Follow the Data

A firm cannot govern AI without knowing where confidential client information goes. That answer shapes which tools the firm permits, which controls it needs and what it can tell clients. This paper maps where data lives, where it moves and where an AI model reads it.

The first paper in this series explained why AI needs governance. The next step is a shared picture of the firm's data flows, including the point at which an AI model processes confidential client work.

1Where your data already lives

Before adding AI, the firm should map its existing systems. A small or mid-size firm rarely uses one system. Client files may sit on an office network drive and in a cloud document-management system. Email and files may live in Microsoft 365. The practice-management system may run on a local server or in a vendor's cloud.

Some information is on the firm's premises. Other information sits in a vendor's cloud under the firm's tenant and account. These are both common parts of a modern legal technology estate.

Storing files in Microsoft 365 or another cloud service is not the same as sending their contents to a third-party AI model. The precise question is: when the firm adds AI, where does confidential client information travel that it did not travel before?

2The moment that matters: inference

An AI model does its work, known as inference, wherever the model runs. To answer a question, a grounded system assembles a prompt and retrieves relevant passages from authorised firm documents. It then sends the question and retrieved text to the model. The location of that model determines where the information is processed.

There are three broad destinations. Each places the information under a different set of controls.

Storage still matters. AI adds another question at inference, when client-file content is transmitted to a model for processing. A tool can leave the original file in place while sending relevant passages elsewhere each time a lawyer asks a question.

3Two boundaries people confuse

Two boundaries are often confused. Separating them makes the data flow easier to assess.

The first is the tenant boundary. A file stored in the firm's Microsoft 365 or document-management account is governed by the firm's contract and tenant controls. The second is the third-party-model boundary. This is the point at which confidential client text is sent to a model the firm does not operate. A file can remain in the firm's tenant while its contents are processed by an external model.

For that reason, saying that documents remain in the firm's SharePoint does not answer the inference question. The firm must also establish whether document contents are transmitted to an external model. Retrieval-augmented systems place relevant passages into the prompt as context, so this data flow should be explicit.

4Air-gap versus the AI-inference wall

The term "air-gapped" is often used too loosely. A true air gap means that a system has no network connection to the outside world. A firm that uses Microsoft 365 for email or documents is connected to cloud services, so it should not describe its whole environment as air-gapped.

A narrower control is an AI-inference wall. It means that confidential client information is not sent to a third-party model for inference. Files may still live in the firm's cloud tenant, and email may still flow through Microsoft 365.

With Secure Law, AI processing of confidential client files takes place on premises, under the firm's control. The files do not need to be sent to a public or third-party AI model.

5What "zero-retention" does and does not buy you

Enterprise AI vendors often provide two important assurances: they do not retain customer data, and they do not use it to train their models. These controls can make an enterprise service materially safer than a free public AI tool.

But it is worth seeing exactly what they change, and what they do not.

These terms do not change the destination. Under a zero-retention arrangement, confidential client information is still transmitted to a model the firm does not operate. The contract and the vendor's controls govern retention and reuse after the information arrives. The firm should assess the terms, their implementation and the evidence available.

Enterprise cloud AI can be appropriate for a great deal of a firm's work. The purpose of this distinction is to help the firm decide which information it will protect through contracts and vendor controls, and which work should remain in an on-premises private AI environment.

6Not all data carries the same stakes

The decision becomes manageable when the firm stops treating all information as one category. A published statute and confidential correspondence from a live matter carry different risks. They should not pass through the same controls by default.

A simple traffic-light lens, developed fully in the next paper, is enough to begin:

Mapping the estate against these classes replaces a broad question with specific ones: what may each tool do with Amber information, and where does it send that information for processing?

7You cannot govern what you cannot see

Before choosing an AI tool, comparing architectures or writing a policy, draw the firm's data-flow map.

List where confidential client files live. For every current or proposed AI use, mark the point at which their contents would be sent to a model the firm does not operate. Record the control chosen for each path. This gives partners, the DPO and IT a shared factual basis for decisions.

With that map in hand, the firm is ready for the two decisions the next papers address. How to classify its information so the right rule attaches to the right data (A3). And how to choose a deployment architecture that keeps the most sensitive inference under the firm's own control (A4).

---