Industries · Legal
Protect privilege and client confidence as your firm adopts AI.
See which AI tools hold client matters, whether vendors retain or train on them, and where AI can communicate on the firm's behalf.
The landscape
How AI is changing risk in law firms
Lawyers are using generative AI for research, drafting, document review, and summarization. Professional-responsibility guidance — including the ABA's Formal Opinion 512 on generative AI tools (2024) — emphasizes that existing duties of competence, confidentiality, client communication, supervision, and reasonable fees apply. In practice, that means understanding what a tool does with client information, supervising its output, and in some cases informing or obtaining consent from clients. State bars have issued their own guidance, which varies.
What to do first
Approve tools by matter sensitivity
Define which AI tools may be used with which categories of client information, and prohibit personal accounts for client work.
Supervise AI output
Treat AI output like the work of a non-lawyer assistant: it must be reviewed by a responsible attorney before use.
Check engagement terms
Some clients restrict AI use in outside-counsel guidelines. Track those restrictions alongside your AI inventory.
Free readiness check
AI readiness check for law firms
A short, industry-specific check. You get the gaps your answers reveal, why each matters, and what to do next — not a score. Runs in your browser; no signup.
Seven questions about AI, client confidentiality, and supervision in your firm or legal department. Answer for how things work today. Your answers stay in your browser; FlashTower records only anonymous usage events.
Readiness summary
0 of 7 answered
Your summary lists each gap your answers reveal, why it matters in legal, what to do next, and the public frameworks it maps to. It is not a score.
Based only on your answers, using fixed rules. Frameworks are listed for orientation; this summary does not determine whether you meet any law or standard and is not legal advice.
FlashTower findings are informational. No security system detects or prevents every threat, and FlashTower does not certify compliance or provide legal advice.
Common exposures
Where AI risk concentrates
Client information in consumer AI
Attorneys and staff use personal AI accounts for client work, where the firm has no contractual protections, retention control, or visibility.
Vendor retention and training
Some AI services retain prompts and uploaded documents, or use them to improve models, unless contract terms or settings say otherwise.
Unreviewed outbound communication
AI that drafts and sends email to clients or opposing counsel without review can disclose confidential information or make statements the firm did not approve.
Deletion and legal holds
AI agents that can delete or modify documents may conflict with records-retention obligations and litigation holds.
FlashTower rules
Rules most relevant to law firms
These are real rules from the FlashTower Risk Engine. Each fires only when your answers meet its stated condition.
FT-DAT-011 · Sensitive Data
Highly sensitive data in a consumer AI account
A free or personal consumer AI plan is used with health data, payment card data, privileged legal material, or credentials.
Mapped to: OWASP LLM Top 10 LLM02 · NIST CSF 2.0 PR.DS-01 · ISO 27001 A.8.12 · SOC 2 TSC C1.1
CriticalFT-COM-001 · External Communications
AI sends or publishes externally without review
The AI system can send email/messages or publish content without per-action human approval.
Mapped to: OWASP LLM Top 10 LLM06 · NIST AI RMF GOVERN 1.4 · ISO 27001 A.5.14
HighFT-GOV-010 · Governance
Unapproved AI tool handles sensitive data
The AI system is not approved (employee-adopted) and accesses sensitive data.
Mapped to: NIST AI RMF GOVERN 1.6 · NIST CSF 2.0 ID.AM-02 · ISO 27001 A.5.10
HighFT-POL-001 · Policies
No AI acceptable-use policy
The organization has no written AI use policy, or cannot confirm one exists.
Mapped to: NIST AI RMF GOVERN 1.2 · NIST CSF 2.0 GV.PO-01 · ISO 27001 A.5.10 · SOC 2 TSC CC5.3
HighFT-PRM-012 · Data Exposure
AI can delete data without approval
The AI system can delete data or records without per-action human approval.
Mapped to: OWASP LLM Top 10 LLM06 · NIST CSF 2.0 PR.DS-11 · ISO 27001 A.8.13
HighFT-DAT-014 · Model Risk
No confirmation vendor does not train on your data
A vendor-hosted, non-consumer AI system accesses sensitive data and there is no contractual confirmation the vendor will not train on it.
Mapped to: OWASP LLM Top 10 LLM02 · NIST AI RMF MAP 4.1 · ISO 27001 A.5.20
Medium
This page provides general information, not legal advice. FlashTower does not certify compliance with HIPAA, GLBA, NYDFS Part 500, professional-conduct rules, SOC 2, FedRAMP, or any other law or standard; findings and gaps are mapped to frameworks for orientation only. Consult qualified counsel and your compliance advisors about your obligations.
See what AI can access in your law firms organization.
Run the free FlashTower Scan. Get your AI risk score and every finding in about 10 minutes — no account or system access required.