AI data leakage in law firms: what leaves when client files go into ChatGPT or Claude.

The regulators have said it plainly: confidential, sensitive or privileged client information cannot safely be entered into publicly available AI chatbots. What that looks like in practice is less often shown. This series takes eighteen documents a law firm produces every week, from the advice letter to the brief to counsel, marks every item rule 9, privilege or statute protects, and shows where each one goes when the document is pasted into ChatGPT or Claude. Each page ends with the same document on Ermos, inside the firm.

The documents, one at a time

LetterThe letter of advice

Client, facts, opponent, prospects and strategy. Privileged advice, in the document privilege was made for.

See what leaves → NotesThe file note of a client conference

Instructions, admissions, health and family details and the solicitor’s own impressions. Nobody outside the room was meant to see this.

See what leaves → EmailThe client update email

The other side’s position, counsel’s view, the costs so far and the next move, in the most routine email the firm sends.

See what leaves → EmailThe without-prejudice settlement email

The offer, the reasoning, the pressure points and the walk-away figure. The firm’s negotiating hand, mid-negotiation.

See what leaves → EmailThe letter to the other side

Everyone named, the client’s position stated, documents demanded. Open correspondence, drafted from a privileged file.

See what leaves → Report or memoDocuments obtained on discovery

The other side’s documents, produced under compulsion, which the court allows to be used for one purpose only.

See what leaves → RecordThe family law affidavit

Parties, children, a school, a workplace and the allegations. Everything Part XIVB of the Family Law Act lists as identifying material.

See what leaves → EmailThe conveyancing settlement email

Purchase price, bank details, identity documents and the settlement date. Everything a payment redirection fraud needs, in one email.

See what leaves → Report or memoThe contract review memo

Counterparties, price, indemnities and the client’s fallback positions, on a deal that is itself under NDA.

See what leaves → Report or memoThe brief to counsel

The chronology, the evidence, the weaknesses and the questions for advice. The whole matter, in the document that goes to the barrister.

See what leaves → LetterThe letter of demand

The debtor, a director’s personal guarantee, the invoices and an internal note on what the client will accept.

See what leaves → FormThe will instruction sheet

Children, guardians, a capacity note, assets and a claim not yet decided. A client’s plans for the worst case, in her own words.

See what leaves → SpreadsheetThe probate inventory spreadsheet

Property, accounts, shares and super, with a column of internal notes about a daughter who may contest. An estate on one sheet.

See what leaves → LetterThe termination advice letter

A named worker, an allegation, a compensation claim, a union delegate and the amount the client will pay to end it.

See what leaves → LetterThe letter of instruction to an expert

The questions put to the expert, a gap in the client’s own inspection records and documents produced on subpoena.

See what leaves → AgreementThe costs agreement and disclosure

The client, her budget, the sister who is paying and the firm’s rates, in the document every matter starts with.

See what leaves → SpreadsheetThe time and billing spreadsheet

Matters, fee earners, narrations, write-down notes, a deal under NDA and the identity checks, in one month-end export.

See what leaves → TranscriptThe client call transcript

Medication, a job interview, the settlement floor, the solicitor’s candid view and a deleted text message, in a client’s own words.

See what leaves →

How the leakage happens

The mechanism is the same for every document. The whole text is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia. On consumer tiers it can be retained and used to train future models. The provider’s staff and systems can reach it under the provider’s own policies. Once sent, the firm no longer controls it. Our on-premise vs cloud comparison sets out the four ways to run AI and where each one puts your documents.

The obligations in play

Each marked item on these pages links to the guide that covers its obligation:

The same documents on Ermos

Ermos Dominion drafts and searches on a unit in your office, so the documents never leave it. Ermos Edge keeps your documents on your own instance in an Australian data centre and sends only permitted excerpts, per question, to a named Australian provider. Every page in this series ends with both, item by item.

Common questions

Can lawyers use ChatGPT or Claude with client information?
Not safely in a publicly available tool, as the Law Society's guidance warns. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. Rule 9 protects confidential client information, and privilege depends on advice staying confidential. Discovered documents may be used only in the proceeding, as Hearne v Street restates. Part XIVB of the Family Law Act restricts communicating to the public an account of family proceedings that identifies a party, witness or child, and whether pasting into an AI tool counts is undecided.
Do ChatGPT and Claude train on what staff paste in?
As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. For lawyers, that matters because privileged advice pasted into a personal account could be used for training without the practice knowing.
Do business plans such as ChatGPT Business or Claude Team solve the problem for lawyers?
Only in part, because the practice would still be relying on an outside company's terms. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. For lawyers, the careful question then is whether sending privileged advice to a third-party service is consistent with keeping it confidential. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.
What is a safer way for a law firm to use AI with client documents?
A safer way is to draft inside an environment the practice controls. Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. That covers privileged advice, settlement figures and discovered documents alike.
What is AI data leakage in a law firm?
Client information leaving the firm's control through an AI tool. When a document is pasted into ChatGPT or Claude it is transmitted to the provider's servers, can be retained on the provider's terms, can be used to train future models on consumer tiers, and can be reached by the provider's staff and systems. For a law firm the leaked information is usually confidential, often privileged, and sometimes restricted by statute.
Which legal documents carry the most risk?
Anything privileged, anything obtained by compulsory court process, anything from family law proceedings, and anything carrying bank details for settlement. The pages in this series take each one in turn.
Does an enterprise AI subscription change this?
It improves the contract: no training on your data by default, admin controls, shorter retention. The document is still transmitted to and processed by a third party, for the major providers outside Australia, which is the fact a privilege or confidentiality analysis has to deal with. The Law Society guidance expects a careful review of the terms before any client information is involved.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI for law firms The Law Society AI guidance All professions