Know What You Can Put Into an AI Assistant
Use Claude, ChatGPT, or Perplexity without accidentally putting client or confidential information somewhere it does not belong.
You will know how to decide whether information is low-risk, needs an approved tool, or should stay out.
Start with what you can safely share
Before you put information into an AI assistant, pause and ask whether that information belongs in that tool. Lawyers and legal professionals should do this whether they are learning, brainstorming, researching, drafting, or working on a real matter.
An AI assistant can be useful, but it is still a separate tool or workspace. The concern is not that every AI assistant is unsafe. The concern is that different tools and accounts can handle prompts, uploaded files, outputs, conversation history, review, retention, logging, and model improvement in different ways.
Some approved business, enterprise, legal, or internal tools may be cleared for confidential work. Other accounts may only be appropriate for public, invented, or fully redacted information. Before you paste, ask what the information is, which tool and account you are using, and whether that tool is approved for that kind of information.
When real client work is involved, follow your organization's policies for confidentiality, privilege, approved tools, and client consent, plus any professional-conduct rules, ethics guidance, court rules, or jurisdiction-specific requirements that apply.
How to check the rules
Start with your own organization: ask a supervising lawyer, ethics counsel, risk team, IT/security team, law school clinic director, or other person responsible for AI and confidentiality rules.
Then check official sources for the places where you practice or appear: state bar or professional-responsibility guidance, court rules, judge or chamber orders, local rules, client requirements, and the terms or security documentation for the tool itself.
You can ask an AI assistant to help you make a checklist or find likely official sources, but do not treat the assistant's summary as the rule. Use it as a map, then verify against the official source.
I am a legal professional trying to find official rules and guidance about lawyers using AI assistants in [jurisdiction] and, if relevant, [court]. Do not give legal advice and do not rely on unofficial summaries. Give me a checklist of official sources to check, search terms to use, and questions to ask my organization before putting client or confidential information into an AI tool.Lower-risk examples
- A public case, statute, rule, agency page, or court form.
- A made-up fact pattern with no real client, witness, employee, company, or matter details.
- A paragraph you wrote yourself asking for a clearer structure, a checklist, or follow-up questions.
- A redacted excerpt after names, contact information, docket numbers, transaction details, and identifying facts have been removed.
Information that needs an approved tool
- Client names, matter names, addresses, phone numbers, emails, account numbers, or other identifying details.
- Privileged communications, litigation strategy, settlement positions, investigation notes, or unreleased deal terms.
- Contracts, pleadings, discovery responses, emails, or transcripts that contain real client facts.
- Medical, financial, employment, trade-secret, or other sensitive personal or business information.
What approved means
Approved does not just mean you personally have an account. It means your organization has cleared that product, account, workspace, or connector for the kind of information you plan to enter and the kind of task you plan to do.
Approval can differ by tool and setting. A personal chat account, team workspace, enterprise plan, legal research connector, and internal firm tool may have different rules for confidentiality, retention, model improvement, account access, and logging.
An unapproved tool is not automatically bad. It just means you should treat it like a public or unknown workspace: use public, hypothetical, or fully redacted material until your organization says real client information is allowed.
Three questions before you paste
- Is this information public, invented, or fully redacted?
- If not, is this exact tool and account approved for this kind of information and this kind of task?
- Could the prompt, file, or output reveal a client, matter, strategy, privileged communication, or sensitive personal or business information?
The answer still needs review
Safety is not only about what you paste. It is also about what you do with the answer. Treat AI output as research assistance until a human checks the legal support.
Later lessons will show you how to move from a helpful research idea to source-backed results grounded in citations, quotes, and source text you can inspect.