Public AI on a Client File

Staff will use AI. The useful question is which work may use a public tool, and which work must stay under the firm’s control. This briefing is a practical map for that line, as at August 2026. It is not legal advice. The named circulars and cases are listed at the end.

1What is actually happening

Many firms have given people a chatbot and pointed it at house forms and precedents. The pitch is that the model has been “trained” on the practice, so filling a form or a first draft is just administration.

What happens is simpler. The knowledge base retrieves text from the firm’s files. That text is then sent as context to a public model. Paid ChatGPT, Custom GPTs, Copilot and most “AI for SMEs” products do not change that. The confidential work leaves the firm at the moment the model reads it.

A research question can sometimes be written without names. A stamp-duty form, a court filing, a KYC pack or a letter that still has to be usable cannot. That is the work that needs a private path.

2A working rule for the firm

Draw three buckets and put every AI use into one of them. Then tell people which tools belong in which bucket.

1. Public AI. General learning and non-confidential questions. No client names, identifiers, financial facts or file text.
2. Approved everyday tools. Firm-approved public AI for work that is not a confidential client file, such as client enquiries and ordinary office tasks, inside clear rules. IQ Assist is IntelekIQ’s offer in this bucket. It is not a place for privileged files.
3. Private AI. Confidential client work: research, document review and drafting on the file itself. This needs inference the office controls, a wall between clients, and a record of who asked. Secure Law is that path when the work must stay inside the firm.

A ban on public AI is not a policy. People still need a way to get the work done. The rule above is the policy: public tools stay useful, and confidential files stay under the firm’s control.

3What this already asks of lawyers

Professional bodies in Malaysia and Singapore are not banning AI. They are asking for the same line the rule above draws.

The Malaysian Bar’s circulars (2023 and 2025) tell members to verify output independently, to have an internal generative-AI policy, and not to put personal data or client-specific facts into generative AI tools, including paid subscriptions. Prefer tools designed for professional use. Even then, treat the privacy controls as limited.

Singapore’s Law Society advisory (April 2026) and the Ministry of Law guide (March 2026) say the same in operational terms. Do not type privileged, confidential or personal data into a public tool. Marker-pen “blackout” is not enough, because the underlying text can still be machine-read. For confidential client or business data, prefer tools with stronger controls, or an in-house system. Consider telling the client, particularly where data-handling may not match the client’s own requirements.

The Singapore Courts have been clear since October 2024. Court users own the output. Information given to a generative AI chatbot may be disclosed. Verify citations against LawNet and Singapore Statutes Online. The court can ask how you checked. In Tajudin [2025] SGHCR 33 the court ordered personal costs after counsel cited a fictitious authority. In Tan Hai Peng Micheal [2026] SGHC 49 the High Court treated the duty to verify as non-delegable. Supervising another person’s use of the tool is not a defence.

In practice: do not put this client’s file into a public tool. Check anything that will be filed. Keep a record of how you checked.

4Data protection is a separate checklist

A prompt that contains a client’s name, NRIC, address or financial facts is personal data. Sending it to a US model is a cross-border transfer under Malaysia’s PDPA. The 2024 Amendment Act raised the penalty for breaching the data-protection principles, and made data processors directly liable for the Security Principle. Breach notification is now part of the regime.

A consumer ChatGPT account does not give the firm the paperwork that regime expects: no transfer assessment the firm controls, no processor contract the partnership can produce, no record of where inference happened. If the work is personal data, it does not belong in that account.

5A UK preview, not local law

In August 2026 the Solicitors Regulation Authority warned about hallucinations in court documents and confidential client information in public AI tools. A UK tribunal has said that putting client letters into ChatGPT places that information in the public domain, and can waive privilege. That is UK law. Malaysian and Singapore courts have not decided the waiver point. Deleting the chat does not undo a disclosure. Treat it as a reason to keep client letters out of public tools, not as a local judgment.

6What to put in place

A first policy does not need to be long. It needs to be usable.

1. Write the three buckets down. Tell staff which tools sit in each one, and who to ask when the work is unclear.
2. Do not point a public chatbot at house files, forms or a shared “firm GPT” over every client. That is how Client A’s position appears in Client B’s draft.
3. Require a person to check anything that will reach a client or a court. The lawyer remains responsible for what is filed.
4. Keep a short record for higher-risk use: what tool, what work, who checked. A client, a DPO or an insurer who asks where a file was read needs an answer the firm can show.
5. Give confidential client work a private path: inference on premises, under the firm’s control.

The accounting counterpart is There Is No Privilege to Fall Back On.