← Tools
Signature tool · CLO AI Chambers
Legal AI use-case triage
For any proposed AI use in legal or the wider business: how sensitive is the data, could privilege be lost, what does the vendor do with the data, how accurate must the output be, who reviews it and where does it go? A fixed rule table (shown on the page) turns your answers into a verdict and a list of required controls. Hard stops, such as privileged data with a vendor that may train on it, always mean don't. The verdict is calculated in code; AI only explains it.
A structured first view, not legal advice. The verdict comes from the fixed rule table below; a lawyer should confirm it for anything high-stakes.
The rule table (23 rules)
Each answer has risk points; the risk score is 100 × points ÷ maximum possible points for the questions answered. Verdict: any hard-stop rule that matches → Don't. Otherwise, if any question is unanswered → incomplete. Otherwise, any control rule that matches, or a risk score at or above 40 → Approve with controls. Otherwise → Approve.
| Rule | When | Result |
|---|---|---|
| Confidential or privileged data with a vendor that may train on it. | What is the most sensitive business information the AI will see?: Confidential (company or client confidential, trade secrets) / Privileged (legal advice or work product)May the vendor train or improve its models on our inputs or outputs?: Yes, or by default unless we opt out | Don't |
| Privileged data where the vendor's training terms are unclear. For privileged material, treat unclear as yes. | What is the most sensitive business information the AI will see?: Privileged (legal advice or work product)May the vendor train or improve its models on our inputs or outputs?: Unclear / not yet confirmed | Don't |
| Privileged data in a consumer tool. Consumer terms can defeat confidentiality and privilege. | What is the most sensitive business information the AI will see?: Privileged (legal advice or work product)Which kind of tool and terms?: Consumer tool or personal account | Don't |
| Confidential data in a consumer tool or personal account. | What is the most sensitive business information the AI will see?: Confidential (company or client confidential, trade secrets)Which kind of tool and terms?: Consumer tool or personal account | Don't |
| Sensitive personal data with a vendor that may train on it, or where that is unclear. | Will it process personal data?: Sensitive personal dataMay the vendor train or improve its models on our inputs or outputs?: Yes, or by default unless we opt out / Unclear / not yet confirmed | Don't |
| Third-party information restricted by an NDA, protective order or client terms in a consumer tool. | Is any third-party information restricted by an NDA, protective order or client terms?: Yes, restricted third-party informationWhich kind of tool and terms?: Consumer tool or personal account | Don't |
| Restricted third-party information with a vendor that may train on it. | Is any third-party information restricted by an NDA, protective order or client terms?: Yes, restricted third-party informationMay the vendor train or improve its models on our inputs or outputs?: Yes, or by default unless we opt out | Don't |
| Output filed with a court or regulator without a qualified person reviewing every output. | Where will the output go?: Filed with a court or regulatorWhat human review happens before the output is used?: Sampled or occasional review / No review before use | Don't |
| Decisions about individuals made by AI with no human review. | Does it affect decisions about individuals?: It makes or effectively makes the decisionWhat human review happens before the output is used?: No review before use | Don't |
| High-accuracy output used with no human review. | How accurate must the output be?: High — legal authorities, figures or advice relied onWhat human review happens before the output is used?: No review before use | Don't |
| Confidential data while the vendor's training terms are still unclear. | What is the most sensitive business information the AI will see?: Confidential (company or client confidential, trade secrets)May the vendor train or improve its models on our inputs or outputs?: Unclear / not yet confirmed | Controls |
| Privileged material is involved. | What is the most sensitive business information the AI will see?: Privileged (legal advice or work product) | Controls |
| Personal data is processed. | Will it process personal data?: Ordinary personal data (names, contact details, HR records) / Sensitive personal data | Controls |
| Restricted third-party information is involved. | Is any third-party information restricted by an NDA, protective order or client terms?: Yes, restricted third-party information | Controls |
| People will rely on legal authorities, figures or advice in the output. | How accurate must the output be?: High — legal authorities, figures or advice relied on | Controls |
| Output goes to a court or regulator. | Where will the output go?: Filed with a court or regulator | Controls |
| Output goes to a counterparty or customer. | Where will the output go?: Documents sent to a counterparty or customer, reviewed before sending | Controls |
| Output reaches customers or the public automatically. | Where will the output go?: Shown to customers or the public automatically (no review of each output) | Controls |
| Only sampled review for output that people rely on. | What human review happens before the output is used?: Sampled or occasional reviewHow accurate must the output be?: Medium — summaries relied on with checks / High — legal authorities, figures or advice relied on | Controls |
| The AI affects decisions about individuals. | Does it affect decisions about individuals?: It informs decisions a human makes / It makes or effectively makes the decision | Controls |
| High regulatory exposure. | How much regulatory exposure does this use have?: High — high-risk category or active regulator interest | Controls |
| Sector or data protection rules apply. | How much regulatory exposure does this use have?: Moderate — sector rules or data protection duties apply | Controls |
| A consumer tool is used (only for public or internal data). | Which kind of tool and terms?: Consumer tool or personal account | Controls |
Sign in to save your work privately and come back to it. Export works without an account.