Is it safe to use AI in a law firm? Professional confidentiality and the LFPDPPP
The number-one objection to legal AI is the right one: confidentiality. What the LFPDPPP requires, what Mata v. Avianca taught, and the safeguards checklist a law firm should require before using any model.
The question “does AI violate professional secrecy?” is the one we hear most from partners and legal directors—and it’s the right question. The honest answer isn’t yes or no: it depends on the tool, the contract, and the policies in place. This analysis breaks it down with the law in hand.
# Can AI violate professional confidentiality?
Yes, and the mechanism is clear: consumer AI tools (free and personal plans) may use conversations to train their models. A lawyer who pastes case-file content into one of them is transmitting privileged information to a third party without contractual controls—functionally equivalent to discussing a client’s case in a public place. The risk isn’t the technology; it’s using it without the safeguards the profession requires of any provider that handles client information.
# What does the LFPDPPP say about client data in AI tools?
The Federal Law on the Protection of Personal Data Held by Private Parties requires the law firm—as the data controller—to ensure that any processor (including an AI provider) handles data in accordance with the privacy notice and applies appropriate security measures. Uploading a client’s personal data to a tool that uses it for training is processing beyond the stated purpose and is subject to penalties. The operational rule: the AI provider must sign or publish verifiable commitments not to use data for training, and to encrypt and delete it.
# What happened in Mata v. Avianca, and what does it teach?
In 2023, two New York lawyers filed a brief citing six nonexistent precedents generated by ChatGPT. Judge P. Kevin Castel sanctioned them 5,000 dollars under Rule 11—Avianca’s lawyers simply reported that they “could not locate” the cited cases. The lesson isn’t to ban AI: no AI output should reach a court without verification against official sources. In Mexico, that means always checking against the Semanario Judicial de la Federación and the DOF.
# What safeguards should a law firm require from an AI provider?
The minimum checklist before processing any client matter:
| Safeguard | Question to answer | Claude Enterprise |
|---|---|---|
| No training | Does the provider contractually commit not to train on your data? | Yes—Enterprise policy |
| Segregation | Can you isolate matters with different permissions? | Yes—workspaces and permissions |
| Encryption | Is data encrypted in transit and at rest? | Yes |
| Traceability | Are there logs showing who used what and for which matter? | Yes—admin audit |
| Data residency and retention | Where is the data stored, and when is it deleted? | Documented in DPA |
# What does a well-crafted AI policy look like?
According to Clio, 53% of legal professionals have no AI policy or don’t know whether one exists — the governance gap is the rule, not the exception. A serious policy specifies which tools are authorized and under what plan, which categories of information may be processed (a confidentiality matrix by matter type), the process for reviewing outputs before external use, and who is accountable for compliance (an AI committee). It’s a 5-10-page document that is put into practice—not a memo that gets filed away.
POLICIES + IMPLEMENTATIONia¹ implements Claude with confidentiality policies documented from day one. Start with an assessment.# Frequently asked questions
# Does using AI mean I have to tell my clients?
It depends on the processing involved: if the tool processes clients’ personal data, the privacy notice must cover the data processor. Many firms choose proactive transparency—disclosing their use of AI along with confidentiality safeguards—as a trust-building practice, just as they would disclose the use of any technology provider.
# Is attorney-client privilege lost when using AI?
No, if the provider acts as a data processor with contractual confidentiality obligations—just like an email or document management service. The risk arises when the tool uses the data for its own purposes, such as training public models.
# What should I do if my team is already using free ChatGPT with real cases?
First, don’t punish anyone: this is a symptom of a real need without a secure channel. Second, reduce the risk: put an interim policy in place immediately, adopt an enterprise plan that does not train on your data, and migrate workflows to a controlled environment with training.
# Have Mexican authorities penalized law firms for using AI?
The enforcement framework exists (LFPDPPP), and the data protection authority can act on complaints about improper processing. International precedents—judicial sanctions such as Mata v. Avianca and data protection fines in Europe—point in the same direction: the exposure is real and growing.
Continue the cluster: Complete guide to AI for lawyers · how Claude works in a law firm