.uk
Back to textWhat we took from it
A representative had uploaded Home Office decision letters to an AI platform to summarise them for clients (paragraph 16). Headnote and paragraph 60: uploading confidential documents into an open-source AI tool such as ChatGPT places the information on the internet in the public domain, breaching client confidentiality and waiving legal privilege; such conduct might warrant referral to the regulator and should be referred to the Information Commissioner's Office. These are general statements in a Hamid (professional conduct) judgment; the tribunal made no finding that privilege was lost in any client's case. Paragraph 21: closed-source tools that do not place information in the public domain are available for tasks such as summarising without these risks.
- 7
Law firm commentary (not the judgment, which we could not open): orrick.com
Back to textWhat we took from it
Orrick, Herrington & Sutcliffe, "Court Rules AI Conversations Are Not Privileged: What United States v. Heppner Means for You," 25 March 2026. US District Court for the Southern District of New York, opinion of Judge Jed S. Rakoff, 13 February 2026 (Hall & Wilcox, note 8, gives 17 February 2026): a senior executive indicted for securities fraud used Anthropic's consumer Claude assistant on his own initiative, without direction from his lawyers, to analyse his legal position; about 31 documents recording those exchanges were seized. The court held they were neither privileged nor work product: the AI is not a lawyer; the consumer privacy policy, which permits collection of inputs and outputs, training and disclosure to third parties including government authorities, defeated any reasonable expectation of confidentiality; and, as Orrick reports the holdings, inputting privileged information waives privilege, because feeding counsel's advice into a public AI tool is the same as disclosure to a third party. Orrick does not say the defendant entered his lawyers' advice; it notes that enterprise tools with negotiated confidentiality terms have not been tested in court.
- 8
Law firm commentary (we did not open the Helmold judgment). hallandwilcox.com.au
Clayton Utz, "AI and legal professional privilege: why common workflows now carry uncommon risk," 30 April 2026: claytonutz.com
Back to textWhat we took from it
Hall & Wilcox, "Mid-year review: how generative-AI is reshaping litigation and privilege in Australia, the UK and the US," 7 July 2026: no authoritative ruling has yet emerged in Australia on whether AI use waives privilege; in Helmold & Mariya (No 2) [2025] FedCFamC1A 163 the Full Court of the Federal Circuit and Family Court noted that inputting court documents into open AI systems may breach statutory prohibitions on publication and could potentially waive privilege; the Federal Court's Generative AI Practice Note (GPN-AI), released in April 2026, distinguishes open or public tools from closed enterprise systems.
privilege requires confidentiality; waiver is assessed objectively by whether conduct is inconsistent with keeping the communication confidential, not by intention; enterprise tools with contractual safeguards can support confidentiality, but privilege still turns on dominant purpose and lawyer direction, and "the closer to the lawyer's control, the stronger any privilege claim".