Using AI safely in legal and compliance work

Legal and compliance teams hold some of the most sensitive material in a company: privileged advice, litigation strategy, investigation files, deal documents, and personal data. Putting that material into an unapproved tool can risk privilege, breach a confidentiality agreement, or violate data protection rules. The professional duty of confidentiality applies to AI tools as it does to any other channel.

Keeping it safe also covers the output. A filing or memo that relies on an invented authority creates risk for the company and the practitioner. So does advice that presents an AI answer as a professional opinion.

Where it comes up

• Reviewing deal documents under an NDA

  Before using AI on a counterparty’s documents, check whether the confidentiality agreement and your company’s AI policy allow it. Use only tools approved for confidential material.

• Summarizing an internal investigation file

  Investigation material may be privileged and may contain personal data about employees. Confirm the tool is approved for privileged work and limit the data to what the task needs.

• Drafting a court or regulator submission

  Every authority must be verified in a primary source, and some forums have rules on disclosing AI use. Check those rules before drafting.

What it looks like at each band

1. E1 · Foundational

   Knows that confidential and privileged material needs care, but does not always recognize it in a forwarded email chain or an attachment. Follows the company AI policy when reminded of it.

2. E2 · Proficient

   Uses approved tools for confidential and privileged material as a habit. Removes personal data the task does not need. Recognizes work that needs professional judgment and should not be delegated to AI.

3. E3 · Distinguished

   Judges risk across a whole matter, including privilege, contractual confidentiality, data protection, and disclosure duties. Raises concerns before work starts rather than at review. Knows when a task should not use AI at all.

4. E4 · Exceptional

   Shapes the team’s practice: which tools are approved for which material, how privilege is protected, and how AI use is disclosed where required. Handles a mistake openly and fixes the process that allowed it.

Common mistakes

• Pasting privileged advice into an unapproved tool

  Sharing privileged material with a third-party service on unclear terms can put privilege at risk. Use tools your company has approved for this material.

• Forgetting the counterparty’s confidentiality terms

  An NDA or data room agreement may limit how you process the other side’s documents. Read the terms before you upload anything.

• Overlooking personal data in legal files

  Employment disputes, investigations, and customer complaints carry personal data that data protection rules govern. Remove what the task does not need.

A worked example

Summarizing a set of employee complaint files to find common themes for a compliance report.

The full study guide for this skill, for every role, is Keeping it safe. The other five skills for legal and compliance professionals are on the AI skills for legal and compliance professionals page. A one-page summary is in the AI data safety checklist.