The firm's software provider
Can our case management software train AI on our client files?
Updated
The provider holds the files on the firm's instructions; whether it may learn from them is a question for its contract and its own published promises.
Short answer for the practice manager
Not unless the firm has agreed to it. A provider that holds client files for the firm processes the personal data in them only on the firm's documented instructions, and the two providers whose AI pages we read both say client data is not used to train AI. The gap to check is the clause some contracts keep for pooled, de-identified use.
The firm instructs, the provider follows
Article 28 of the UK GDPR makes the software provider a processor for the client personal data it holds: it acts only on the firm's documented instructions, and the firm may use only a processor that gives sufficient guarantees about how the data is protected. Training a model is a use the firm would have to have instructed.
What Clio and LEAP publish
Clio's help page on its AI features says a customer's data is never used to train external AI models.
Source: Clio help, AI features in Clio Manage
LEAP says client matter data is not used to train third-party AI foundation models, and adds that some AI features, Matter AI among them, may send limited client data to the US for processing by AI service providers.
Source: LEAP, security
Where a contract keeps pooled use
2 of the 6 contracts on our board keep a right to use customer data in de-identified, aggregated or anonymised form, for improving the service or for reports on usage. Neither clause mentions AI training, and neither rules it out, so the firm should ask what that pooled use covers today.
Source: Law firm software data terms
Questions to put to the provider
- Does any model, yours or a supplier's, learn from our matters, documents or notes?
- Which AI features send client data outside the UK, and to whom?
- What does your right to de-identified or aggregated use cover, in writing?
- Can the firm switch those features off, and is that recorded on our account?
If the firm is thinking of licensing its own records, describe what it holds on the enquiry form.