What it means for a UK law firm
Client confidentiality is set out in paragraph 6.3 of the SRA Code of Conduct for Solicitors, RELs and RFLs. The duty applies when client information is entered into an AI tool just as it does when information is sent to any other outside supplier. The SRA's warning notice on the misuse of AI says client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality.
Client confidentiality is wider than legal professional privilege. Confidentiality covers all information about a client's affairs, not only privileged communications, and it continues after the retainer ends.
Client information that includes personal data is also protected by UK GDPR. A firm using an AI provider to process that data needs a written contract with the provider meeting Article 28 of UK GDPR, and must meet the rules on transfers outside the UK if processing happens abroad.
Example
Illustrative scenario
A family team wants to use AI to summarise financial disclosure. Before allowing it, the firm checks the AI provider's contract for training, retention and processing location, records its decision, and tells the team which tool is approved for client documents.
How Chancery handles it
Chancery gives each firm a separate database, with row-level security inside it. Data is stored in Microsoft Azure UK South, AI processing takes place within Microsoft's EU data zone, and access follows the firm's own structure, with private, team, firm-wide and matter-level sharing; see Security.
Related terms
- Legal professional privilege
- Data residency
- Model training on client data
- Zero data retention (ZDR)
- Shadow AI