Mahvash Ikram
Law firms will likely be held liable for AI blunders, even those caused by a third party, such as their software provider.
In worst-case scenario, these failures could result in a disciplinary finding of unsatisfactory conduct or misconduct, attendees at a recent webinar – AI for Property Practitioners, hosted by The Law Association – were told.
The firm becomes liable for a provider’s mistakes because under the Privacy Act 2020, personal information held by an agent – including a third-party AI provider hosting the firm’s data – is deemed to be held by the firm. Anything the provider does or omits is considered to be done or omitted by the firm, said presenter Lloyd Gallagher, managing partner of Gallagher & Co and outgoing convenor of The Law Association’s Technology & Law Committee.
For example, Microsoft recently admitted that the data inside its sandboxes – a sealed environment meant to keep information isolated from everything around it – had been breached and hacked. But it is the firm that will be liable, even if it is the vendor’s security failure that exposes client data, Gallagher said.
Joanna Pidgeon
A law firm could also be found in breaching s 4 of the Lawyers and Conveyancers Act 2006, which requires practitioners to uphold the rule of law, independence and fiduciary duty, said co-presenter Joanna Pidgeon, a director of Pidgeon Judd and the incoming convenor of The Law Association’s Property Law Committee.
“You can’t delegate them to a machine.”
Further, an employee’s unauthorised use of AI could put the firm’s principals in breach of r 11.1 of the Client Care Rules. This requires a lawyer practising on his or her own account to ensure the conduct of everyone engaged or employed by the practice is competently supervised, Pidgeon said.
Liability: firm vs vendor
Most firms paying for enterprise-grade AI products do not redact client data before using them.
Exposure starts the moment commercially sensitive data or privileged material is pasted into an AI tool, Gallagher said. But the answer is not to stop using the tools: rather, it is to strip out what the tool must not see before anything is uploaded.
“It’s really important that you redact. Whiteout’s probably not the best. Have decent, proper software to redact information that AI should not have, and don’t just copy and paste straight into AI. The minute you do so, you’ve effectively created a breach,” Gallagher said.
Lloyd Gallagher
“Having policies around how you submit information to AI for responses is just as important as double-checking responses.”
Offshore vendors present a further problem. US suppliers may undertake to apply New Zealand law but they remain bound by US legislation and cannot give these assurance, although their “sales team will try”.
Vendor agreements typically disclaim all responsibility, leaving the firm to carry the full risk. So, it is important to check how an insurer would view a potential contract with an AI provider, Gallagher said.
“You could get hung out to dry… you don’t want indemnity insurance not applying when you need it.”
A closed, customised system inside a firm’s own data centre is considerably safer than putting material into general cloud services, although some risk remain, he said.
AI’s limitations
To demonstrate the limitations of AI for property lawyers, Pidgeon used the example of buying a property managed by a body corporate, which could generate hundreds of pages of minutes and remediation reports.
AI is good at summarising them, she said, but the summary revealed only what was in the file. It could not tell you what should be there but was not.
“You still need to at least scan it to see that something hasn’t been left out that might be important,” she said
AI can also make up facts and citations and present them convincingly, Gallagher said.
“You need to have a human eye double-checking this information that’s being submitted… because there is a genuine risk and you are the one who carries the liability if you are acting in a professional capacity.”
Supervision failures
Checking AI-generated work is harder than supervising a junior lawyer, Gallagher said, because AI never signals doubt whereas an unsure staff member will flag their concerns.
AI will produce a convincing argument and “won’t show any lack of certainty” so firms must not leave AI to juniors alone.
As yet, there is no settled view on what constitutes reasonable use of AI so the courts are holding lawyers to a higher standard, he said.
“The ‘reasonable’ standard is not enough. We need to take the next step and make sure that whoever’s using it is taking appropriate steps to double-check and have it checked by a senior.”
Staff must be trained to use the tool, supervised while using it and must be given clear instructions about their obligations, Pidgeon said. Every output must be verified before the file progresses to the next step.
Pidgeon has used AI to check whether she has missed any relevant cases when writing an opinion on a unit title property – the legal structure used for apartments and townhouses, where owners hold their unit plus a share of the common property.
She already knew the legal position and could tell whether the AI results held up. Someone less experienced would likely have taken the results at face value and would not have understood the consequences of missing something or noticing a red flag, she said.
AI software responds with case citations and extracts, and a junior who reads only the extract cannot tell whether the case applies. One way of testing that was to ask staff to provide printed copies of the cases, highlighted at the relevant passages, rather than taking a junior’s word that they had checked it.
Gallagher’s suggestion was to have the junior argue the contrary position, to confirm the original argument was sound.
“It’s a little bit more work, but if you’re dealing with a junior, it’s probably not bad practice because it’s also giving them the training and the understanding of the law, not just copying and pasting.”
The Tenancy Tribunal’s Chief Adjudicator has issued guidance on AI use and unchecked filings can attract indemnity costs, Pidgeon said.
Frameworks, policies and guardrails
Every firm needs a written AI policy, Gallagher said.
It should cover:
- how AI may be used and which tools are approved;
- how client information is kept secure; and
- what happens if something is disclosed by mistake – who is told, and what will be done to limit the damage.
It should also require confidential client data to be anonymised before it goes into an open-source AI tool, and for every AI-generated conveyancing document to be checked by a second person before it is filed.
If you’re interested, you can purchase access to the on-demand version of this webinar here.
0 Comments