AI Governance · Australian Law Firms

Your Firm Is Adopting AI. Time to Govern It.

Shadow AI in a law firm is fee earners putting client matter data into ChatGPT, Copilot, or a consumer AI tool the firm has not approved. That is a confidentiality problem under the Australian Solicitors' Conduct Rules, a Privacy Act exposure, and a question your PI insurer will ask at renewal. 3 Peat builds the register, the approved-tools policy, and the framework managing partners need to show adequate systems.

What counts as Shadow AI in an Australian law firm

It is not Harvey, CoCounsel, or another vendor under a firm contract. It is a solicitor pasting a client email into a personal ChatGPT account, a paralegal dropping a brief into a free summariser, or Copilot on a home laptop with no data processing agreement. The tool is usually free. The client data is not. Once matter facts leave the firm's environment, confidentiality, privilege, and APP 11 security obligations are in play even if nobody meant harm.

What Australian guidance already applies

There is no standalone AI Act for law firms yet. Existing duties already cover the risk. The Supreme Court of Victoria published Guidelines for the Responsible Use of Artificial Intelligence in Litigation in May 2024. In December 2024 the NSW Law Society, the Legal Practice Board of Western Australia, and the Victorian Legal Services Board and Commissioner said lawyers cannot safely put confidential, sensitive, or privileged information into public AI chatbots, and that practices need a risk-based policy. Privacy Act APPs and Legal Profession Uniform Law confidentiality sit under that. A missing policy is itself a signal to a regulator, a client, or a PI underwriter.

What managing partners need to be able to show

Three artefacts, not a 40-page strategy deck. An AI register of tools actually in use. An approved-tools policy that classifies what data can go where. A short framework that names who owns exceptions, how staff are trained, and how you evidence this at renewal or when a client asks. 3 Peat builds those for Australian firms, then maps them into the 3 Peat AI Framework Builder so the policy stays current as the stack changes.

What to do this week

  1. Ask IT and practice managers for a list of AI tools staff have used in the last 30 days, including personal accounts.
  2. Ban client data in consumer ChatGPT, Gemini, and Copilot until those tools sit on a firm agreement that does not train on your prompts.
  3. Write a one-page approved-tools list and circulate it. Silence is how Shadow AI spreads.
  4. If you want the register and policy drafted against Australian solicitor duties, start with the 3 Peat AI Framework Builder or book a readiness audit.