AI Governance · Australian Law Firms

Shadow AI in Australian law firms

Shadow AI in a law firm is fee earners putting client matter data into ChatGPT, Copilot, or a consumer AI tool the firm has not approved. That is a confidentiality problem under the Australian Solicitors' Conduct Rules, a Privacy Act exposure, and a question your PI insurer will ask at renewal. 3 Peat builds the register, the approved-tools policy, and the framework managing partners need to show adequate systems.

What counts as Shadow AI in an Australian law firm

It is not Harvey, CoCounsel, or another vendor under a firm contract. It is a solicitor pasting a client email into a personal ChatGPT account, a paralegal dropping a brief into a free summariser, or Copilot on a home laptop with no data processing agreement. The tool is usually free. The client data is not. Once matter facts leave the firm's environment, confidentiality, privilege, and APP 11 security obligations are in play even if nobody meant harm.

What Australian guidance already applies

There is no standalone AI Act for law firms yet. Existing duties already cover the risk. The Supreme Court of Victoria published Guidelines for the Responsible Use of Artificial Intelligence in Litigation in May 2024. In December 2024 the NSW Law Society, the Legal Practice Board of Western Australia, and the Victorian Legal Services Board and Commissioner said lawyers cannot safely put confidential, sensitive, or privileged information into public AI chatbots, and that practices need a risk-based policy. Privacy Act APPs and Legal Profession Uniform Law confidentiality sit under that. A missing policy is itself a signal to a regulator, a client, or a PI underwriter.

What managing partners need to be able to show

Three artefacts, not a 40-page strategy deck. An AI register of tools actually in use. An approved-tools policy that classifies what data can go where. A short framework that names who owns exceptions, how staff are trained, and how you evidence this at renewal or when a client asks. 3 Peat builds those for Australian firms, then maps them into the 3 Peat AI Framework Builder so the policy stays current as the stack changes.

What to do this week

  1. Ask IT and practice managers for a list of AI tools staff have used in the last 30 days, including personal accounts.
  2. Ban client data in consumer ChatGPT, Gemini, and Copilot until those tools sit on a firm agreement that does not train on your prompts.
  3. Write a one-page approved-tools list and circulate it. Silence is how Shadow AI spreads.
  4. If you want the register and policy drafted against Australian solicitor duties, start with the 3 Peat AI Framework Builder or book a readiness audit.

Shadow AI FAQ for Australian law firms

What is Shadow AI in a law firm?

Shadow AI in a law firm is fee earners putting client matter data into ChatGPT, Copilot, or a consumer AI tool the firm has not approved. That is a confidentiality problem under the Australian Solicitors' Conduct Rules, a Privacy Act exposure, and a question your PI insurer will ask at renewal.

Why is unapproved ChatGPT use a problem for Australian solicitors?

Pasting client instructions or matter data into a consumer AI tool transmits confidential information to a third party with no data processing agreement. That can waive legal professional privilege, breach Privacy Act APP 11, and conflict with Legal Profession Uniform Law confidentiality duties and retainer undertakings.

What Australian guidance already applies to AI in legal practice?

The Supreme Court of Victoria issued Guidelines for the Responsible Use of AI in Litigation in May 2024. The NSW Law Society and the Legal Practice Board of WA issued a joint statement in December 2024 that lawyers cannot safely enter confidential information into public AI chatbots and that firms must implement risk-based policies.

What do managing partners need to show for AI governance?

Managing partners need an AI register of tools in use, an approved-tools policy with data classification, and a documented framework they can show clients, courts, and PI insurers as evidence of adequate systems. 3 Peat builds those artefacts for Australian law firms.

Frequently asked questions

What is Shadow AI in a law firm?
Shadow AI in a law firm is fee earners putting client matter data into ChatGPT, Copilot, or a consumer AI tool the firm has not approved. That is a confidentiality problem under the Australian Solicitors’ Conduct Rules, a Privacy Act exposure, and a question your PI insurer will ask at renewal.
Why is unapproved ChatGPT use a problem for Australian solicitors?
Pasting client instructions or matter data into a consumer AI tool transmits confidential information to a third party with no data processing agreement. That can waive legal professional privilege, breach Privacy Act APP 11, and conflict with Legal Profession Uniform Law confidentiality duties and retainer undertakings.
What Australian guidance already applies to AI in legal practice?
The Supreme Court of Victoria issued Guidelines for the Responsible Use of AI in Litigation in May 2024. The NSW Law Society and the Legal Practice Board of WA issued a joint statement in December 2024 that lawyers cannot safely enter confidential information into public AI chatbots and that firms must implement risk-based policies.
What do managing partners need to show for AI governance?
Managing partners need an AI register of tools in use, an approved-tools policy with data classification, and a documented framework they can show clients, courts, and PI insurers as evidence of adequate systems. 3 Peat builds those artefacts for Australian law firms.