Cybersecurity
Natural Networks ยท San Diego, CA
A paralegal pastes a client's deposition summary into ChatGPT to draft a motion — and in that moment, confidential case details may have been transmitted to a third-party AI model with no attorney-client privilege protection. AI for law firms is a genuine productivity story, but the confidentiality risks are equally real.
Why Law Firms Are Embracing AI — and Why That Creates New Risk
AI tools including Microsoft Copilot, Harvey, and ChatGPT Enterprise are delivering real efficiency gains in legal research, contract drafting, and document review. Most small law firms, however, are adopting these tools without formal policy or IT oversight — creating cybersecurity and ethics exposure that can outpace the productivity benefit.
Data submitted to consumer-grade AI tools may be retained by the vendor, used to improve the model, or transmitted to subprocessors outside the firm's control. That is the default behavior for many free-tier products — making this simultaneously a law firm cybersecurity problem and a bar ethics problem.
What "Client Confidentiality" Actually Means in the Age of AI
ABA Model Rule 1.6 requires attorneys to make reasonable efforts to prevent unauthorized disclosure of client information. Several state bars — including guidance aligned with California State Bar ethics opinions — have warned that submitting client data to AI tools without proper safeguards may fall short of that standard.
Why "I Didn't Know" Is Not a Defense
A small firm uses a free-tier AI tool to summarize discovery documents. The attorney never reads the vendor's terms, which permit data retention for model improvement. The client's medical records and litigation strategy are now in a third-party system. ABA Model Rule 1.6 does not require intent — it requires reasonable effort. Bar guidance consistently frames that obligation as understanding what a tool does with data before using it, not assuming privacy because a product looks professional.
The Specific AI Risks Law Firms Need to Understand
Three distinct risk categories apply to AI tools for attorneys: where vendor data goes, what outputs the model produces, and whether access can be controlled and audited. Each requires a different technical and policy response.
- Data residency and retention: Consumer ChatGPT may use submitted content for training; ChatGPT Enterprise offers contractual commitments against it. Law firm data protection depends on which version is actually in use.
- Prompt injection and model hallucination: AI models can produce fabricated case citations. An attorney who files a brief based on a hallucinated precedent faces malpractice exposure independent of any confidentiality issue.
- Endpoint and access control gaps: If any employee on any device can reach an AI tool, there is no audit trail. An attorney accessing AI on an unmanaged personal laptop over hotel Wi-Fi is invisible to firm IT controls and unrecoverable if an exposure occurs.
Building an AI Usage Policy Your Firm Can Actually Enforce
A defensible AI usage policy for a small law firm has four components: an approved tools list, a data classification framework, endpoint controls, and staff training tied to ethics obligations. Without all four, the policy is a document, not a control.
- Approved tools list: IT-vetted products with documented data handling terms the firm has reviewed and accepted.
- Data classification framework: Defines which categories of client information may be submitted to AI tools and which may not.
- Endpoint controls: Restrict AI tool access to managed firm devices only — not personal phones or home computers.
- Ethics-grounded staff training: Ties AI use to ABA Model Rule 1.6 obligations, not just an IT memo staff ignore.
Microsoft 365 Copilot deployed by a managed IT partner is one enterprise-grade example: Microsoft's commercial data protection commitments contractually exclude customer data from model training — a safeguard consumer tools do not offer.
How Cybersecurity and IT Infrastructure Support Safe AI Adoption
An AI usage policy is only enforceable when the underlying IT infrastructure can back it up. Multi-factor authentication, mobile device management, network segmentation, and security awareness training are the technical controls that make client confidentiality policy more than aspirational.
Multi-factor authentication (MFA) — a login control requiring a second verification step beyond a password — greatly reduces unauthorized access risk via stolen credentials. Mobile Device Management (MDM), such as Microsoft Intune, enforces which devices can access approved AI tools and enables remote wipe if a device is lost. Without MDM, endpoint controls are unenforceable.
A managed IT partner who monitors for unauthorized AI tool installations can flag a staff member using an unapproved consumer tool before client data is exposed. A break-fix vendor engages only after something breaks — by which point an exposure has already occurred. For law firms, IT support tailored specifically for law firms means a partner familiar with legal industry compliance requirements. The cybersecurity services built for businesses like yours should include proactive monitoring scoped to legal data handling obligations.
What to Look for in an IT Partner for Your Law Firm
When evaluating an IT partner for AI and cybersecurity support, law firms should apply three non-negotiable criteria: legal industry compliance experience, ability to vet AI tools against data privacy standards, and proactive monitoring rather than reactive support.
- Legal industry compliance experience: The partner should know ABA Model Rule 1.6 and relevant state bar AI guidance — not learn it on your dime.
- AI tool vetting capability: The partner should review vendor data retention terms and produce a written approved tools list, not simply install whatever attorneys request.
- Proactive security monitoring: Continuous monitoring that surfaces unauthorized tool use before a confidentiality gap becomes a bar complaint or breach notification obligation.
Natural Networks has supported law firms and professional services clients for over 30 years, with a track record in legal industry cybersecurity that goes beyond generic small business IT.
Frequently Asked Questions About AI and Client Confidentiality
Is it a confidentiality violation for attorneys to use ChatGPT with client information?
Using consumer ChatGPT with client information may fall short of the "reasonable efforts" standard in ABA Model Rule 1.6, because consumer-tier terms permit data retention for model training. Whether a specific use constitutes a violation depends on the facts and applicable state bar guidance. Enterprise-tier products with contractual data protections present a materially different risk profile.
What AI tools are safe for law firms to use without risking client data?
No AI tool is risk-free, but enterprise-grade products — including ChatGPT Enterprise, Harvey, and Microsoft 365 Copilot — offer contractual commitments against using customer data for model training. Firms should have an IT partner review each tool's data processing agreement before approving it for use with client information.
Does Microsoft Copilot protect attorney-client privilege?
Microsoft 365 Copilot's commercial data protection terms contractually exclude customer content from model training and do not share data with third parties for advertising. Copilot does not itself create or preserve attorney-client privilege — that is a legal doctrine — but its data handling terms are significantly stronger than consumer AI tools when properly deployed and configured.
What should a law firm AI usage policy include?
A law firm AI usage policy should include an IT-vetted approved tools list, a data classification framework defining what client information may be submitted to AI tools, endpoint controls limiting access to managed devices, and staff training that connects AI use to ABA Model Rule 1.6 obligations — not just a generic technology policy memo.
Is Your Law Firm's AI Use Actually Secure? Let's Find Out.
In a free 15-minute discovery call, Natural Networks will review how your firm is currently using AI tools and identify any gaps in your data handling practices before they become a bar complaint or a breach.
Schedule Your Free Discovery Call
