AI and Professional Obligations

A law firm adopts technology to support its work while meeting duties to clients, courts and regulators. This paper maps the controls described in the Secure AI for Legal Practice series to professional and data-protection obligations in Malaysia and Singapore. Technical controls can support compliance. They do not transfer accountability away from the firm or the lawyer.

1Confidentiality and privilege

Secure Law processes confidential client files on premises by default. The files are not sent to a public or third-party AI model for ordinary research, document review and drafting. This reduces external disclosure at the point of AI processing and supports the firm's duties of confidentiality and privilege.

These are the confidentiality and fidelity duties that bind every advocate and solicitor under Malaysia's Legal Profession Act 1976 and Singapore's Legal Profession Act.

Many firms already store files in Microsoft 365 or another cloud service. Storage in a managed cloud environment is not the same as sending confidential content to an external AI model for processing. Secure Law does not change the firm's existing storage arrangements. It provides an on-premises path for AI processing, under the firm's control. Frontier Mode is optional and uses reversible pseudonymisation, lawyer approval and restoration of identifiers inside the firm.

2Conflicts of interest

Firm-managed permissions should restrict retrieval to information the user is authorised to access. In professional-conduct terms, this supports information barriers and conflicts controls. A lawyer working on one client file should not gain access to confidential material from another merely because both are available to the AI system.

Two limits are important.

First, Secure Law supports the firm's conflict processes but does not replace them. Clearing a new client file remains a professional judgement at intake. Second, access controls are only as accurate as the permissions behind them. The access reviews described in roles, sign-off and separation of duties are therefore part of compliance.

3Data protection

Data-protection law asks the firm to understand what personal data it processes, why it processes it, who can access it and where it goes. Both target markets have strengthened their regimes.

Malaysia's Personal Data Protection Act, as amended in 2024, now requires a Data Protection Officer and mandatory breach notification, in force in 2025, and applies a risk-based cross-border-transfer regime. Singapore's PDPA carries an equivalent DPO requirement, breach-notification duty and transfer-limitation obligation.

Secure Law's on-premises model gives the firm direct control over AI processing of confidential client files. The firm must still define the purpose, lawful basis, access rules, retention period and permitted sources for that processing. Those decisions should be documented and reviewed by the DPO.

Higher-risk information may require stricter handling or exclusion from a general AI workflow. The DPO should review the firm's ingestion policy, access arrangements, external processing and any exceptional use.

4Erasure, designed in rather than bolted on

Data-subject rights can be difficult to apply to AI systems because source text may produce derived data, including chunks, embeddings and cached context. A deletion process must account for each relevant copy.

The firm should map source files, derived AI data, cached material and backups. Its retention and deletion procedures should cover each location and record any legal reason to retain information. Secure Law forms part of that process, but the firm must test that its wider data estate can carry out an authorised request.

5The regulatory landscape in Malaysia and Singapore

The underlying duties are similar, but the rules that express them differ by market and continue to develop. For law firms in Malaysia and Singapore, the principal reference points are set out below.

Two points follow from these reference materials.

First, neither Malaysia nor Singapore mandates on-premises hosting. A firm's deployment choice should follow its confidentiality judgement, client requirements and risk assessment. Singapore's Ministry of Law guidance points firms towards tools with stronger confidentiality assurances for client data. It also requires lawyers to verify AI output and remain accountable. The Supreme Court's practice on generative AI in filings reinforces that responsibility.

Second, the NIST AI Risk Management Framework and ISO/IEC 42001 provide useful structures for ongoing AI governance. They encourage firms to identify which systems are in use, assign responsibility, monitor risk and retain evidence that controls operate as intended.

6Accountability stays with the firm

Secure Law provides private AI for research, document review and drafting. It does not discharge the firm's duties to appoint a DPO where required, notify relevant breaches, honour data-subject rights or maintain conflicts procedures. Its output can be inaccurate. Lawyers must verify sources, apply professional judgement and remain responsible for advice, client communications and court filings.

With the duties mapped, one practical question remains: how a firm actually adopts all of this without disruption, from pilot to production. That is the final paper in the series (A10).