Every prompt containing client information is a disclosure to a third party. Ethics rules require reasonable efforts to protect it.

Key diligence questions: Is data used for training? Where is it stored, and for how long? Who can access it? What certifications does the vendor hold?

Clients increasingly include AI-specific terms in outside counsel guidelines. Firms should be ready to answer before they are asked.

Good security is now a selling point. Treat your AI governance policy as marketing collateral as much as compliance.