Module 2 of 2 · 45 minutes
Confidentiality, privilege and what the firm must have in place
By the end of this module you will be able to
- Explain why client information in a public AI tool risks privilege
- State the safeguards required before client data enters an AI system
- Decide whether a given use of a tool is acceptable
- Describe what a compliance officer should have in place
- Record enough to justify a decision afterwards
Work through it
1 interactive for this module, built on the WAJD Teach engine. Nothing moves until you ask it to, and every one has a written version if you would rather read it.
Watch: Emma and George talk it through
3 minutes. Captions are on, and the same conversation is written out in full below. The voices are computer generated.
Emma George, the citations I understand. What's the other thing the SRA is worried about?
George What you put in. Confidential client information entered into public or insufficiently secured AI systems. Paragraph 6.3 of the Code requires you to keep clients' affairs confidential.
Emma Surely pasting a paragraph into a tool isn't publishing it.
George The notice says it is. Entering client information into a public AI tool is to place that information on the internet, in the public domain. The Upper Tribunal made the same observation in a 2026 decision.
Emma And the consequence?
George A risk that legal professional privilege is waived. Privilege belongs to the client, and once it's lost you can't get it back. This isn't a data protection fine. It can decide the client's case.
Emma So when can client information go into an AI system?
George Only where appropriate contractual, technical and organisational safeguards are in place. And the notice lists what firms must ensure.
Emma Go on.
George The data stays within a secure environment. It isn't accessed by unauthorised third parties. It isn't used to train AI models unless that's explicitly authorised and appropriate. And it isn't kept longer than necessary.
Emma How do I judge a tool on a Tuesday afternoon?
George Three questions. Has the firm approved this tool, under a contract that gives those four protections? Is this use within what it was approved for? And would I be comfortable explaining to the client exactly what I entered and where it went?
Emma What if I take the client's name out?
George That doesn't make a public tool safe. The facts of a matter usually identify the parties to anyone who knows of it. And the other side may well be one of them.
Emma Some people use their own account at home.
George Which removes the firm's protections entirely. Personal account, personal device, client matter. That's the worst combination.
Emma What should the firm itself have?
George A written policy saying which tools may be used and for what. Training for everyone who drafts. A verification step for anything going to a court or a client. And a route to report a mistake without fear.
Emma Whose job is that?
George The managers are responsible for compliance, and the compliance officer for legal practice must take all reasonable steps to ensure it.
Emma And records?
George Paragraph 7.2. You must be able to justify your decisions and actions. If a document's challenged, showing what was checked, against what and by whom is the difference between a mistake and misconduct.
Emma And if I find a problem afterwards?
George Tell your supervisor and your compliance officer at once. Courts have treated minimising the problem as worse than the error.
The written material
The second concern: what you put in
The warning notice's second concern is confidential client information entered into public or insufficiently secured AI systems. Paragraph 6.3 of the Code requires you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents.
The notice puts the risk plainly. Entering client information into a public AI tool is to place that information on the internet, in the public domain. In UK v Secretary of State for the Home Department, decided by the Upper Tribunal in 2026, the tribunal made the same observation and noted the risk that legal professional privilege is waived.
The safeguards the notice requires
The notice says client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality.
It lists what firms must ensure: that client data remains within a secure environment, is not accessed by unauthorised third parties, is not used to train AI models except where explicitly authorised and appropriate, and is not retained longer than necessary.
- Stays within a secure environment
- No access by unauthorised third parties
- Not used to train models unless explicitly authorised
- Not kept longer than necessary
A working test for any use
Three questions settle most cases. Is this a tool the firm has approved, under a contract that gives those four protections? Is this use within what it was approved for? And would I be comfortable explaining to the client exactly what I entered and where it went?
Removing the client's name does not turn a public tool into a safe one. The facts of a matter usually identify the parties to anyone who knows of it, and the other side may well be one of them. Neither does using a personal account on a personal device, which removes the firm's protections entirely.
What the firm must have
The notice points to the Code of Conduct for Firms: effective systems for supervising clients' matters, and people who keep their knowledge and skills, and their understanding of their obligations, up to date. A firm's managers are responsible for compliance, and the compliance officer for legal practice must take all reasonable steps to ensure it.
In practice that means a written policy saying which tools may be used and for what, training for everyone who drafts, a verification step for anything going to a court or a client, and a route to report a mistake without fear.
And keep a record. Paragraph 7.2 of the Code requires you to be able to justify your decisions and actions to demonstrate compliance. If a document is challenged, being able to show what was checked, against what and by whom is the difference between a mistake and misconduct.
Knowledge check
The knowledge check and your certificate need a free account, so that your progress and results can be saved as evidence.
The learning itself stays free and open. You are reading all of it right now without an account.
Was this module useful? Tell us in two minutes, it decides what we improve next.