Understand your professional obligations and explain them to your staff 

Read: 

• Statement on the use of artificial intelligence in Australian legal practice 
• Supreme Court of Victoria’s practice note on the use of artificial intelligence by court users (SC GEN 25) or the equivalent practice note of the relevant jurisdiction. 

Additional information on lawyer’s professional obligations when using AI is available in the Law Institute of Victoria’s AI Hub and Victorian Bar’s Guidance on the Ethical Use of Generative AI. 

Build your AI literacy  

Learn what AI can and cannot do and get a feel for how it works by testing it with hypothetical, non-confidential tasks. 

As a practice leader, you need to understand how AI can be used and its limitations – even if you are not using AI in your practice. This understanding will help you mitigate the risks of unauthorised AI use by your staff, or AI misuse by other lawyers, decision-makers, or your clients. 

The Law Library Victoria has lists of resources for lawyers in their guides AI in the Law and AI hallucinations, and the Digital Literacy Framework for Legal Practice with CPD resources. 

The Law Institute of Victoria has established a dedicated AI Hub that is free and publicly available. The Law Council of Australia has created an AI and the Legal Profession web page designed to provide a centralised source of information. 

Assess whether your practice already has access to AI tools

For example, as part of existing software or a subscription you already have.

Establish a policy on AI use   

Having a policy on AI is important, even if your practice is not using AI. It makes your position clear to staff and other professionals you engage with, and reduces the risk of irresponsible or unauthorised use (i.e. “shadow AI”). 

Having a written policy is not a complete answer to managing AI-related risks in your practice. If you start adopting AI, you will need to build a culture of transparency and accountability and develop a more robust governance framework.

See section 4 for guidance on create an AI policy.  

Identify where AI could help in your work 

Start with lower-risk, time-intensive administrative or internal tasks. 

Explore the AI tools available to your practice  

Consider: 

• both general purpose and legal-specific tools 
• standalone tools 
• tools which integrate with software you’re already using. 

Be cautious about adopting agentic AI tools  

• Assess the risks before giving these tools access to your files or email 
• Make sure you understand what actions the tool can take, and put appropriate controls in place 

‘Agentic’ AI tools may be able to take actions (e.g. sending emails from your law practice) with little or no direct oversight. If you implement these tools, make sure you understand what access they have and what actions they can take. Never give an AI agent more than the minimum data, tools, and permissions required to complete its task. 

Adopt tools at a pace that makes sense for your practice  

Factor in: 

• your practice’s risk appetite 
• your budget – consider ongoing costs such as subscription fees and usage charges 
• costs associated with implementation, training, verification of outputs and supervision.

Consider the tool’s capabilities 

• Is it a general-purpose tool, or designed specifically for legal work? 
• What information can the tool access?  
• Can it access the internet, and can that access be turned off?  
• Can it access legal research databases or other legal materials? 
• Do those legal materials include primary sources, such as court judgments and legislation?  
• Are those legal materials relevant to Australia and kept up to date? 
• Can it access your practice’s administrative and/or client files?  
• Is it suitable for the size and type of tasks you want to use it for (e.g. how much material can it process for a task)? 

Consider whether the tool comes with security guarantees 

Guarantees should cover data use, privacy, confidentiality and cybersecurity. Confirm the provider gives enforceable guarantees that the information you use with the tool: 

• will be encrypted while it is sent, processed and stored and is evidenced by independent security certification such as SOC 2, ISO 27001 or equivalent 
• will not be accessed by the service provider (including its staff and contractors) except to the extent required to perform agreed services and in a manner that preserves privacy and confidentiality  
• cannot be accessed by unauthorised third parties 
• will not be used to train AI models or improve the provider’s services 
• will not be used for any other purpose 
• will not be processed and stored in a jurisdiction where you cannot enforce these guarantees.

AI tools that don’t provide these security guarantees are not secure enough to use with client information, or other confidential, personal or private information. 

Remember: paying for a subscription or accessing a tool through software your practice already uses, does not guarantee your information is being protected. 

Read the terms of service carefully  

Make sure: 

• any security guarantees are contractually enforceable 
• you understand who your practice is contracting with and which law governs the contract 
• you have the right to retrieve or delete your data if needed 
• you understand where data is processed and stored  
• you understand when and how the provider can change the terms of service 
• you understand what happens to your data if the provider stops operating or your practice stops using the tool.  

Understand how difficult it would be to stop using or replace the tool 

Use free trials (if available) or a smaller pilot subscription

Assess the benefits to your practice before committing to purchasing a tool. 

Learn about good AI governance 

Start with simple, practical rules that are proportionate to your practice’s size, AI use and risk profile 

See the Australian Government National AI Centre’s Guidance for AI adoption for tips and advice on building and strengthening your AI governance. 

Take a proportionate approach to managing risk 

Assess each approved use of AI and apply controls that are proportionate to the level of risk. Consider: 

• the sensitivity of the information involved 
• the significance of the task 
• the consequences if the AI output is inaccurate, incomplete or misleading, including any potential impacts on clients, third parties, your practice, court processes.

Implement policies on AI 

Policies should cover: 

• which AI tools and uses of AI have been approved, restricted or prohibited, and for approved tools: 
  • what information they can access 
  • whether they integrate with other systems or software 
• which tools (if any) can be used with client information or other confidential, personal or private information 
• how AI-generated materials must be verified including who verifies, how and when 
• training requirements before staff can use AI (see section 5 for more information) 
• how AI use must be disclosed including when staff must: 
  • tell supervisors about AI use 
  • tell clients about AI use 
  • seek approval before AI use 
  • when records of AI use must be made and retained 
  • how to record and respond to client concerns or objections about AI use 
• billing requirements to ensure clients are billed fairly and accurately when AI is used. 

Where charging is time-based, practitioners must ensure the time recorded accurately reflects the work undertaken and that clients are not charged for unnecessary AI-related inefficiency, experimentation or training.  

For fixed-fee or value-based pricing, practices must ensure the fee remains fair, reasonable and proportionate having regard to the nature of the work, the value provided, and the professional judgement, review, analysis and supervision undertaken. 

Update other policies and agreements

Policies which may need to be updated to account for any new AI tools include your: 

• privacy policy 
• collection notice 
• website terms of use 
• standard retainer terms about data collection  
• training policies. 

The Office of the Australian Information Commissioner has guidance on Privacy Act 1988 (Cth) obligations when using AI which may be helpful. 

Use IT controls to limit access (where possible) 

• Block access to the websites of unapproved tools 
• Turn off unapproved AI features in existing software 
• Limit access to certain tools/features to specific staff.

Train all staff on responsible use of AI  

Make sure training includes how to: 

• implement your practice’s policies on AI 
• configure your practice’s tools for safe use 
• recognise and manage AI risks (such as bias, discrimination, confidentiality and hallucination) 
• verify AI outputs 
• supervise AI use by junior lawyers and lay associates (where relevant) 
• write effective ‘prompts’ for AI tools.

Complete equivalent training yourself. Train new staff and provide refresher training as required.

See the Singapore Academy of Law’s Prompt Engineering for Lawyers for information about writing effective GenAI prompts. 

Give staff opportunities to build practical experience with AI and encourage them to share what works

Including useful prompts, workflows, examples and lessons learned.

Hands-on experience with AI tools will give your staff a better understanding of their strengths and limitations. Make sure they have time and permission to build this experience on tasks that are carefully supervised or have no risk to your clients.