Blog
What should a law firm ask an AI supplier about client confidentiality?
Where the information is held and processed, who can see it, whether it trains anything, how firms are kept apart, and what happens when you leave. Seven questions, and the answers a careful firm should expect in writing.
Alesis · · 4 min read
Ask seven questions, in writing, and expect answers in writing. Where is our information held and processed? Who inside the supplier can see it? Is any of it used to train or improve a model, for us or for anyone else? How is our firm kept apart from other firms? How are matters kept apart inside our firm? What sits between the assistant and the outside world? And what happens to everything when we leave?
The rest of this post is why those seven, and what a good answer sounds like.
Why confidentiality is the first question, not the last
A law firm's duty of confidentiality does not soften because a tool is convenient. Client information pasted into an assistant has been disclosed to whoever runs it, on whatever terms govern that service. If those terms have not been read, the firm has made a disclosure it cannot describe, which is a poor position for a COLP to be in and a worse one to explain to a client.
Suppliers know this, and the good ones will answer plainly. Vague answers are themselves an answer.
The seven questions, and what to listen for
1. Where is our information held and processed? The whole answer matters, not the storage alone. Documents can be stored in one country and sent to another to be worked on. Ask about processing, retrieval and the model itself, and ask for the regions by name. "In the UK, end to end" is a clear answer. "Primarily in the UK" invites a follow-up.
2. Who at the supplier can see it? Support staff, engineers, contractors, sub-processors. Ask what access exists, how it is granted, and whether it is logged. A supplier that has thought about this will have a short, specific answer.
3. Is any of it used to train or improve a model? This is the question firms most often forget, and the one with the longest tail. Ask about training, fine-tuning, evaluation and any other use of your content beyond answering your own questions. The answer you want is that nothing you upload, ask or draft is used to train anything for anyone else, and that this is a term of the contract rather than a setting someone could change.
4. How is our firm kept apart from other firms? Ask how the supplier prevents one firm's material from influencing, or surfacing in, another firm's answers. Ask them to describe it as a property of the design rather than a policy. A promise not to mix is not the same as an architecture that cannot.
5. How are matters kept apart inside our firm? Inside a firm, confidentiality is also a matter of information barriers between matters and between people. Ask whether the assistant respects who is on which matter, and whether seniority alone grants a view. The honest answer for a well-designed tool is that even a firm owner sees a matter only once they have been added to it.
6. What sits between the assistant and the outside world? Can it send email? File documents? Post to a portal? An assistant that can act on the world can act on it wrongly, and can be induced to. The safer answer is that it prepares work and people decide what leaves the firm, and when.
7. What happens when we leave? Export, deletion, timescales, and confirmation in writing. A supplier that makes leaving hard has told you something about how they see the relationship.
Ask about the paperwork too
Alongside the seven questions, ask for the documents that make the answers binding: the contract terms on data, the privacy notice, the sub-processor list, and the security page or pack. Read them against the spoken answers. If a promise made in a meeting is not in the paperwork, ask for it to be added; a supplier that will not put it in writing has not made the promise.
If your COLP, your insurers or your IT reviewers have a questionnaire, send it. A supplier serious about law firms will answer it in writing, signed by the people responsible for the answers, so your file shows exactly what was promised.
A note on the regulator's view
The Solicitors Regulation Authority expects firms to understand the tools they use well enough to meet their obligations, and the Information Commissioner's Office has published guidance on AI and data protection. Neither expects a firm to become an engineer. Both expect it to ask, to record the answers, and to act on them.
Where Alesis fits
The answers Alesis gives to the seven questions are the ones on its security page, in the same words. Your firm's information is held and processed in the UK, end to end. It is kept apart from every other firm's, and nothing you upload, ask or draft is used to train anything for anyone else. Inside your firm, people see only the matters they are on; seniority does not grant a view. Alesis cannot file, serve or email anything; it prepares the work and your people decide what goes out. And whatever your compliance review needs to ask, the answer comes back in writing, signed by the people responsible for it.
