AI adoption your partners can defend

The Law Society of Ontario has not adopted AI-specific rules. Its April 2024 white paper and companion practice resources explain how existing duties apply to generative AI: technological competence under rule 3.1-2, confidentiality under rule 3.3-1, supervision under rule 6.1-1, candour with clients, fair billing, and not misleading a tribunal. The guidance tells licensees not to put confidential or privileged client information into a generative AI tool unless adequate safeguards are in place.

Yes: the Barreau du Québec encourages supervised use of generative AI, but professional secrecy leaves no room for approximation. Its practical guide states that simply entering information protected by professional secrecy into an open system, such as a public AI tool, is a breach, even without any actual reproduction or disclosure. In practice, that means anonymizing, keeping data to the strict minimum, not using the tool when anonymizing is impossible, and supervising how the whole team uses it.

The Law Society of British Columbia has not created AI-specific rules. Its practice resource, Guidance on Professional Responsibility and Generative AI, applies existing BC Code duties: competence (rule 3.1-2), confidentiality (rule 3.3-1), candour, supervision (rule 6.1-1), fair fees, and the records security obligations in Law Society Rules 10-3 and 10-4. Its core advice on confidentiality is to leave client confidential and identifying information out of generative AI tools, and to consider informed client consent where redaction is not possible.

Treat it as a possible confidentiality breach, not a training issue. In the first 48 hours, preserve the facts, find out exactly what was submitted and under which account, assess whether privacy law requires a report (PIPEDA or Quebec's private sector act), decide how the client will be told, and give your professional liability insurer prompt notice. Confirm each step with your law society's practice advisors and your insurer.

This is normal, and a sanctioned tool alone will not end it. People keep using the AI they already know because it is fast, familiar, on their phone, and sometimes better at a given task than the approved tool. Close the gap by finding out which tasks drive people elsewhere, setting a clear rule on personal accounts, and adding a control at the prompt that catches client data before it reaches any tool the firm has not approved.

Spend days 1 to 30 finding out how AI is actually used across the firm, days 31 to 60 deciding on a policy, approved tools, and rules for client data, and days 61 to 90 putting controls and training in place and collecting evidence that they work. Anchor each step in the guidance your law society has already published, and in what clients and insurers are starting to ask.

Only into a tool the firm has vetted, and only if the NDA, the client and the law allow it. Evaluation material is usually shared under an NDA that limits who may receive it and what it may be used for, personal information in the data room is often shared under a privacy law exception tied to the transaction, and a public company deal may involve undisclosed material facts. Pasting that material into a personal AI account can fall outside all three.

Yes, but only with tools and settings the firm has approved, and never with the client's unreleased product details, the unfiled invention, or the draft conclusions pasted into a personal AI account. These inputs are confidential, often privileged, and may later be examined in litigation, so the firm needs to control what reaches any AI tool before it is submitted.

Not in a personal or unapproved AI account, and not together with launch plans. Until the application is filed, a new mark and the strategy around it are confidential client information, and in Canada entitlement turns on who filed or used first, so a firm should keep that combination out of AI tools it does not control.