The professional conduct framework for AI in legal practice

Every jurisdiction's professional conduct rules require lawyers to provide competent legal services. In the context of AI, competence has two dimensions: competence in the substantive legal work (which AI may assist with but cannot replace) and competence in the use of AI tools (which includes understanding their limitations and supervising their outputs). A lawyer who uses AI to research a legal question without understanding that AI systems can fabricate case citations has not exercised the professional competence their rules require.

The practical implication: before using any AI tool in legal practice, a lawyer should understand what the tool does and does not do reliably, what its failure modes are, how to verify its outputs, and whether its data handling satisfies confidentiality obligations. This is not a high bar, lawyers do not need to understand the technical architecture of AI tools, only their practical behaviour in legal contexts. But it is a genuine obligation, not a theoretical one.

Confidentiality and AI: the non-negotiable

Legal professional privilege and lawyer-client confidentiality are among the most stringent confidentiality obligations in any professional context. They apply regardless of what tool is used to perform legal work. A lawyer who dictates a confidential memo and hands the tape to an untrusted third party has breached confidentiality. A lawyer who inputs a confidential client matter into a commercial AI tool with inadequate data protection arrangements has done the equivalent.

The practical standard: before inputting any client information into an AI tool, a lawyer must be satisfied that: the AI provider will not use the input data for training or other purposes, the data will be held securely, the data processing terms satisfy applicable privacy law, and the use is consistent with any client confidentiality agreement or retainer. Consumer tiers of general-purpose assistants differ from one another and their terms change: some now require an explicit opt-in before conversations are used for model improvement, others use them by default, so the position for any given product has to be checked against that provider's current published terms rather than assumed from its category. What does not vary is that consumer tiers are not sold with the contractual data-protection commitments a law firm needs, and a privacy toggle is not a substitute for one. Law firms using AI for client work must obtain enterprise agreements with explicit data protection terms, not rely on consumer products.

Accuracy and verification: the hallucination liability

The AI hallucination problem is particularly acute in legal practice because the consequences of submitting fabricated legal authority to a court are severe. Courts in the US, UK, and Australia have sanctioned lawyers who filed pleadings with AI-generated citations to non-existent cases. The professional conduct consequences of submitting fabricated authority range from formal reprimands to costs orders to, in the most serious cases, disciplinary proceedings. The verification standard is clear: any legal authority cited in a court document, legal advice, or professional opinion must be verified against an authoritative source, a legal database subscription, official court reports, or legislation databases, before use. AI-generated citations that have not been independently verified cannot be relied upon.

Further reading: American Bar Association AI

Related reading

Further reading: SRA, Compliance tips for solicitors on the use of AI and technology (updated 9 February 2026), Law Society of NSW, court protocols on AI