Is Customer Data Safe with AI Tools? A Guide for Law Firms

The Shadow AI Problem: Why Your Firm's Data Is Already at Risk

Here's a uncomfortable truth about AI adoption in law firms: the lawyers most likely to paste confidential client data into a free AI chatbot are often the ones your firm hasn't vetted, trained, or even asked. According to the ABA's 2025 Legal Industry Report, personal generative AI use at work rose to 31% in 2024, while firm-level generative AI use actually declined to 21%. That inversion is the shadow AI problem in a single statistic — lawyers are experimenting with free tools outside firm oversight, and there's no way to know how much privileged material has already flowed into them.

Why does this matter so much more with AI than with traditional software? Because of the training-data problem. AI systems learn from uploaded data, so confidential client documents fed into a tool without proper safeguards could potentially influence outputs shown to other users. Worse, most current AI architectures cannot "unlearn" accidentally included data — once a leak happens, prevention is the only real remedy. There's no recall button.

The risk environment compounds the concern. Law firm data breach attempts increased by 68% in 2024, according to industry research on legal AI security, and 68% of data breaches involve human error while using AI. For a profession built on confidentiality, those numbers should drive every AI governance decision.

Attorney hesitancy reflects this accurately. In the same research, 74.7% of attorneys cite accuracy as their primary concern — a worry fueled by widely publicized AI hallucinations in legal documents, including fabricated citations. Another 47.2% worry about data privacy and security. These concerns aren't paranoia; they're the correct instincts of professionals who understand that a free chatbot's privacy policy may permit collecting inputs and disclosing them to third parties.

The core shadow AI risks firms face include:

• Unvetted free tools receiving client confidences with no security review
• Potential vendor training on uploaded data, with no ability to unlearn leaks
• Loss of privilege when confidential material is shared with public chatbots
• Human error in AI use, which features in 68% of data breaches

The governance gap can be closed, but only deliberately. Firms that invest in AI prioritize trust — integration with trusted software (43%) and trust in legal-specific tool output (29%) top the list of investment drivers. And the same principle applies beyond the core AI platform: any agent skills or extensions a firm connects to its AI tools carry their own security risks, which is why SkillzBench is building free security scanning, version pinning, and trust scores for agent skills — so firms can verify what their agents see before data ever flows through them. Shadow AI thrives on ambiguity; verification is the antidote.

What Courts and Bar Authorities Now Require: Privilege, Ethics, and the New Rules of AI

Paste a client's confession into a public chatbot, and you may have just waived privilege — that is no longer hypothetical. In February 2026, two federal courts drew the first hard lines between casual AI use and protected legal work product.

In United States v. Heppner (S.D.N.Y., Feb. 17, 2026), a defendant tried to shield 31 AI-generated documents as privileged, and the court ordered them produced. The reasoning was blunt: there is no "trusting human relationship" with a chatbot, and the platform's privacy policy permits collection and third-party disclosure of inputs and outputs. Sharing those outputs with counsel later does not retroactively create privilege.

The BakerHostetler analysis of the ruling highlights a crucial nuance: the Heppner court suggested that had counsel directed the AI use, the chatbot "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent." Days earlier, Warner v. Gilbarco (E.D. Mich., Feb. 10, 2026) upheld work-product protection for documents prepared with a public chatbot — because work product is waived only by disclosure to an adversary. The practical takeaway: counsel-directed use on enterprise platforms with no-retention terms preserves protections that public chatbot use destroys.

The ethics framework is equally explicit. ABA Formal Opinion 512 (July 2024) imposes four core duties on lawyers using generative AI:

• Competence — understanding how the tool works and its limits (Rule 1.1)
• Confidentiality — securing client data against unauthorized disclosure (Rule 1.6)
• Informed consent — disclosing AI use where client confidences are involved
• Supervision — policies and training covering all staff, since personal AI use (31% of lawyers in 2024) now outpaces firm-level adoption (21%)

State bars are stricter still. California's guidance prohibits inputting confidential client information into any generative AI tool lacking adequate security protections. Arizona's advice is simpler: when in doubt, do not enter confidential information at all. Florida's Advisory Opinion 24-1 requires informed consent before third-party AI use that would disclose confidences.

For firms assembling an AI stack — including agent tools and third-party extensions — the lesson is that vetting cannot stop at the platform. If you are evaluating AI agents or skills for firm workflows, SkillzBench is building a free directory that security-scans and benchmarks skills before they touch client data. The rules are now clear: privilege survives only where security is deliberate.

The Vendor Vetting Checklist: How to Evaluate AI Tools Before Client Data Touches Them

Before a single client document gets uploaded to an AI tool, the vendor behind it needs to pass a security bar you set in advance. The stakes are real: courts have ruled that data shared with public AI chatbots can lose privilege protection entirely, and most AI architectures cannot "unlearn" confidential data once it enters a training pipeline.

Start with certifications. Require a SOC 2 Type II report — not Type I — because Type II covers at least six months of demonstrated control effectiveness, while Type I only captures a point in time. Then demand explicit answers on data handling:

• A firm "no" on training with customer data — the only acceptable answer for production systems
• Zero data retention (ZDR), meaning the vendor keeps no record of the interaction once a response is returned
• AES-256 encryption at rest and TLS 1.3 encryption in transit
• Zero Trust architecture and documented access controls

Run the evaluation in phases to keep it efficient. Spend one to two days on initial screening — certifications and security documentation — then three to five days on a detailed review of the full SOC 2 report, penetration test results, and incident response procedures. This structure weeds out weak vendors quickly without over-investing in tools that never make the shortlist.

One warning: ZDR alone is not enough. As Clio's guidance notes, zero data retention removes vendor-side privacy exposure but doesn't protect data in transit, control endpoint risks, or create an audit trail. It must be paired with encryption, access controls, and documentation to fully protect client data. A vendor touting ZDR while staying vague about encryption or audit logs hasn't cleared your bar.

Finally, match the data isolation tier to matter sensitivity. Options range from logical separation of tenant data up through virtual private clouds, physical separation, and air-gapped deployments for the most sensitive work. Routine matters may justify a standard enterprise tier; high-stakes litigation files may demand more.

The same rigor applies to anything you bolt onto these tools. Third-party agent skills and extensions expand what AI tools can do, but they also expand the attack surface — published research found roughly 26% of agent skills carry at least one vulnerability. That's why we're building SkillzBench: a free directory where every agent skill is pinned to a specific version, security-scanned, and benchmarked in a sandbox, with a trust score from security, quality, license, and maintenance signals. If you extend vetted AI tools with agent skills, verify them the same way you'd verify the vendor.

Vet the vendor, verify the extensions, document everything — then, and only then, let client data near the tool.

From Policy to Practice: Building a Firm-Wide AI Safety Program

A written AI policy sitting in a shared drive does nothing if half your attorneys are pasting client documents into free chatbots on their phones. That gap between policy and practice is where law firms lose privilege, breach confidentiality, and invite disciplinary action.

The numbers confirm the problem is real. Personal generative AI use at work rose to 31% in 2024, while firm-level generative AI use actually declined to 21%, according to the ABA's 2025 Legal Industry Report. Employees are experimenting with tools the firm never vetted, outside any oversight. Closing this shadow-AI gap requires four concrete steps.

• Adopt a written firm AI policy covering every staff member. ABA Formal Opinion 512 implicates the supervision duties under Rules 5.1 and 5.3, meaning partners and managers are responsible for subordinate lawyers and nonlawyer staff alike — the policy must reach paralegals, assistants, and vendors, not just attorneys.
• Train employees on the firm's approved tools. Arizona's guidance explicitly recommends written firm AI policies, and training is what converts an approved-tool list from a document into a daily habit. When in any doubt, staff should not enter confidential or non-public information into a generative AI tool.
• Keep a human attorney verifying every AI output. "Human in the loop" validation of every result before it lands in a brief or contract is the emerging best practice, and Illinois recommends personally checking any fact, law, or citation generated by AI.
• Obtain informed client consent — not boilerplate — before client confidences enter any AI tool. Florida's Advisory Opinion 24-1 requires informed consent before third-party AI use that would disclose confidential information, and a buried engagement-letter clause does not satisfy Rule 1.6's informed-consent standard.

The consent point deserves emphasis because the stakes are now visible in court. In United States v. Heppner (S.D.N.Y., Feb. 2026), a federal court ruled that 31 AI-generated documents were not privileged because the defendant shared confidential information with a public chatbot whose privacy policy permits collection and third-party disclosure. The court noted that counsel-directed AI use might have changed the analysis — which is exactly why firm policies should route AI work through vetted, enterprise-grade platforms at counsel's direction.

Vetted platforms need their own scrutiny, too. Firms adopting legal-specific AI prioritize integration with trusted software (43%) and provider workflow understanding (33%), but trust must be earned through security terms, not marketing. Before any approved tool enters your stack — including AI agents and the third-party skills that extend them — verify how it handles data. SkillzBench, AIQ Labs' free directory of agent skills, is building exactly this verification layer: pinning every skill to a specific version, security-scanning it, and publishing trust scores so firms can see which extensions are safe before connecting them to an agent that touches client work.

One final habit: check your state bar's latest guidance before finalizing anything. State opinions date from 2023 onward, some states are still issuing reports, and the 50-state survey of AI ethics rules shows justia-style variation across jurisdictions. Rules are evolving rapidly — a policy written this year may need revision next year. The firms that treat AI governance as a living program, not a one-time memo, are the ones that keep client data safe.

Extending Safety to AI Agents and Skills: Vet What Your Agents Can Do

Vetting your AI vendor is only half the job. Law firms increasingly run coding and chat agents in their workflows, and those agents don't just come with a vendor — they come with third-party skills and extensions that act on your data. Each one is a new trust decision, and most firms never make it consciously.

The scale of the problem is real. Published research has found that roughly 26% of agent skills carry at least one vulnerability. These skills — instruction packages for tools like Claude Code, Codex, Cursor, and Gemini CLI — are shared freely online, rarely audited, and often installed with the same casualness as a browser extension. For a profession where 47.2% of attorneys already worry about data privacy and security, that's an uncomfortable gap.

The same principles that govern vendor selection apply here: know what has access to client data, and apply the minimum security bar before anything touches your systems. When evaluating agent skills, ask:

• Is the version pinned, so you know exactly what code you're running?
• Has it been security-scanned and license-checked?
• Has it actually been tested to prove it works — and works better than not using it at all?
• Can you control precisely which skills each agent can see and use?

That last point matters most. Just as court rulings in 2026 made clear that counsel-directed AI use on controlled platforms preserves privilege while ad hoc public chatbot use destroys it, agent safety comes down to deliberate, supervised configuration — not default settings.

This is the gap SkillzBench is being built to close. It's a free, independent directory of AI agent skills where every listing is version-pinned to a commit SHA, security-scanned, license-checked, and benchmarked in a sandbox — tested with and without the skill, using the same model, so you can see the measured performance lift published separately from any rating. A free MCP connector then lets you equip each agent with only the skills you've explicitly approved, so an agent sees nothing you haven't chosen for it.

For law firms, the fit with existing ethics duties is direct. ABA Formal Opinion 512 requires lawyers to understand how their AI tools process data and to put safeguards in place against unauthorized disclosure — and that duty extends to whatever third-party components your agents load. Treat skill vetting the way you treat vendor vetting: deliberate, documented, and done before any client matter is involved.

SkillzBench is currently in development, with its waitlist open for firms and professionals who want to adopt agent skills without adopting unknown risk.