An employment lawyer is finishing a settlement agreement at a quarter past ten in the evening. She pastes the draft into a chatbot and asks it to tighten the notice clause. The draft contains the employee's name, the salary and the reason for dismissal, and the chatbot runs on the account she also uses at home to look up recipes.
For a lawyer, confidentiality is two things at once: a professional duty and a contract. Generative AI touches both in four places, and in none of them does the line sit at the tool. It sits at the firm's decision about which case information may go into which environment, and at the moment the lawyer sees that decision.
Why is confidentiality two things at once for a lawyer?
The professional duty is the familiar part. A lawyer has a statutory duty of confidentiality and legal privilege: what a client entrusts to them stays with them, including in court. The local dean of the Bar supervises it and the disciplinary tribunal rules on it. The duty covers everything the client entrusts, not just personal data, and it does not transfer to the vendor of a tool. The Netherlands Bar has published recommendations on AI in the legal profession, structured around the profession's core values; on confidentiality, the gist is that a lawyer knows and controls the data flows and puts no confidential data into free tools.
The contractual part is less visible but just as binding. The engagement letter, the non-disclosure agreement in a transaction, the procurement terms of a large client: these increasingly say something about AI, from a duty to notify to a ban on using external AI services on the matter. That applies to in-house counsel too: they have no privilege, but they are bound by the confidentiality terms of their employer and its customers.
A data processing agreement under the GDPR settles neither. It covers what the vendor does with personal data. It is a precondition for considering a tool, not an answer to which case information may go in.
Where does generative AI touch that confidentiality?
In four places, and most firms have only the first in view.
| Place | What happens | What the firm decides |
|---|---|---|
| Input | What someone pastes or uploads goes to the vendor; on a personal account it can be used for training unless switched off | Which case information may go into which environment, and which account is preferred |
| Memory | The tool stores facts and references earlier chats; context from one matter can resurface in a conversation about another | Whether memory may be on for case work, and who manages it |
| Connections | An assistant that reads the case management system, the mailbox or SharePoint sees everything the user has access to, including anything shared too widely | Which sources an assistant may search, and whether the permissions on them are correct |
| Sharing | A shared link, a connected app or an export takes a conversation outside the tool | Whether sharing by link is permitted, and which apps an administrator allows |
The first place is the well-known one. What can go wrong with a pasted email thread or an uploaded file is covered in our article on ChatGPT and work data, and what a PDF carries that you cannot see is explained in our guide to redacting a PDF before you paste it.
The second place surprises lawyers most often. The major chatbots now remember things between conversations: memories you explicitly let them save, and references to earlier chats the tool makes on its own. How that works, and where to switch it off, is explained in our article on AI memory. For a firm, this means that a party name from an acquisition in March can surface in a draft letter about an employment matter in June, for a different client, without anyone typing that name again.
The third place is a different kind of risk. A tool that reads case files itself, such as Microsoft 365 Copilot in SharePoint and the document management system, sees more than what someone pastes: it sees everything that person's permissions give access to. A folder opened up years ago to "everyone at the firm" was only protected because nobody found it. An assistant will find it; see Copilot and SharePoint. At a firm with information barriers between practice groups, that is no small matter.
What does a business account change, and what stays the same?
The account type is the biggest lever, and it settles three things. On business tiers, input is not used for training by default, a data processing agreement is in place and an administrator can set memory, apps and sharing centrally. How this differs by vendor is set out in our comparison of free and business AI accounts.
What the account does not change matters more to a lawyer than to most other professionals. It does not decide whether the employee's name and the reason for dismissal should have been in the prompt. It does not decide whether the client has permitted AI use on their matter. And it does not move the duty of confidentiality: that stays with the lawyer, whatever the contract with the vendor says.
A firm of thirty lawyers has set up ChatGPT Business, with training switched off and a data processing agreement in place. An associate uses it to summarise a due diligence memo that includes the name of the target company and the purchase price. Three months later, in a conversation about an entirely different matter, the tool offers that company's name as an example. Nothing leaked outside the firm and the account was the right one, yet case information about client A now sits in a conversation about client B. The firm had never looked at memory, because its assessment covered training and the agreement.
What does a firm need to put in place?
Six measures, in this order.
First, a decision on each tool with a condition about case information: anonymised text only, no party names or case numbers, or full documents as well. That decision is recorded in the firm's AI register, per application. Second, a business account as the preferred option, with the free tier of the same tool pointing to that account as the alternative. Third, memory switched off centrally for case work where possible, or an instruction to use a temporary chat for it. Fourth, connections assessed separately, with the permissions on the sources fixed first. Fifth, sharing by link and connected apps restricted by the administrator. And sixth, whoever works on a matter knows the client's terms on AI.
The seventh is not a measure but the moment of use itself. All those decisions are written down in a protocol, and the employment lawyer working at a quarter past ten does not know it by heart. What helps is that the decision appears when she opens the tool, and that the employee's name and salary are highlighted as she pastes. BeeSensible does this in supported AI tools: party names, case numbers, amounts and company registration numbers are highlighted as she types, and the lawyer chooses whether to mask, remove or keep them (unless the firm has set masking on paste or on send to "Always on"). The text is discarded after detection and never stored. The firm's decision about a tool appears in the browser when someone opens it. How this works for a firm is explained on the page for legal organisations.
The rest of the AI work at a firm, from seeing which tools are used to showing that what was agreed is being followed, is gathered under the topic AI governance.
Next time, the settlement agreement still goes into a chatbot, but on the business account, without the name or the salary, and with the question of what the client agreed about AI answered before the prompt is sent.
