AI use in a legal practice sits across overlapping frameworks. Most are addressed by good workflow design rather than by avoiding AI altogether.
Privacy Act 2020 and client confidentiality.
Client information is both personal information under the Privacy Act and subject to the lawyer's professional confidentiality obligation. Two practical implications: vendor data residency (NZ or AU strongly preferred), and contractual terms that prohibit any use of client data for training future models. Public AI chat interfaces are categorically not suitable for client-identifying information without anonymisation. We help firms pick tools that handle both cleanly.
Law Society conduct rules and professional supervision.
The Law Society's conduct rules require lawyers to act with professional competence, confidentiality, and care, and to supervise work product. None of those rules prohibit AI assistance. They do require that the responsible lawyer maintain judgment over the output, that supervision is documented, and that any junior staff using AI-assisted workflows are appropriately supervised. Our workflow designs put the lawyer's signoff at every output step, with the AI draft archived as supporting material rather than as the deliverable.
Copyright on training data.
There are two distinct copyright issues, and they should be addressed separately. First, whether the underlying model was trained on copyright material without licence (a vendor-level question, currently being litigated in several jurisdictions). Second, whether client work product sent into the tool might be retained and used to train future models, which is contractually addressable and we strongly recommend prohibiting in your vendor terms. The second question is much more directly under the firm's control.
Disclosure to clients.
Increasingly best practice and we recommend it. The clause we typically draft for engagement letters covers: categories of AI tools used by the firm, protection of client data, the fact that lawyer professional judgment remains the lawyer's responsibility, and a contact point for client questions. Most clients accept the clause without comment. The handful who ask follow-up questions tend to be reassured by the documented approach.
PI insurance considerations.
Most NZ PI insurers are now actively asking about AI use as part of renewal. Carrier expectations vary, but the common themes are: documented workflow, named-lawyer signoff, audit trail, written acceptable use policy, and disclosure to clients. A Risk + Compliance Review delivers exactly the documentation packet PI insurers prefer to see. We've briefed practices' PI insurers directly as part of engagement closeout.
Sample audit narrative.
For an AI-assisted contract review, a Law Society-aligned audit trail looks like: client matter file with the source contract, AI-generated first-pass review archived alongside, named lawyer's reviewed and edited markup as the final deliverable, with a brief sign-off note recording the lawyer's review and any judgment calls. None of this is structurally different from how a typical firm already documents the human-only equivalent.