Harnessing AI Efficiency Without Compromising Confidentiality – Q3 2026 Facts & Findings

AI is rapidly becoming part of the day-to-day infrastructure of how litigation teams research, review, and prepare cases. From natural language searches of deposition transcripts to automated chronologies and draft outlines, AI-driven tools can dramatically compress timelines and surface insights that might otherwise be missed.

However, in a profession built on confidentiality, privilege, and trust, any technology that touches client data must be held to a much higher standard. In the era of AI, data privacy and confidentiality are going to become even more important. Firms that do not have solid practices in place for handling confidential material with AI may find themselves liable if that same material ends up in a large language model, available to parties that should never have had access.

At the same time, consumers and witnesses are becoming more aware of how their data is captured and processed, whether through facial recognition, biometrics, or analytics. As that awareness grows, regulators are already moving to provide additional protection, either with new AI-specific regulations or by strengthening existing privacy frameworks. We may even face a future where consumers, witnesses, and staff have rights similar to those granted under the California Consumer Privacy Act (CCPA), but tailored to AI systems.

For legal teams, the challenge is not whether to adopt AI, but how to capture the efficiency gains without compromising confidentiality, ethics, or compliance.

WHAT AI ACTUALLY CHANGES FOR LEGAL TEAMS
To understand the new risk and opportunity landscape, it helps to be clear on what modern AI systems are actually doing.

Traditional legal programs have long included technology-assisted review and predictive coding: court-recognized tools that apply machine learning to prioritize likely relevant documents in discovery. What is new is the rise of large language models (LLMs) and natural language processing (NLP) that let you interact with those documents conversationally rather than wrestling with dense Boolean strings.

Now, instead of:
(“company” OR “defendant” OR “corporation”) w/5 (“ignored” OR “disregarded”) w/10 (“safety warnings” OR “safety protocol”)

You can simply ask:
“Did anyone say the company ignored safety warnings?”

Modern NLP-driven systems do not just look for exact keyword matches. They model the meaning of your query and scan for semantically related language such as synonyms, paraphrases, and legally relevant phrasing across large datasets.

For litigators, that yields three concrete advantages:

  • More Complete Recall: You are less likely to miss key testimony because a witness said “blew off the safety rules” instead of “ignored safety warnings.”
  • Less Noise: By ranking passages based on semantic relevance, AI can reduce the time spent discarding false positives.
  • Better First Drafts: Tools can automatically generate issue-organized summaries, chronologies, or lists of potential cross-examination questions, often with page-and-line citations back to the transcript.

Used well, AI becomes a tireless research assistant, not a replacement for legal judgment.

A SAFER DEFAULT FOR LEGAL AI USE
A central concept for responsible legal AI use is retrieval-augmented generation (RAG).

In a standard chatbot interaction, the model draws on its internal training to answer your question. That is where hallucinations and untraceable assertions come from.

RAG flips that model:

  1. You specify trusted documents: deposition transcripts, pleadings, expert reports, exhibits, internal memos.
  2. The system uses specialized search to retrieve the most relevant passages.
  3. The LLM then generates answers based only on those retrieved passages (typically accompanied by citations back to the page and line).

For legal use, this approach offers several critical protections:

  • Verifiability: Every substantive claim can be traced back to specific text in a transcript or document you control.
  • Containment: The model is not freestyling from the wider internet. It is constrained to the materials in your matter.
  • Explainability: You can test and refine the retrieval process and demonstrate to a court or opposing counsel how results were generated.

In practice, this looks like asking, “Identify all places in these three depositions where the witness discusses the accident scene,” and receiving:

  • A bulleted list of excerpts
  • Each one tagged with a page and line
  • A link back to the exact point in the transcript for quick verification

Grounded this way, AI stops being a mysterious black box and becomes a powerful, auditable layer on top of your existing evidence.

THE CONFIDENTIALITY RISK: WHEN AI LEADS TO DATA LEAKS
While RAG and similar architectures help ensure accuracy, they do not automatically guarantee privacy.

Two categories of risk still loom large:

1. Training and Data Reuse
Many consumer-grade AI tools improve their models by training on user inputs. If an associate pastes a confidential transcript into a public chatbot with default settings, that content may be stored, used for further training, and applied to conceptually influence future responses for other users.

That creates a very real possibility that:

  • Sensitive facts, names, or patterns could emerge in responses to unrelated users.
  • You have effectively disclosed privileged or confidential information to a third party.
  • You may have created a discoverable record of that disclosure.

In other words, a convenience prompt such as “Summarize this witness’s testimony” could become a long-tail data breach.

2. Opaque Processing Pipelines
AI tools are often composed of multiple services: cloud storage, vector databases, logging/monitoring systems, model APIs, and analytics. Each step in that pipeline is a potential point where data can be copied, cached, or logged.

If you do not know where your data is stored, how long it is retained, whether it is shared with subprocessors or partners, and whether it can be reconstructed or reidentified from logs, then you do not actually know where your clients’ information might surface.

Seen through that lens, AI risk is not just a technology issue. It is an emerging avenue for malpractice claims, disciplinary action, and reputational damage.

ETHICAL DUTIES REMAIN BUT EXPAND
The ABA Model Rules of Professional Conduct and analogous state rules remain clear:

  • Rule 1.1 – Competence: “A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.”1

Given that competence is a requirement, a case could be made for relevant technological aptitude, including understanding when and how AI can be used safely.

  • Rule 1.6 (c) – Confidentiality of Information: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”2

These reasonable efforts of confidentiality could include vetting third-party service providers and ensuring that they responsibly safeguard client data through rigorous security protocols.

  • Rule 3.3 (a)(3) – Candor Toward the Tribunal: “A lawyer shall not knowingly offer evidence that the lawyer knows to be false.”3

Submitting evidence or briefs that are populated by AI tools can create a risk of fabricated case law, misquoted transcripts, or other potentially inaccurate information. This, in turn, could become a violation of a lawyer’s duty of candor. It is critical that all AI-generated materials are considered draft quality and are reviewed for accuracy before use.

The ethical takeaway is simple:

  • AI may draft, but you sign.
  • AI may search, but you decide what is relevant and how it is used.
  • AI may summarize, but you verify every critical fact and citation.

Think of AI as nonlawyer assistance. Under existing rules, you must supervise that assistant and remain responsible for its output.

HOW TO VET AI VENDORS FOR PRIVACY AND SECURITY
Most firms will not build their own models. They will rely on vendors with research platforms, discovery tools, court reporting services, or specialized AI products.

To preserve confidentiality, you need a disciplined vendor selection process focused on four domains: data handling, security, model behavior, and governance.

1. Data Handling
Key questions to ask:

  • Will any of our data be used to train or improve models that serve other customers?
  • Can we contractually prohibit use of our data for general model training?
  • How is data segmented by client and matter?
  • What is your data retention policy?

You are looking for explicit commitments that:

  • Client data remains logically and cryptographically isolated.
  • Data is only used to provide services to you, not to improve the provider’s products for others.
  • Data is not retained any longer than necessary or ordered by the court.

2. Security and Compliance
You should expect a security posture comparable to, or better than, your own:

  • Do you hold certifications such as SOC 2?
  • Is data encrypted in transit and at rest?
  • What access controls are in place (role-based access, MFA)?
  • How do you monitor, detect, and respond to security incidents?

For firms handling health, financial, or other regulated data, providers should be able to support
relevant frameworks (HIPAA, GDPR, CCPA-aligned practices, and similar obligations in your
jurisdiction).

3. Model Behavior and Controls
Ask providers to be specific about:

  • Whether outputs are grounded in your documents or free-form outputs from web-trained models
  • Whether they provide citations to source documents for every substantive assertion
  • How they mitigate hallucinations and bias
  • Whether you can configure the system to never reach out to the public internet when answering questions about your matters

The goal is to ensure every answer is reproducible and testable against known sources.

4. Governance and Transparency
Finally, look for:

  • Clear documentation and training tailored to legal ethics and confidentiality.
  • Named roles (such as a data protection officer) accountable for privacy and security.
  • A change management process for model updates and feature changes that could affect risk.

A trustworthy partner will educate your team, not just sell you a license.

EMBRACING THE AI ADVANTAGE
AI is poised to become as fundamental to litigation practice as email or eDiscovery platforms. With AI, legal teams can turn days of manual transcript review into hours; surface contradictions, themes, and gaps across sprawling records; and help lawyers move from rote sifting to the higher-order work of strategy, narrative, and client counseling.

However, the AI advantage must be earned responsibly. Firms need to choose providers that can back up their promises on privacy, security, and model behavior. You can learn more about this in the AI Roundtable: Exploring Emerging Trends in Artificial Intelligence video series available at https://www.veritext.com/innovations-ai/.

The question is no longer whether legal teams can harness AI, but whether they can do so in a way that keeps trust and privilege intact. Those who answer that question well will define what competent, modern practice looks like in the AI age.

RESOURCES
1 https://www.americanbar.org/groups/professional_responsibility/publications/
model_rules_of_professional_conduct/rule_1_1_competence/
2 https://www.americanbar.org/groups/professional_responsibility/publications/
model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/
3 https://www.americanbar.org/groups/professional_responsibility/publications/
model_rules_of_professional_conduct/rule_3_3_candor_toward_the_tribunal/

Author:
Dave DaSilva is the senior vice president of product management and engineering at Veritext Legal Solutions.

icon Categories