Module 2.2 · Topic 5

Confidentiality and Data Governance in AI Context

Bottom Line Up Front: Vendor data policies vary. Some retain for training; others promise zero retention. Know your tool's policy and compare to your obligations before uploading. Context practices must be secure.…

5.1 What Happens to Data You Provide as Context

Key questions: Retention? Training use? Employee access? Sub-processors? Compliance (GDPR, HIPAA)? Tools retaining indefinitely + training = unsuitable for client docs. Zero-retention + confidentiality contract = acceptable. Verify current terms as policies change.

5.2 Sensitive Information and Privacy Considerations

Redaction discipline when there is uncertainty about the privacy protections guaranteed by your AI tool: (1) Avoid client names and use "Company A/B" instead. (2) For financial figures, generalize when appropriate instead of using exact amounts or avoid linking too much ancillary detail to analysis of specific financial scenarios. (3) Health information (HIPAA) should be generalized and anonymized unless using HIPAA-compliant tools with Business Associate Agreements. (4) SSN/IDs are rarely relevant as specific info and should usually be redacted entirely or proxied with a fake number. Balance: AI needs detail to be useful; protect what must be protected.

5.3 Organizational Policies for AI Data Handling

Approved tool list, data classification matrix, confidentiality contracts (Data Processing Agreement/Business Associate Agreement), approval workflow for exceptions. Critical risk: employees using unapproved consumer tools with aggressive data retention policies. Establish approved tools and communicate widely to prevent accidental breaches. If uncertain, ask and prepare to dig into all the T's and C's.

5.4 Data Governance Obligations in Legal Settings

Identify applicable bar rules: ABA Formal Opinion 512, state bar guidance (CA, FL, TX, NY, NC). Review engagement letters: do they allow AI tools? Verify tool's privilege protection: does contract explicitly protect privilege? Is tool a confidential agent under law? Choose tools meeting your obligations. Document your choice. Brief clients explicitly before using AI on their work.

Critical: Privilege Waiver

Uploading client documents to certain AI tools may waive attorney-client privilege or violate confidentiality obligations. If vendor retains inputs for training or grants employee access, client information is no longer under your sole control. Recent court decisions show tool choice matters. Choose wrong, and you've exposed client and waived privilege. See Module 7.1 for professional liability details.

Topic 5 details

Topic overview

Topic details

5. Confidentiality and Data Governance in AI Context

Vendor Data Policies: You must verify whether a tool retains your inputs for training before uploading documents; policies vary wildly between enterprise and consumer tiers.
Redaction Discipline: Client names, exact financial figures, and sensitive identifiers must be generalized or redacted before processing in standard AI tools.
Governance Obligations: Uploading confidential information to unvetted systems violates professional duties and can inadvertently waive attorney-client privilege.

Key takeaway

Knowledge check

Confidentiality and Data Governance in AI Context: Before uploading client documents to an AI tool, what must you verify about the tool, and why does getting it wrong carry such serious consequences for a legal professional?

Show answer

Verify the vendor's data policy. Check whether it retains inputs for training, grants employee access, or promises zero retention. Redact sensitive data, use approved tools, and confirm compliance with your professional obligations. Vendor policies vary, and uploading to the wrong tool can waive attorney-client privilege or breach confidentiality, since the information is no longer under your sole control (cf. ABA Formal Opinion 512; see Module 7.1).