Private AI for law firms: the matter wall has to survive the assistant

The AI case for a law firm is easy to make. Summarising, comparing, extracting clauses and searching internal knowledge are exactly the repetitive work that consumes junior time. The difficulty is not whether the technology helps. It is that the material is client confidential and separated by matter.

The first question is not about quality

Before asking whether the model is good enough, ask where the client's information goes while the model is processing it, who else can reach it, how long it is retained and by whom. Those answers determine which tools are usable at all, and they narrow the shortlist faster than any benchmark.

Retrieval is where confidentiality breaks

Retrieval over the firm's documents is the feature that makes an assistant genuinely useful. It is also a search engine over everything the firm holds, and a search engine does not know about the matter wall.

A solicitor should not receive documents from another matter because the assistant was able to retrieve them. That has to be enforced at retrieval, by the user's own permissions, not by an instruction telling the model to be discreet. A model can be persuaded. An access control cannot be argued with.

If the assistant can retrieve it, treat it as disclosed. Design the permissions on that assumption and the rest of the deployment becomes straightforward.

Documents from the other side are untrusted input

A firm's index fills up with material written by people outside it: draft contracts from opposing counsel, bundles, correspondence, expert reports. Those documents become model input, and text in a document can behave like an instruction.

This is not theoretical. CVE-2025-32711, disclosed in June 2025, was described as “a zero-click prompt injection vulnerability in Microsoft 365 Copilot that enabled remote, unauthenticated data exfiltration via a single crafted email”. It scored 9.3, and Microsoft fixed it, stating that “There is no evidence that the shortcoming was exploited maliciously in the wild.”

The lesson for a firm is narrow and practical: an assistant that reads inbound documents and can reach the matter store needs its outbound paths and tool permissions constrained deliberately.

Workloads worth running locally

• Summarising long documents within a single matter
• Comparing versions of a contract and listing what changed
• Extracting clauses and obligations into a checkable table
• Searching the firm's own precedents and know-how
• Drafting first passes of routine correspondence
• Answering internal questions about the firm's own procedures

Each of those is verifiable against a source document, which is the property that makes a workload safe to start with.

What the model does not become

A local model helps lawyers work faster. It does not exercise legal judgement, and generated analysis still requires review by a qualified professional before it reaches a client or a court.

Local deployment is not automatically the best option for every task either. Where the work is not confidential and the strongest available reasoning matters, a cloud service may be the better tool. The case for local is strongest exactly where confidentiality is the product.