Claude for law firms: privilege, client data, and supervision
Updated August 10, 2026 · 5 min read · Claude platform facts checked against claude.com/pricing on August 10, 2026.
Can a small law firm use Claude without risking client confidentiality?
A small law firm can use Claude for client work when the setup honors the duties the profession already recognizes: confidentiality, supervision, and candor. In practice that means a business-tier plan where client content is not used for model training by default (the Team and Enterprise standard as of August 2026), access scoped to what each matter needs, a written AI policy, and a lawyer reviewing anything that leaves the firm. The bigger risk is rarely the model; it is an ungoverned rollout.
Is Claude confidential enough for client files?
On the business tiers, yes, with configuration. As of August 2026, Anthropic does not train models on your content by default on Team and Enterprise plans, and Enterprise adds the controls a confidentiality analysis wants to see: audit logs, custom data retention, restricted network access, and a HIPAA-ready configuration option for firms whose matters touch health information.
The comparison that matters is not Claude against a filing cabinet; it is Claude against the software the firm already trusts. A firm that keeps matters in a cloud practice system has already accepted that confidential material sits with a vendor under contractual protections. The same analysis applies here, and the same discipline: read the terms, configure the controls, write down what is allowed.
What that discipline looks like tool by tool is the subject of Is Claude safe for client data?, which applies beyond law firms.
Does using Claude waive privilege?
Routing work through a confidential technology vendor is not a new privilege category: firms have applied the same disclosure analysis to practice management systems, e-discovery platforms, and cloud document storage for decades. The real answer gets built from the setup details: the business tier, the no-training default, scoped access, and the confidentiality terms in the agreement.
Two practices carry most of the weight. First, scope access by matter, so Claude reaches the folder it is working for and nothing else. Second, keep the excluded list in writing: material under protective order, matters a client has restricted, anything the engagement letter forecloses.
How privilege applies to any particular matter is a question for the responsible lawyer in the relevant jurisdiction, not for a guide. What a guide can say is that firms which treat AI as another confidential vendor relationship, papered and configured accordingly, are asking the right question in the right shape.
What does supervision look like in practice?
Supervision means a lawyer reviews AI-assisted work the way they would review a junior associate: before it goes to a client, a court, or opposing counsel. ABA Formal Opinion 512, issued July 2024, applies the duties lawyers already carry to generative AI: competence, confidentiality, communication with clients, supervision, candor, and reasonable fees. None of them are new; the opinion maps them onto the tool.
- Drafts are held, never auto-sent. Client updates, letters, and filings leave under a lawyer’s name after a lawyer’s read.
- Citations get checked by a person, every time. Claude summarizes and drafts well; verifying authority is the lawyer’s job and stays that way.
- The review rule is written into the firm policy and the training, so it survives busy weeks and new hires.
Which workflows pay for themselves first in a firm?
The nonbillable admin around every matter pays first: the intake summary, the status email, the document organization that eats hours nobody can bill. These are the workflows we set up and train on first in a firm, each with a person signing off.
| Workflow | What goes in | What comes out | Who signs off |
|---|---|---|---|
| Client intake | An intake email or call notes | A matter summary in the firm’s format, follow-up questions drafted | The assigned lawyer |
| Conflict checks | New party names | Flags against the matter list, for a person to confirm | The person running conflicts |
| Document review | A long agreement from the document store | A summary with clauses, dates, and flagged risks | The reviewing lawyer |
| Research summaries | Case law and long records | A plain memo filed to the matter, cites left to check | The lawyer who checks cites |
| Client updates | The matter file | A plain-language status draft | The lawyer who sends it |
| Records and discovery prep | The records stack in the matter folder | Organized, summarized material so review starts ahead | The reviewing team |
What belongs in a firm’s AI policy?
A firm AI policy fits on a few pages if it answers six questions plainly. Sign it before go-live, not after the first close call.
- 01Which tools are approved, by name, and on which accounts. Personal AI accounts for client work are the first thing a policy should end.
- 02Which data never goes in: the excluded-matter list, protective-order material, anything a client restricted.
- 03Who reviews what, and what may never leave without a lawyer’s signoff.
- 04How the training-data and retention settings are configured, so the answer is written down rather than remembered.
- 05What gets disclosed, to clients or courts, and who decides.
- 06What happens when someone leaves: access ends the day the job does.
Each of those six is expanded into a drafting section, with a sample clause to adapt and sign, in An AI use policy for a small firm, section by section.
What does this cost a firm?
Seats are the small number: a ten-person firm on Team standard seats pays $2,400 a year with annual billing as of August 2026, and the full plan arithmetic is in What Claude actually costs a small business. Firms with audit or retention requirements price Enterprise through sales.
The rollout is the other line: our engagement covers plan selection, secure setup, training on the firm’s real matters, and the signed policy, from $3,500 flat, with compliance paperwork handled where the work demands it. Justo is attorney-founded; one of our three owners is a practicing attorney in Miami. Scope is on the pricing section of our main page.
Straight questions
Can Claude do legal research on its own?
It can read, summarize, and draft from case law and records, and it leaves citation checking to the lawyer, which is where it must stay. A firm that treats Claude output as a first draft from a fast junior gets the value while keeping responsibility for the final work where it has always sat: with the lawyer.
Do clients have to be told the firm uses AI?
It depends on the use, the engagement, and the jurisdiction; ABA Formal Opinion 512 discusses when the duty of communication is triggered. The practical answer is to decide the disclosure rule deliberately and write it into the policy, rather than leaving it to each lawyer under deadline.
Does AI threaten the billable hour?
The hours it compresses first are the nonbillable ones: intake notes, status updates, file organization. Firms feel that as recovered capacity. What it means for fee structures over time is a strategy question each firm will answer; the near-term effect is less unpaid admin.
Is it safer to just ban AI at the firm?
A ban without an approved alternative leaves personal-account use as the only route, which is the worst available configuration: client data on consumer terms, no logs, and no review rule. An approved tool with a written policy is the conservative option, not the risky one. What that policy has to settle is drafted out in An AI use policy for a small firm.