Keeping client data confidential when using AI

Keeping client data confidential when using AI is a genuine compliance question for transactional law firms, and the answer depends almost entirely on the specific architecture of the tool being used. The question is not whether AI can be used; it is what happens to client information once it enters the AI environment.

The core risk

The confidentiality risk with AI tools arises at a specific point: when client information is submitted to a system that processes it in ways the firm does not control. A consumer AI product that receives a contract for analysis, stores that contract on the provider's servers, and potentially uses it as training data for a model that may be queried by other users represents a clear confidentiality risk. The same is true of any tool where the data processing terms are unclear or where the firm has not understood what happens to data after the interaction ends.

The risk is not theoretical. Firms have already experienced incidents where client information was inadvertently submitted to public AI products and where the question of whether that information was retained by the provider was not straightforwardly answerable.

What to look for in a legal AI tool

Evaluating an AI tool against confidentiality obligations requires answers to specific questions. Is the data processed within a secure, firm-specific environment or on a shared infrastructure? Is the data retained after the session ends, and if so, for how long and for what purpose? Is there a contractual commitment that client data will not be used to train a general model? Where are the servers, and does data residency comply with applicable data protection requirements?

A tool that cannot answer these questions clearly is not a tool that a transactional firm can safely use on client matters. The ability to demonstrate clear answers to these questions is part of the responsible commercial offer from any legal AI provider.

Firm-specific infrastructure

The architecture that best protects client confidentiality is one where the AI operates on the firm's own documents, within a secure environment, without using client data to improve a general model available to other firms or individuals. Scriptum is built on this model. To understand our data architecture in detail and how it aligns with your firm's confidentiality obligations, book a demo and we can walk through the specifics.