Law Firm AI Transcription and Cross-Border Subprocessor
A 40-attorney law firm adopts an AI meeting assistant that joins video calls, transcribes audio, and summarizes action items. The vendor is a U.S. startup; audio is processed in Virginia, but a subprocessor in India provides overnight quality review. The standard contract retains audio and transcripts for 30 days, uses customer data to improve models unless the firm opts out, and provides no signed data processing addendum. Several attorneys already use personal free accounts on their phones. A partner uploaded documents from a pending merger to the free tool. The firm's engagement letters promise confidentiality, and it has a litigation hold on one matter. Bar rules require competence with technology and protection of client confidences. The firm has no written AI policy and its IT staff of two supports both offices.
1. Identify the confidentiality and privilege risks and rank them. What should be done first?
Read the worked answer
Highest risk: the partner's upload of pending merger documents to a free consumer tool. That may disclose material nonpublic information, waive privilege, and create a securities or client-notification problem. Preserve evidence and involve outside counsel immediately; do not simply delete the account.
Second: personal accounts on attorneys' phones place client data outside firm retention, e-discovery, and access controls. The firm cannot preserve or produce what it cannot see.
Third: no signed data processing addendum, plus a subprocessor in India and default model training. These create unauthorized disclosure and cross-border transfer risk, and they conflict with engagement-letter confidentiality.
Fourth: 30-day retention is not inherently unlawful, but automatic deletion may conflict with the litigation hold if relevant transcripts exist.
Fifth: transcription inaccuracy and competence. A summary error could misstate a client instruction. Rank controls by irreversibility: stop the merger-document exposure first, then disable personal accounts, then fix the contract and retention.
2. What contract and technical controls should the firm require before firmwide deployment?
Read the worked answer
Contract: a signed data processing addendum with confidentiality obligations, a no-training commitment, deletion on request and at contract end, a defined retention period, prior notice and approval of subprocessors, flow-down obligations to the India subprocessor, and appropriate cross-border transfer safeguards such as standard contractual clauses. Add security incident notification, audit rights, encryption commitments, access controls, and breach indemnity. Require a data residency option if available.
Technical: deploy only an enterprise tenant with single sign-on and role-based access; block consumer accounts and personal cloud storage on managed devices; use data loss prevention to flag client identifiers; store recordings and transcripts in the document management system with retention labels and legal-hold exceptions; require meeting notice and consent where calls are recorded; encrypt in transit and at rest; and log access.
Process: vendor risk assessment, privacy impact assessment, attorney training, and an incident-response playbook. With two IT staff, buy a managed security service rather than relying on manual review.
3. Draft an attorney-use policy outline and explain how it addresses the pending merger and the litigation hold.
Read the worked answer
Policy outline:
- Approved tools only; consumer AI accounts are prohibited for client or firm information.
- Classify data before use: public, internal, confidential, and privileged; the highest two categories require the enterprise tenant and, where client contracts require it, client consent.
- Notice participants that an AI assistant may transcribe; obtain consent where required.
- Do not use AI output as the final work product without attorney review.
- Preserve transcripts that are relevant to a matter; apply litigation holds before any automatic deletion.
- Report suspected disclosures within a set time; cooperate with investigation and remediation.
- Train annually and apply sanctions for violations.
For the merger: preserve the upload records, notify outside counsel and the client as advised, request deletion from the vendor, and assess whether the information was used for model training. For the litigation hold: suspend auto-delete for that matter, collect existing transcripts, and document the preservation steps. The policy must make clear that the hold overrides the vendor's 30-day retention default and the firm's normal cleanup schedule.