AI and law firms: confidentiality, privilege and audit trails

Most firms have already crossed the line. A trainee pastes a witness statement into a chatbot to tidy the prose. An associate asks a public model to summarise a bundle. A partner drafts a letter of advice with help from a tool the firm has never approved. None of this is hypothetical, and very little of it is logged.

For a law firm, the stakes are not the same as for a marketing agency. The material flowing into these tools is, by definition, the kind of material the firm is paid to protect. When AI use touches client data, the questions that follow are about confidentiality, legal privilege and your obligations under the SRA Code — not just data protection.

The three risks that are specific to legal work

Every organisation worries about staff pasting sensitive data into public AI. Law firms carry three sharper versions of that problem.

• Client confidentiality. Your duty of confidentiality is near-absolute and survives the retainer. A fee-earner who pastes instructions into a consumer chatbot may have disclosed confidential client information to a third-party provider, with no record that it happened and no way to tell the client what was exposed.
• Legal professional privilege. Privilege protects communications, but it can be undermined by careless handling. Routing privileged material — advice, litigation strategy, counsel's opinion — through an external model is exactly the kind of handling that should be deliberate and recorded, not accidental and invisible.
• Matter-code and identity leakage. Even where the substance stays vague, a matter code, a client name or a counterparty name dropped into a prompt can reveal who you act for and against whom. In contentious work that is a leak in its own right.

The hard part is not having a policy. Most firms have a policy. The hard part is knowing whether anyone follows it — and being able to prove either way when a client or the SRA asks.

A policy you cannot evidence is not a control

"We tell our people not to put client data into AI" is a statement of intent. It is not evidence. When a client's own auditors ask how you govern AI on their matters, or when the SRA queries an incident, intent does not close the question. You need a record.

That is the gap Evaident is built for. It keeps one tamper-evident record of AI use per matter and per fee-earner, across the tools you have approved, any in-house agents you run, and the unapproved consumer apps people reach for when no one is looking. The record carries risk flags — including where a request appears to involve client data, privileged material or PII — so review can focus on what matters instead of reading everything.

The point is not surveillance. It is the same principle that already governs your file notes and your conflicts checks: the work that touches client interests should leave a trail.

Detect and enforce are different things

There is an important distinction between seeing AI use after the fact and stopping a problem before it happens.

Connectors and logs give you the after-the-fact picture: who used what, on which matter, flagged for risk. A fee-earner working in a browser on a public chatbot is detection-only — you can see it happened, but the request has already left the building.

The Evaident Gateway changes that for traffic you route through it. Before a request reaches a public model, the gateway can block customer-defined terms — your matter codes, client names and counterparty names — alongside UK PII and common secrets. It also enforces which vendors and models are approved, applies out-of-hours rules, and holds a spend cap.

Two honest caveats. First, customer-defined term blocking is case-insensitive substring matching, not full DLP or regex — it is a strong, simple guardrail, not a forensic content filter. Second, the gateway only protects what flows through it; browser-based use stays detection-only unless you route it.

Be deliberate about capturing content

By default, Evaident captures metadata — what tool, which matter, which fee-earner, what risk flags — not the verbatim text of prompts and responses. For a law firm that default matters. Retaining the full content of an AI exchange about a live matter may itself raise privilege questions, so it should be a considered choice.

Verbatim capture is available as the approval-gated Enhanced Content Capture add-on. It exists for cases where you genuinely need the full text on the record, but it should be switched on deliberately, with privilege in mind, rather than left running everywhere as a matter of course.

Evidence a client or regulator can actually verify

When the question comes — from a client's panel review, an SRA query, or your PI insurer after an incident — you want to hand over something that stands up.

Evaident's evidence packs are hash-chained and independently verifiable. That means the record can be checked for tampering by someone outside the firm, which is the difference between a log a sceptic can dismiss and one they cannot. The output maps to the relevant parts of the SRA Code, including the duties of competence and confidentiality.

To be clear about scope: this supports your compliance work; it is not legal advice, and it does not decide for you whether a given use was appropriate. It gives the COLP and the risk team the facts to make that judgement and to show their workings.

Where to start

You do not need to solve AI governance in one go. Start by finding out what is actually happening. Most firms are surprised by how much AI use is already running through unapproved tools, and that surprise is the case for doing something about it.

See where your firm is exposed today with an exposure check, and read how Evaident is set up for the specific obligations of legal practice on the law firm page.