'/%3e%3crect%20width='440'%20height='260'%20fill='url(%23gl3)'/%3e%3cpath%20d='M220%2062%20L280%2082%20L280%20132%20Q280%20176%20220%20198%20Q160%20176%20160%20132%20L160%2082%20Z'%20fill='none'%20stroke='%237e92cf'%20stroke-width='2'%20opacity='0.4'/%3e%3crect%20x='202'%20y='122'%20width='36'%20height='30'%20rx='5'%20fill='none'%20stroke='%239fb2e8'%20stroke-width='2'%20opacity='0.5'/%3e%3cpath%20d='M208%20122%20v-7%20a12%2012%200%200%201%2024%200%20v7'%20fill='none'%20stroke='%239fb2e8'%20stroke-width='2'%20opacity='0.5'/%3e%3ccircle%20cx='220'%20cy='137'%20r='6'%20fill='none'%20stroke='%235fe0d6'%20stroke-width='1.6'%3e%3canimate%20attributeName='r'%20values='6;32'%20dur='3.8s'%20repeatCount='indefinite'/%3e%3canimate%20attributeName='opacity'%20values='0.5;0'%20dur='3.8s'%20repeatCount='indefinite'/%3e%3c/circle%3e%3ccircle%20cx='220'%20cy='137'%20r='3'%20fill='%235fe0d6'%20opacity='0.6'/%3e%3c/svg%3e)
Deal data is confidential and often covered by professional secrecy. Before it goes into an AI tool, a law firm needs clear answers on five points: where the data is stored and processed, how long it is kept, whether it is used for training, who can access it, and what the contract says.
Why are public AI tools not enough?
Consumer AI tools and default API terms are not designed for confidential client data. Depending on the provider and plan, terms can allow:
- Processing in any region
- Retention of prompts and outputs for a period
- Access by provider staff, for example for abuse monitoring
- Use of data to improve models
None of this fits a data room.
Where is the data stored and processed?
Ask for both. Storage location and processing location can differ. Ask which cloud regions are used, and whether any step, including the AI model itself, runs outside them.
Is data retained after processing?
Many AI services keep some data by default for a limited period. Ask what is retained, for how long and who can see it. If the vendor cannot answer precisely, assume the default applies.
Is my data used to train models?
The answer should be a clear no, in the contract, for both the vendor and its AI providers.
How is professional secrecy protected?
Lawyers are bound by professional secrecy. Many jurisdictions also have rules on how lawyers may involve IT service providers. Check that:
- The vendor is contractually bound to confidentiality
- Its own subcontractors are bound in the same way
- Access is limited to what is needed to run the service
- The rules of your bar and jurisdiction are met
Have your own counsel or general counsel confirm this for your jurisdiction.
Which contracts and certifications should I ask for?
- Data processing agreement (DPA) under the GDPR or the applicable local data protection law
- List of subprocessors, including AI model providers, with their locations
- Information security certification, for example ISO/IEC 27001
- Access control and encryption details
- Deletion of data at the end of the mandate
FAQ
Is GDPR compliance enough?
It is the baseline in the EU. Professional secrecy and bar rules add further requirements on top.
Does it matter which AI model a tool uses?
Less than where and under which terms it runs. Ask about the setup, not just the model.
What is a red flag in vendor answers?
Vague or missing answers on location, retention or training.
- ✓ Ask where data is stored and where it is processed.
- ✓ Get no-training and retention terms in writing.
- ✓ Check confidentiality down the subcontractor chain.
- ✓ Ask for a DPA, a subprocessor list and a security certification.
Fusewise is an AI legal due diligence platform for M&A deal teams, based in Zurich. Fusewise is ISO/IEC 27001 certified and does not train models on client data.