Is Your Law Firm Putting Client Data at Risk by Using AI?

Australia's Privacy Commissioner has warned law firms about the risks of entering sensitive client information into AI tools, as new privacy disclosure requirements approach.

Speaking to the Queensland Law Society, Privacy Commissioner Carly Kind urged legal practices to reconsider how they collect, store and share personal information, particularly as artificial intelligence becomes increasingly embedded in legal work. One of her key concerns is the use of free, web-based AI platforms. Information entered into these tools, including prompts, may be disclosed to the technology provider, creating potential privacy risks when handling confidential client matters.

The warning comes ahead of 10 December 2026, when new transparency requirements under Australia's Privacy Act take effect.

Organisations covered by the Australian Privacy Principles will need to disclose certain uses of automated decision-making in their privacy policies where personal information is used in decisions that significantly affect individuals.

The requirements do not apply to every use of AI.

Kind also highlighted the growing risks associated with storing identity documents, particularly as law firms navigate expanded anti-money laundering obligations. Her advice emphasised practical safeguards, including minimising unnecessary data collection, restricting access to sensitive information and ensuring appropriate security protections.

For law firms adopting AI, the message is clear: technological efficiency cannot come at the expense of client privacy.

As AI becomes a routine part of legal practice, are firms doing enough to protect the information clients trust them with?