# What is Shadow AI in a law firm?

Shadow AI in a law firm is fee earners putting client matter data into ChatGPT, Copilot, or a consumer AI tool the firm has not approved. That is a confidentiality problem under the Australian Solicitors' Conduct Rules, a Privacy Act exposure, and a question your PI insurer will ask at renewal. 3peat builds the register, the approved-tools policy, and the framework managing partners need to show adequate systems.

HTML page: https://3peat.ai/ai-governance/shadow-ai-law-firms

## Why it matters in Australia

- Confidentiality under the Australian Solicitors' Conduct Rules applies to client information regardless of the tool used to process it.
- The Privacy Act 1988 covers personal information that leaves the firm into a consumer AI vendor.
- PI insurers ask whether the firm had adequate systems when a claim follows an unsanctioned tool.

## What Australian guidance already applies

- The Supreme Court of Victoria published Guidelines for the Responsible Use of Artificial Intelligence in Litigation in May 2024.
- In December 2024 the NSW Law Society, the Legal Practice Board of Western Australia, and the Victorian Legal Services Board and Commissioner said lawyers cannot safely put confidential, sensitive, or privileged information into public AI chatbots, and that practices need a risk-based policy.

## What managing partners need

1. An AI register of tools actually in use (including the ones IT has not approved).
2. An approved-tools list and a written prohibition on consumer ChatGPT/Copilot for client matter data.
3. A governance framework they can show a regulator or insurer.

## What to do this week

1. Ask IT and practice managers for a list of AI tools staff have used in the last 30 days, including personal accounts.
2. Ban client data in consumer ChatGPT, Gemini, and Copilot until those tools sit on a firm agreement that does not train on your prompts.
3. Write a one-page approved-tools list and circulate it. Silence is how Shadow AI spreads.
4. If you want the register and policy drafted against Australian solicitor duties, start with the 3 Peat AI Framework Builder (https://aiframework.3peat.ai) or book a readiness audit.

## Common questions

### What is Shadow AI in a law firm?

Shadow AI in a law firm is fee earners putting client matter data into ChatGPT, Copilot, or a consumer AI tool the firm has not approved. That is a confidentiality problem under the Australian Solicitors' Conduct Rules, a Privacy Act exposure, and a question your PI insurer will ask at renewal.

### Why is unapproved ChatGPT use a problem for Australian solicitors?

Pasting client instructions or matter data into a consumer AI tool transmits confidential information to a third party with no data processing agreement. That can waive legal professional privilege, breach Privacy Act APP 11, and conflict with Legal Profession Uniform Law confidentiality duties and retainer undertakings.

### What Australian guidance already applies to AI in legal practice?

The Supreme Court of Victoria issued Guidelines for the Responsible Use of AI in Litigation in May 2024. The NSW Law Society and the Legal Practice Board of WA issued a joint statement in December 2024 that lawyers cannot safely enter confidential information into public AI chatbots and that firms must implement risk-based policies.

### What do managing partners need to show for AI governance?

Managing partners need an AI register of tools in use, an approved-tools policy with data classification, and a documented framework they can show clients, courts, and PI insurers as evidence of adequate systems. 3 Peat builds those artefacts for Australian law firms.

Start the self-serve builder: https://aiframework.3peat.ai

## Related

- [What is AI governance?](https://3peat.ai/ai-governance.md)
- [3peat.ai](https://3peat.ai)