What happens when the wrong legal data reaches AI?

A recent UK case gives a very practical answer.

In UK v Secretary of State for the Home Department / Munir, the Upper Tribunal examined the use of generative AI by legal representatives.

Among the issues raised was the fact that client letters and other confidential material had been uploaded into a public AI tool.

The Tribunal warned that putting confidential documents into an open AI system could breach client confidentiality and result in the loss of legal privilege. It also stressed that legal professionals remain responsible for how AI is used and for supervising the people using it.

This is not just a story about choosing the wrong tool.

It is a governance problem.

The question is not only “Can AI do this?”

It is also:

For legal teams, AI agents can increasingly work across:

• contracts,
• internal policies,
• matter files,
• entity information,
• communications,
• and company knowledge.

But not every agent should have access to every source.

And not every user should be able to use every piece of legal information through AI.

That means legal teams need to define the boundaries before the workflow starts:

• Which information can the agent access?
• Which data must remain restricted?
• Who is allowed to use the agent with confidential information?
• Can outputs be shared with another team?
• When is lawyer approval required?
• And who is responsible for configuring and maintaining these rules?

Without those controls, a simple AI task can become a confidentiality problem.

AI governance has to exist in the configuration, not only in the policy

A policy saying “do not share confidential information with AI” is not enough if the systems themselves still allow it.

Good governance means translating those principles into actual controls: roles, access levels, permissions, approval points and clear accountability.

That is exactly what we’ll explore in our upcoming workshop:

Claude AI Governance: How to Set Up Roles and Access Levels for AI Agents Performing Legal Tasks

We’ll open Claude’s settings and connectors and look at how to configure access, permissions and boundaries for agents working with sensitive legal and business information.

Join us on 4 November.