Choosing

Can a firm put an AI assistant in front of a confidential enquiry?

A law firm's objection to an assistant is not about accuracy. It is that an enquiry can be privileged before anyone has decided whether the firm may act, and the risk is created by receiving the information - not by answering it.

The risk is in hearing, not in replying

Most vendors answer confidentiality questions with encryption and access control, which address the wrong risk. The danger at first contact is that confidential detail arrives from someone the firm may turn out to be unable to act for, and that can taint an existing engagement as well as the new one. No amount of encryption helps with information you should never have taken in.

What may safely be collected, and it is a short list

Names of the parties, the nature of the matter in one line, and how to make contact. That is what a conflict check needs and nothing more. An assistant whose form invites "describe your situation" is collecting exactly what should wait - and a firm should treat that field as a defect, not a feature.

What is masked, and what is not

Structured identifiers - ID numbers, telephone numbers, card numbers - are replaced with tokens at intake, before any model is called, reversibly, with the originals held encrypted. Names written in free text are NOT detected automatically. For a firm that matters more than for most businesses: party names are precisely the field a conflict check turns on, and they travel as written.

Three questions to ask before signing

What the assistant refuses to discuss, verbatim. What is masked before the text leaves, and what is not. Which sub-processors receive it and under what agreement - with a specific hosting jurisdiction available per firm on request. A vendor who answers all three plainly is describing the limits, which is the only part a firm can assess.

Frequently asked questions

Can a law firm use an AI assistant without risking privilege?
Only if it is scoped to collect party names, a one-line nature of the matter and contact details, and to refuse the substance until a conflict check is complete. The risk is in receiving confidential detail, not in answering it, so the scope is the safeguard.
Why is encryption not the answer to this question?
Because it protects information you have already taken in. The first-contact risk is detail arriving from someone the firm may be unable to act for, which can affect an existing engagement too. Scope and refusal address that; encryption does not.
What is masked before the text reaches a model?
Structured identifiers - ID numbers, telephone numbers, card numbers - are tokenised at intake, reversibly, originals held encrypted. Names in free text are not detected automatically, and for a firm that is the material limit: party names are what a conflict check turns on.
Should the intake form ask the client to describe their case?
No. That field collects precisely what must wait for the conflict check, and a firm should treat it as a defect in any product that offers it. Party names and a one-line description are enough to start the check.
What should a firm ask a vendor before signing?
What the assistant refuses to discuss, word for word; what is masked and what is not; and which sub-processors receive the text, under what agreement, with which hosting jurisdiction available on request. Answers that describe limits are the only usable ones.

Get in touch

Leave your details and we will reply. You do not need a sales call to get an answer.