Client emails and AI data leakage: what a litigation update gives away in ChatGPT or Claude.

Most of what a law firm writes to clients is email, and most of it is updates: what the other side said, what counsel thinks, what it is costing and what happens next. Routine is why it gets pasted into ChatGPT or Claude to be made clearer and kinder. This page marks every item in an ordinary update email that rule 9 and privilege protect, which turns out to be nearly all of it, and shows how the same email is drafted on Ermos from the matter file without leaving the firm.

The client update email

Sent after a development in the matter, such as a defence being filed, a conference with counsel or a directions hearing.

To: Marguerite Soto¹
From: Hamish Reid, Carrick Doyle Lawyers⁸
Subject: Soto v Greystone¹: update after the defence

Dear Marguerite,

Greystone filed its response on Friday. In short:

They say the redundancy was part of a restructure approved by the board in May, before you raised the capitalisation issue, and they have attached board minutes. We have asked for the unredacted minutes and the papers that went to the board.²
They deny the “convenient” remark was made. Mr Whitcombe has sworn an affidavit to that effect.³
They have raised the emails you forwarded to your Gmail account and say this was a breach of your contract and their IT policy. We expected this. It does not defeat the claim, but it will be used on credit and possibly to reduce compensation.⁴

I conferred with counsel, Ms Priya Raman, yesterday. Her view is that the board minutes are the key document: if the restructure was genuinely approved in May, our timing argument weakens considerably, and she would then advise settling at conciliation rather than pressing to hearing. She put our prospects at hearing at roughly 55 to 60 percent on the current material.⁵

Costs to date are $9,840 plus GST, within the estimate. Counsel’s fees for the conference and the conciliation will be approximately $4,500.⁶

Conciliation is listed for 13 November at 10am before the Fair Work Commission. Please keep the morning free. Before then, please send me the text message from Mr Whitcombe about the Parramatta loss; counsel wants to see it before she advises on whether to use it.⁷

Kind regards,
Hamish⁸

An invented email. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

The client and the matter

Named parties and the subject line. Everything below is identifiable. Rule 9 confidentiality guide.

Frontier Models (ChatGPT, Claude)	Transmitted to the provider, generally offshore on personal plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The other side’s case

What the employer has pleaded and what the firm has asked for. Confidential to the client, and a summary of the opponent’s position that the opponent did not give the provider. Rule 9 confidentiality guide.

Frontier Models (ChatGPT, Claude)	The opponent’s pleaded case transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A sworn denial by a named individual

That an executive has sworn an affidavit denying a remark. Information from proceedings about a third party. Rule 9 confidentiality guide.

Frontier Models (ChatGPT, Claude)	A named executive’s sworn denial transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The client’s weak point and the firm’s view of it

The forwarded emails and the solicitor’s assessment of their effect. Privileged advice on the matter’s biggest vulnerability. Legal privilege guide.

Frontier Models (ChatGPT, Claude)	Privileged advice on the weak point; on consumer tiers it can train future models
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Counsel’s opinion and a percentage

A named barrister’s view on prospects and on when to settle. Privileged, and the paragraph that decides the matter. Legal privilege guide.

Frontier Models (ChatGPT, Claude)	Counsel’s opinion now on a third party’s servers
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Costs

What the client has spent and what counsel charges. Confidential to the client, and billing information the Law Society guidance expects to be handled with care. Law Society AI guidance.

Frontier Models (ChatGPT, Claude)	Billing information transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The hearing and a request for evidence

A listing, and an instruction to send a text message that counsel wants to see. The next move, written down. Legal privilege guide.

Frontier Models (ChatGPT, Claude)	The next move transmitted before it is made
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The solicitor

Ties the email to a solicitor bound by rule 9, working under a partner’s supervision. Supervising AI guide.

Frontier Models (ChatGPT, Claude)	Transmitted, and the leak is traceable to you
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the matter file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in law firms. See how this works in practice: Litigation work on Ermos.

Common questions

Do ChatGPT and Claude use the information in a client update email?

Yes, whatever is pasted in is sent to the AI company's servers to be processed. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. A routine update carries counsel's percentage, the client's weak point and the costs to date.

Can we use ChatGPT or Claude for a client update email if we remove the names?

Not safely, because an update email identifies the dispute by its content. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. The employer's pleaded case, counsel's percentage on prospects and the conciliation date describe one matter to anyone connected with it. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.

What if staff use their own ChatGPT or Claude account for a client update email?

The practice loses sight of the update, because a personal account belongs to the staff member who opened it. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. Both companies can also review content that is flagged for safety or policy reasons. For a client update email, that places counsel's opinion, the costs to date and the client's weak point where the practice cannot account for them to the client.

How can a law firm use AI for a client update email without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The solicitor asks for the update in plain language, and it is built from the matter file in the firm's house style. The solicitor checks every figure against the pleadings and the costs ledger before sending it under their own name.

It is only an update. Why does it matter?

Because the update is where the privileged material ends up in plain words: counsel's percentage, the weak point, the settlement timing. Formal advice is drafted carefully; the email summarising it is pasted into a chatbot at 6pm to make it kinder.

Does counsel's opinion leaving the firm affect counsel?

The opinion is the client's privileged material, and the firm holds it on the client's behalf. Counsel's name attached to a percentage, outside the firm, is also a professional matter for counsel, who was never asked.

How is an update drafted on Ermos?

From the matter file on your own network: the pleadings, the conference note and the costs ledger, with the firm's house style as the template. The email is the same. Where it was drafted is the difference.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in law firms AI for law firms The Law Society AI guidance All professions