An employment lawyer is finishing a settlement agreement at a quarter past ten in the evening. She pastes the draft into a chatbot and asks it to tighten the notice clause. The draft holds the employee's name, the salary and the reason for dismissal, and the chatbot runs on the account she also uses at home to look up recipes.
For a lawyer, confidentiality is two things at once: a professional duty and a contract. Generative AI touches both in four places, and in none of those four does the line sit at the tool. It sits at the firm's decision about which case information may go into which environment, and at the moment the lawyer sees that decision.
Why is confidentiality two things at once for a lawyer?
The professional duty is the familiar part. A lawyer has a statutory duty of confidentiality and legal privilege: what a client entrusts to them stays with them, also before a court. The dean supervises it and the disciplinary court rules on it. The duty covers everything the client entrusts, not just personal data, and it does not transfer to the vendor of a tool. The Netherlands Bar has published recommendations on AI in the legal profession along the profession's core values; under confidentiality the substance is that a lawyer knows and controls the data flows and puts no confidential data into free tools.
The contractual part is less visible and just as firm. The engagement letter, the non-disclosure agreement in a transaction, the procurement terms of a large client: more and more often these say something about AI, from a duty to notify to a ban on external AI services on the matter. That applies to in-house counsel too, who hold no privilege but do sit under the confidentiality terms of their employer and its customers.
A data processing agreement under the GDPR settles neither. It settles what the vendor does with personal data. It is a condition for considering a tool, not an answer to which case information may go in.
Where does generative AI touch that confidentiality?
In four places, and most firms have only the first in view.
| Place | What happens | What the firm decides |
|---|---|---|
| Input | What someone pastes or uploads goes to the vendor; on a personal account it can be used for training unless switched off | Which case information may go into which environment, and which account is the preferred route |
| Memory | The tool stores facts and references earlier chats; context from one matter can return in a conversation about another | Whether memory may be on for case work, and who manages it |
| Connections | An assistant that reads the case management system, the mailbox or SharePoint sees everything the user may reach, including what was opened too widely | Which sources an assistant may search, and whether the permissions on them are correct |
| Sharing | A shared link, a connected app or an export takes a conversation outside the tool | Whether sharing by link is permitted, and which apps an administrator allows |
The first place is the known one. What goes wrong with a pasted email thread or an uploaded file is in ChatGPT and work data, and what travels inside a PDF without you seeing it in before you paste a PDF into ChatGPT.
The second place surprises lawyers most often. The major chatbots now remember things between conversations: memories you explicitly let them save, and references to earlier chats the tool makes on its own. How that works and where the switches are is in how AI memory works. For a firm the consequence is concrete: a party name from an acquisition in March can surface in a draft letter about an employment matter in June, for a different client, without anyone typing that name again.
The third place is a different kind of risk. A tool that reads case files itself, such as Microsoft 365 Copilot in SharePoint and the document management system, does not see what someone pastes but everything their permissions reach. A folder opened years ago to "everyone at the firm" was protected by nobody finding it. An assistant finds it; see Copilot and SharePoint. At a firm with information barriers between practice groups, that is not a detail.
What does a business account change, and what not?
The account type is the biggest switch, and it settles three things. On business tiers input is not used for training by default, a processing agreement is in place, and an administrator can set memory, apps and sharing centrally. The difference per vendor is in free vs business AI accounts.
What the account does not change matters more to a lawyer than to most other professions. It does not decide whether the employee's name and the reason for dismissal should have been in the prompt. It does not decide whether the client has permitted AI use on their matter. And it does not move the duty of confidentiality: that stays with the lawyer, whatever the contract with the vendor says.
A thirty-lawyer firm has set up ChatGPT Team, with training off and a processing agreement in place. An associate has it summarise a due diligence memo, with the name of the target company and the purchase price. Three months later, in a conversation about an entirely different matter, the tool offers that company's name as an example. Nothing leaked outside, the account was the right one, and yet case information about client A now sits in a conversation about client B. The firm had never assessed memory, because the assessment was about training and the agreement.
What does a firm arrange?
Six agreements, in this order.
Per tool a decision with a condition about case information: anonymised text only, no party names and case numbers, or full documents too. That decision lives in the firm's AI register, per application. A business account as the preferred route, with the free tier of the same tool pointing to that account as the alternative. Memory switched off centrally for case work where possible, or an instruction to use a temporary chat for case work. Connections assessed separately, with the permissions on the sources fixed first. Sharing by link and connected apps limited by the administrator. And the client's terms on AI known per matter by whoever works on it.
The seventh is not an agreement but the moment itself. All those decisions exist in a protocol, and the employment lawyer at a quarter past ten does not know the protocol by heart. What helps is that the decision appears when she opens the tool, and that the employee's name and salary are marked while she pastes. BeeSensible does that in supported AI tools: party names, case numbers, amounts and company registration numbers are marked as she types, the lawyer chooses whether to mask, remove, or keep them, and the text is discarded after detection and never stored. The firm's decision about a tool appears in the browser at the moment someone opens it. How that works for a firm is on the page for legal organisations.
The rest of the work around AI at a firm, from seeing what is used to showing the agreements are followed, is collected under the topic AI governance.
Next time the settlement agreement still goes into a chatbot, but on the business account, without the name and without the salary, and with the question of what the client agreed about AI answered before the prompt is sent.
