AI and Client Confidentiality: A Straight Answer for Law Firms

Every law firm I speak to asks the same question within the first ten minutes: "But what about our client data?"

Good. I'd be worried if you didn't ask it.

You're dealing with people's divorces, property settlements, business disputes and estate plans. These are people's lives. Here is the straight answer.

Your client data is never shared or used to train AI models.

Consumer AI vs Enterprise AI - They're Not the Same Thing

When most people think of AI, they picture ChatGPT. You type something in, and who knows where it goes. That's a fair concern. One law firm principal I spoke to put it well: "I'm not dumping personal information into ChatGPT."

He's right. Consumer AI tools may use your inputs to improve their models. The AI systems we build for law firms work differently.

Enterprise AI uses commercial-grade API connections with contractual commitments:

• Your data is encrypted in transit (the same standard your bank uses)
• Your data is never used to train AI models
• Your data is never shared with other customers
• The AI provider may keep each request for up to 30 days for its own safety checks, or longer if a check flags it

Think of it like the difference between posting on social media and sending a registered letter. Same technology underneath, different rules about who sees what.

Three Approaches to AI Data Security

There are three ways to handle data processing. The right one depends on your firm's requirements and risk appetite.

1. Cloud-based (API processing)

This is the most common approach. Your data goes to a secure AI model via an encrypted API call. The AI processes the request and sends back the result.

The major AI providers, Anthropic, OpenAI and Google, each hold a current SOC 2 Type II report, an independent audit of their security controls. Ask to see it for whichever provider your system uses.

2. On-premise (fully offline)

For firms with the strictest requirements, AI models can run on your own infrastructure. Nothing leaves your network. The trade-off is local computing power, and on-premise models are typically less capable than their cloud counterparts.

3. Hybrid

Often the sweet spot. Sensitive data, such as client names, matter details and financial information, stays on your systems. Only de-identified or non-sensitive data touches the cloud. The results come back and are matched with the sensitive data locally.

How We Handle It at Blue Seas AI

Our AI systems work within the tools you already use: LEAP, Smokeball, your email, your VoIP phone system.

How data moves in the systems we've built for Sunshine Coast law firms:

• Email processing: Emails are analysed within your practice management system's security framework. The AI reads the content, classifies it to the correct matter and files it. The filed email stays in your practice management system.
• Meeting transcription: Audio from phone calls and face-to-face meetings is transcribed and used to generate client letters and file notes. The audio is processed through encrypted channels, and each transcription is independent, with no memory of previous conversations.
• No client database on our side: The AI processes inputs, generates outputs and moves on. There's no database or "history" of your clients sitting in our systems.
• Integration: Our systems plug into your existing infrastructure. Your records stay in the systems you already use.
• Stored in Australia: Your files and records are stored in Australia. Where the AI's own work is done is decided with you before anything is built.
• A lawyer signs off: Nothing leaves the firm without a lawyer seeing it.

Every system we build for a law firm has to meet the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles, the Solicitors' Conduct Rules, legal professional privilege and the Notifiable Data Breaches scheme. The rules are agreed before anything is built, and they are set out on How we protect your files.

Five Questions to Ask Any AI Provider

1. Where is my data processed? Get a specific answer, down to the country, cloud provider and data centre.
2. Is my data used to train AI models? The answer needs to be no. Get it in writing.
3. How long is my data retained after processing? Get the number of days in writing. Many AI providers keep each request for up to 30 days for their own safety checks.
4. What certifications does the AI provider hold? Look for SOC 2 Type II, ISO 27001, or equivalent.
5. Does the system integrate with my existing tools, or does it require me to move data? Integration is safer than migration.

If a provider can't give specific answers to all five, keep looking.

The Risk Most Firms Aren't Thinking About

The biggest data security risk in most practices is what you're already doing.

It's the staff member who copies client details into a personal Gmail to work from home. It's the unencrypted USB drive in someone's laptop bag. It's the spreadsheet of client matters saved to a personal Dropbox. And it's the AI tool someone started using on client work without telling anyone, which has a name: shadow AI.

A properly built AI system, on a commercial agreement with an audited provider and a written limit on how long anything is kept, is likely to be safer than the workarounds already running in many firms.

Still ask the questions. Then make the conversation about doing things properly. The risk is leaving those workarounds in place.

I spent 16 years in financial crime, risk and continuous improvement for major banks across Australia and Europe. I've seen what "secure" looks like inside a bank, and what happens when corners get cut. We build AI systems for law firms with that same lens, because your clients trust you with their most sensitive information.

See how this works inside a firm like yours: AI for law firms, and the questions to settle first in AI strategy for law firms.

Bart Puszko

Founder and Principal of Blue Seas AI. Queensland Government AI mentor. Winner, 2025 Sunshine Coast Business Awards, Advanced Technology. Top 10 finalist, Australian AI Awards 2025 & 2026. Before AI, 16 years in financial crime, risk and continuous improvement for major banks across Australia and Europe.