��˾����ҹ����

In-house legal departments are embracing AI at unprecedented rates, but with great power comes great responsibility.

Recent surveys found that  are already using some form of AI in their legal workflows. Yet alongside the efficiency gains lurks a profound concern: protecting the highly sensitive, privileged information that legal teams handle every day. In fact, cybersecurity and data privacy rank as top worries for in-house counsel, and among those concerned about AI,  as their biggest fear.

This article sets out what in-house legal teams should expect from AI providers. It covers the specific privacy risks legal departments face, outlines what safeguards to look for in platforms claiming to be “secure,” and provides a checklist of features and frameworks that reflect how legal-grade AI should operate. The message is clear: to unlock AI’s benefits without risking client confidentiality or regulatory exposure, in-house counsel must demand transparency, robust governance and deep security from any AI solution under consideration.

Why in-house legal teams should be sensitive to AI security

Few functions within an organisation carry as much responsibility for data protection as the legal department. In-house lawyers routinely work with confidential contracts, internal investigations, regulatory reports and privileged advice. Their ethical and legal obligations do not disappear when AI enters the picture.

Commercial AI tools that are not built for legal workflows may fall short of these confidentiality requirements – and worse, some may use your inputs to train their models. A draft contract or email entered into an unsecured AI service could effectively be exposed to unknown third parties or made available for future reuse.

In-house legal professionals understand that even a minor privacy breach involving privileged material can have wide-reaching consequences. That includes loss of client trust, reputational damage, litigation risk and regulatory fallout. For legal teams, data protection isn’t a preference – it is a duty.

AI tools in legal: security promises vs reality

AI has immense potential to transform legal work, but not all platforms are built to meet the demands of in-house legal teams. When handling confidential, privileged and regulated data, in-house lawyers must hold AI providers to the highest standards of security, privacy and operational integrity.

This section outlines the key requirements every legal AI tool should meet – and how ��˾����ҹ���� puts those principles into practice in Lexis+ AI.

Expect security throughout the product lifecycle

AI platforms should be developed with strong security oversight from the outset, involving security experts across all stages of the product lifecycle.

What we do: Our comprehensive data protection programme ensures that we safeguard your valuable information. To ensure comprehensive security controls throughout the entire product lifecycle, we’ve assembled a team of application and security experts. They work hand in hand with our talented product development and operations teams, ensuring that each product meets rigorous, audited standards.

Expect encryption in transit and at rest

Data should be encrypted when stored and while moving through systems, using modern encryption standards and secure key management.

What we do: All Lexis+ AI™ customer data (prompts/documents) is encrypted at rest, utilising AWS’s Key Management Service and AES-256 encryption. Internet traffic in transit using TLS 1.2. Each customer request is treated separately and subsequently generates a separate transaction with the generative capabilities.

Expect defined data retention and user control

In-house legal teams should be able to control how long prompts and documents are stored, and delete them when required.

What we do: Your conversations are purged after 90 days or until the user deletes (whichever occurs first). Your conversation history is stored in a secured environment and encrypted-at-rest using AES-256.

Expect no training on customer data

Vendors should not use client data to train or tune AI models. Third-party providers must be contractually restricted from accessing or learning from user content.

What we do: ��˾����ҹ���� Large Language Model partners are bound by our agreement to “not to train” our custom models based on your data. Anthropic and OpenAI do not have access to our models or service. Our architecture precludes either organisation from logging or training models based on users’ conversations.

Expect third-party services to be isolated and vetted

If external models are used, they must be deployed in private, secure environments that are inaccessible to the public or other clients.

What we do: Third-party models used in Lexis+ AI are deployed only in protected, private cloud environments in AWS Bedrock and Microsoft Azure that are part of the secure ��˾����ҹ���� cloud environment and subject to ��˾����ҹ���� security controls that apply across our platform. The models are used exclusively by ��˾����ҹ���� and not used by the public or other companies.

All models deployed by ��˾����ҹ���� utilise dedicated, encrypted, authenticated connections which meet or exceed our high security standards. All data is encrypted and stays in the control of ��˾����ҹ���� at all times.

Expect independent audits and tested response procedures

Legal teams should expect regular, third-party assessments of a vendor’s security posture and incident handling capability.

What we do: ��˾����ҹ���� engages an independent third-party auditor to perform an annual SOC 2 Type 2 examination of Lexis® and Lexis+ based upon the Trust Services Principles of Security, Availability, Processing Integrity, Confidentiality and Privacy. New assets for Lexis+ AI have a SOC2 examination scheduled for Q1 2024.

��˾����ҹ���� has a robust set of Information Security policies. This enables us to efficiently respond to potential threats against our systems. Our incident response plans, which are updated and tested periodically, include technical, administrative, business, and executive escalation processes. The company does have external firms on retainer to provide expertise and guidance, as needed.

Expect continuous testing and vendor risk management

Vendors should conduct ongoing penetration testing, vulnerability scanning and supplier due diligence, with documented risk handling procedures.

What we do: The ��˾����ҹ����® Vendor Management programme performs vendor security and background checks and assessments during the procurement process. Vendors are assessed on a risk-based approach using several factors including access to data (customer/company), system access, and performing a critical function on behalf of the company.

We conduct penetration testing with internal tools and third-party firms to validate our defences. Automated internal and external vulnerability scanning provides continuous visibility into new risks. Any items discovered are tracked centrally to ensure proper risk prioritisation. Remediation efforts are coordinated with the supporting team in risk prioritised manner.

A higher standard for legal AI

For in-house legal teams, data protection is more than a technical detail – it is a core responsibility. Any AI platform intended for legal use must reflect that reality by offering verifiable, enforceable and legally defensible security practices.

At ��˾����ҹ����, we’ve built Lexis+ AI to meet that standard. Every design decision reflects the needs of legal professionals who require clarity, control and confidence when adopting new technology.

Because for legal teams, trust isn’t optional – it’s the foundation.