The question is never “is AI confidential”. It is what left the firm, where it went, and what you had agreed.
Key takeaways
Using AI does not breach client confidentiality on its own. What can breach it is sending client information outside your firm to a party you have no confidentiality arrangement with, or into a service whose terms permit uses you have not agreed to. The tool determines the answer far more than the task does: the same summarisation job can be entirely proper in one environment and a disclosure in another.
That is why the decision belongs at the tool level, made once and written down, rather than at the matter level, made by whoever is under deadline pressure.
Professional conduct. For lawyers, confidentiality is a chapter of the code, not a clause — the annotated Code of Professional Conduct for British Columbia sets out rule 3.3 Confidentiality, covering confidential information, use of confidential information, the obligation to claim privilege when faced with a requirement to surrender a document, and the future harm exception. Rules are harmonised nationally through the Federation’s Model Code and adopted province by province, so identify your own society’s numbering before you write a procedure. The Law Society of BC’s AI and the legal profession page points to guidance covering exactly this ground — competence, confidentiality, information security, fraud, plagiarism and copyright — and to a Lawyers Indemnity Fund article on client confidentiality, inaccurate results, bias, cybersecurity and fraud. For accountants the equivalent sits in the provincial code; CPABC publishes the Act, Bylaws and Code of Professional Conduct, and CPA Alberta notes that unprofessional conduct is defined by section 93 of the Chartered Professional Accountants Act.
Privacy legislation. Where client files contain personal information, clause 4.1.3 of Schedule 1 to PIPEDA keeps your organisation responsible for that information when it is transferred to a third party for processing, and requires contractual or other means to provide a comparable level of protection. In Québec the Commission d’accès à l’information administers the private-sector statute and flags on its own English page that businesses face amended obligations. The Office of the Privacy Commissioner’s generative AI principles are addressed to organisations deploying these systems.
Contract. Many engagements carry a confidentiality clause stricter than either of the above — a client NDA, a protective order, a bank’s vendor terms. Those are enforceable on their own terms; our sister firm covers the remedies for breach of a confidentiality clause and how these clauses are drafted.
The task is the same in each case: summarise a 60-page client document into a two-page brief.
Tool A runs entirely inside the firm’s own environment and the document never leaves. Nothing has been disclosed to anyone, so the confidentiality question narrows to your own internal access controls — who inside the firm can now see a summary of a matter they are not on.
Tool B is a commercial service on the firm’s tenant, with a signed agreement and a published data-handling position such as Microsoft’s data, privacy and security document. Information has been transferred for processing, which is permitted if you have the contractual protections PIPEDA clause 4.1.3 contemplates and your conduct rules allow it. This is where most firms land, and it is defensible because the analysis was done before use, not after.
Tool C is a free consumer assistant with terms nobody in the firm has read. The document has gone to a third party on that party’s terms. Whether that is a breach depends on the terms, the information and your rules — but you cannot answer the client’s question about it, and being unable to answer is itself the problem.
Four things, in order of effect. One: a short list of approved tools with the confidentiality analysis recorded against each, so nobody re-decides under pressure. Two: a prohibited-inputs rule written in categories, not principles. Three: minimisation — if a summary can be produced from a redacted extract, use the extract; the safest information is the information you never sent. Four: a record of who used which tool on which matter, which is what lets you answer a client question in an afternoon rather than a fortnight.
De-identification helps but is not a universal answer: a document can identify a client through its facts long after the names come out, particularly in a small market or a specialised sector. Treat de-identification as a reduction in risk, not an exemption from the question. The wider security review of a vendor is covered in the note on cybersecurity and data-privacy due diligence.
A tool does not hold a duty of confidence; you do. That is also why supervision is part of the answer — if a firm can be answerable for the work of the people in it, as set out in the note on claims against a professional’s firm, it can be answerable for the tools they choose. The decision to route client information anywhere is a professional decision, made by a named person and recorded.
Does the client have to consent?
Sometimes, and it depends on your regulator, your retainer and whether personal information is involved. Decide your default position, put it in the engagement letter, and stop relitigating it per matter.
Is privilege lost if a document goes through a tool?
Treat this as unsettled and act conservatively. The Law Society of BC’s guidance treats the risks around generative AI, including privilege-adjacent concerns, as an area lawyers must assess rather than assume; that is a reason to keep privileged material inside controlled environments.
Can we use AI on a file that is under investigation?
Default to no, and say so in the policy. Files subject to litigation holds, regulatory review or an undertaking are the ones where an unplanned transfer is least defensible.
A 30-minute call is enough to tell you whether AI pays for itself here.
