AI can save enormous amounts of time—but giving it access to confidential client information requires more thought than simply turning on an integration.
Artificial intelligence is quickly becoming a useful tool for law firms.
Imagine being able to ask:
“Summarize everything that has happened in the Smith case during the last 60 days.”
Or:
“Find the medical records that discuss the client’s prior back injury.”
Or:
“Prepare a first draft of a case chronology using the documents in this matter.”
Those capabilities can save attorneys and staff hours of work.
But there’s an important difference between asking AI a general legal question and connecting AI directly to your case-management system.
What Information Are You Giving AI?
A law firm’s case-management system may contain some of the most sensitive information a business can possess:
- Attorney-client communications
- Medical information
- Financial records
- Discovery documents
- Personally identifiable information
- Litigation strategy
- Attorney work product
Before connecting any AI system to that information, the first question shouldn’t be:
“What can the AI do?”
It should be:
“What information will the AI be able to access, and what happens to that information?”
Not All AI Accounts Are the Same
There is an important difference between consumer AI services and commercial or enterprise AI platforms.
Business-oriented AI services can provide stronger controls over how information is stored, retained, accessed and used.
For example, Anthropic states that information submitted through its commercial Claude products is not used to train its AI models by default. Enterprise and API implementations can also provide additional administrative, retention and security controls.
For a law firm, choosing the right account and configuration is not a minor technical detail.
It should be part of the security decision.
Give AI Only the Access It Needs
If an AI assistant needs access to one case, should it have access to every case in the firm?
Probably not.
The same security principle that applies to employees should apply to AI:
Give it the minimum access necessary to perform the job.
Modern AI integrations can use a dedicated account to control what the AI is allowed to access. This is an important safeguard—but it only works if that account is configured properly.
Before connecting AI, determine exactly what information it needs. If the initial goal is to summarize cases or locate information, the AI may only need read access. It may not need permission to modify case records, create tasks, upload documents, change appointments, or perform other actions.
Permissions should be designed around users, matters and functions.
An attorney working on Matter A shouldn’t accidentally receive information from Matter B simply because the AI system can see both.
Reading Is Different From Acting
There is also a major difference between allowing AI to read information and allowing it to take action.
Consider these capabilities:
Lower risk: Summarize a document.
More risk: Search an entire matter.
Still more risk: Draft correspondence using matter information.
Higher risk: Write information back into the case-management system.
Much higher risk: Send correspondence, modify records or perform actions without human approval.
As AI becomes more capable, firms need to decide exactly where the human approval point should be.
There is an important difference between allowing AI to retrieve information and allowing it to take action.
Asking AI to summarize a case, locate a document, or identify upcoming appointments is very different from allowing it to update case information, create tasks, upload documents, send communications, or trigger workflows.
Before enabling an AI integration, understand not only what information the AI can see, but what actions it is capable of performing.
A sensible approach is to begin with read-only capabilities wherever practical and add additional permissions deliberately.
AI Can Be Wrong
AI-generated answers can sound extremely confident even when they’re incorrect.
In a law firm, that matters.
An incorrect summary, nonexistent citation, missed deadline or misunderstood document can have consequences far beyond an ordinary office mistake.
AI should assist professional judgment—not replace it.
Important AI-generated work should be reviewed by a qualified person before anyone relies upon it.
Attorneys Still Have Professional Responsibilities
Using AI doesn’t transfer an attorney’s professional obligations to the AI company.
Lawyers still have responsibilities involving client confidentiality, competence, supervision and accuracy.
That means a firm should understand how an AI product handles information before confidential client information is provided to it.
Seven Questions to Ask Before Connecting AI
Before connecting Claude, ChatGPT or another AI platform to a legal case-management system, ask:
- Is this a business or enterprise AI account designed to protect organizational data?
- Is our information used to train the AI model?
- How long is our information retained?
- Who can access the information?
- Can we restrict AI access by user and matter?
- Is the AI’s access limited to the minimum information and permissions it actually needs?
- What actions can the AI perform without human approval?
- Who verifies the AI’s work before we rely on it?
If you can’t confidently answer those questions, you probably aren’t ready to connect the systems yet.
The Goal Isn’t to Avoid AI
The lesson isn’t that law firms shouldn’t use artificial intelligence.
Quite the opposite.
AI has the potential to dramatically improve how attorneys find information, review documents, prepare summaries and manage large amounts of case information.
The objective is to gain those benefits without unnecessarily putting confidential client information at risk.
Start with the business problem.
Determine what information the AI actually needs.
Limit its access.
Put appropriate security and privacy controls around it.
And keep a human responsible for the result.
Sources & Further Reading
ABA Opinion: Generatice AI Tools
American Bar Association — Formal Opinion 512: Generative Artificial Intelligence Tools
NIST — Artificial Intelligence Risk Management Framework: Generative AI Profile
NIST Generative AI Risk Management Profile
Anthropic — Commercial Data and Model Training
Anthropic commercial data policy
Considering AI for your law firm?
Computers, Inc. can help evaluate the technical and security requirements before connecting AI to confidential business systems.
