Resources
AI Vendor Security Claims, Decoded
Five real ways vendor security goes wrong, what the rules, insurers and courts already expect, and the exact questions to ask before you sign, with the specific stakes for criminal defense, personal injury, family law and immigration practices.
Most legal AI tools say almost the same handful of things about security. What those phrases actually promise, from SOC 2 to zero retention, is read term by term in The Legal AI Buzzword Decoder. This page covers what happens when the promises meet the real world. No specific vendor is named, on purpose: the patterns matter more than the brand, and they show up across the industry.
Five ways this actually goes wrong
None of this is hypothetical. Each one is already documented in a research paper, a public breach report, or a regulator’s own guidance.
1
“Deleted” doesn’t always mean deleted
When an AI tool searches your documents, it first converts each one into a mathematical fingerprint that gets stored separately so the AI can find it later. A 2026 research paper found that several widely used systems for storing these fingerprints kept them fully intact and recoverable, including sensitive personal details, even after the original document was deleted and the system reported the deletion as complete. If a client asks you to confirm a document never existed in your system, “we deleted it” might not be true everywhere it was stored.
- Ask
- When I delete a document, does its fingerprint get deleted too, everywhere, including backups, and can you show me, not just tell me?
2
Hidden instructions inside a document you didn’t write
AI tools that read documents sometimes can’t tell the difference between the text of a document and instructions telling the AI what to do next. A single document you didn’t create yourself (one from opposing counsel, a client’s upload, anything forwarded to you) can contain hidden text that redirects the AI. This exact flaw already caused a zero-click data leak at one of the most widely used AI assistants in the world, with no user having to click or open anything. It’s ranked the #1 risk on the AI security industry’s own list of threats. This risk grows with every new efficiency tool a firm connects, whatever kind of law it practices.
- Ask
- If a document I upload contains hidden text instructing the AI to do something else, what stops it from following those instructions, and has that actually been tested?
3
Connected tools that can reach more than they need
Connecting an AI tool to your document system, calendar, or email usually grants it far more access than the specific feature actually needs. If that access is later stolen from the AI company, not from you, the attacker inherits everything it can reach. This exact pattern caused a breach reaching more than 700 organizations in one 2025 incident, traced back to a single chatbot integration granted far more access than it needed. On average, companies now have well over a dozen of these AI connections active, and most are never reviewed again after the day they were first set up.
- Ask
- When we connect this tool to our document system or email, exactly what can it access, and who reviews that on an ongoing basis, not just once at setup?
4
A vendor’s breach reaches you, while their website still says “secure”
One major legal-industry data platform was breached in early 2026 through an unpatched software flaw and a hardcoded password. Roughly 400,000 accounts were exposed, including well over 100 belonging to federal judges, law clerks, and government attorneys, while the company’s own public statement described the situation as “contained” with “no evidence” of impact to its products. Both statements can be technically true and still leave you with an incomplete picture: “contained” describes their cleanup, not what already left the building before anyone noticed.
- Ask
- Walk me through your last actual security incident, not hypothetically: what was exposed, and how long between the intrusion and telling anyone?
5
The AI underneath quietly changes, and nobody has to tell you
The contract you sign covers the product. It usually says nothing about the specific AI model running inside it. Vendors have already swapped in their own newly built model as the new default, without a public accounting of whether their “we don’t train on your data” promise still holds for a model they trained themselves.
- Ask
- If you change or replace the model behind this product, are we told before it goes live in our account, and do we get a chance to test it first?
What the rules, insurers, and courts already expect
This isn’t optional caution. Bar associations, malpractice insurers, and judges are already asking exactly these questions.
The ethics rule
ABA Formal Opinion 512 (2024), the framework most later state guidance builds on, says a lawyer’s duty to supervise extends to the AI vendor itself. That means real due diligence: checking references, reviewing the vendor’s security practices, and, the detail most firms skip, confirming whether the vendor claims any ownership over what you submit. Several states have issued their own guidance since. One more detail worth knowing: boilerplate consent buried in an engagement letter isn’t enough. Informed consent has to name the specific tool, the specific task, and the specific risk.
What your malpractice insurer is already asking
In the last two years, this went from rare to routine. Well over half of malpractice carriers now ask about AI use at intake or renewal: do you use AI, do you have a written policy, do you train your people on it, do you audit it. More than half of carriers report a rise in AI-related claims in the past year. A firm with no written AI policy and no record of vendor due diligence is now a different underwriting risk than one that has both.
Privilege risk: the split every firm should know about
In one 2026 federal case, a judge held that a criminal defendant’s conversations with a consumer AI chatbot were protected by neither attorney-client privilege nor work product. The AI isn’t a lawyer, and there was no reasonable expectation of confidentiality given how the product’s own terms are written. A different court, one week earlier, reached the opposite result on work product in a similar situation, because losing work-product protection requires disclosure to an actual adversary, a narrower bar than losing privilege. Together, these rulings mean how a tool is used (an enterprise product used at counsel’s direction versus a consumer tool a client opens on their own) can decide whether what gets typed into it is protected at all, or sitting there waiting to be subpoenaed.
1,500+
documented court cases worldwide, as of mid-2026, involving AI-fabricated legal citations, up from roughly 200 a year before. Penalties have run from a few thousand dollars to over $100,000, plus case dismissals, attorney suspensions, and at least one interim license suspension. Firm size is no protection: some of the worst cases came out of a large firm’s own in-house AI research tool, not a free chatbot someone used on the side.
What this means for your practice
Two of these risks apply no matter what you practice. The rest depend on what kind of law you do.
Every practice area
Wrong numbers, wrong citations
An AI tool can confidently generate the wrong number or the wrong case name, and it will look exactly as polished and certain as a correct answer would. The 1,500+ documented court cases above all started this way.
Hidden instructions in someone else’s document
Any firm connecting an AI tool to move faster is exposed to this, regardless of practice area. It’s a function of what the AI reads, not what kind of law you practice.
By practice area
Criminal defense
The privilege risk above matters most here. A client typing out what actually happened into an AI chat tool, believing it’s a private conversation with their lawyer’s software, may be creating a record that isn’t protected by privilege and is discoverable by the prosecution. A tool being marketed “for lawyers” doesn’t automatically fix this. What fixes it is a specific, tested contractual commitment, not a marketing page.
Personal injury
The same privilege exposure shows up here in a different shape. A client discussing liability, describing what they told an insurance adjuster, or working through settlement numbers inside an AI tool is generating a record that opposing counsel may be able to subpoena, particularly when large sums are on the table and the incentive to dig for anything usable is highest.
Family law
This is where the hallucination risk gets concrete and expensive fast. An AI tool confidently miscalculating a support obligation, misreading an asset value, or inserting the wrong figure into a financial disclosure can shape a settlement or a court’s decision before anyone catches the error, and family law’s numbers-heavy, deadline-driven paperwork is exactly the kind of task firms reach for AI to speed up.
Immigration
Every immigration matter runs through federal agencies, which changes the stakes on two of the risks above. First, a vendor’s data-sharing chain (its subprocessors, its AI model provider, its backups) determines how easily a client’s information could end up in the hands of federal immigration authorities, not just a private litigant. Second, “could this be subpoenaed, and has that actually happened” is a materially different question when the requesting party could be a federal agency with independent enforcement power, not just an opposing party’s lawyer.
The question checklist
If you only have fifteen minutes with a vendor, ask these five, in this order.
1
“What was your last actual security incident?”
- Why it is here
- Opens on their honesty, not their certifications.
2
“Is your no-training promise in the contract, or just on this page?”
- Why it is here
- Moves the conversation from marketing to something enforceable, fast.
3
“Name every company that touches our data, including your AI provider.”
- Why it is here
- The one vendors are least prepared for. The hesitation itself tells you something.
4
“When a document is deleted, does its fingerprint get deleted too, and can you show me?”
- Why it is here
- The most technical question here, and a good test of whether the person answering actually understands their own product.
5
“If the AI model changes, do we get notified before it goes live in our account?”
- Why it is here
- Closes on the forward-looking risk: not what’s true today, but what happens the day it changes, with nobody in the room to ask.
The full list, by category
All 15 questions, grouped by what they test.
About the company and the contract
1
Is your no-training promise written into the contract, or only on the marketing page, and does every product your company sells make the same promise?
2
What was your last actual security incident?
3
If your company is acquired, what happens to our data, our contract terms, and our right to leave?
About the AI model itself
4
Which AI model(s) actually power this feature, and are we told before that changes?
5
Does the no-training promise cover a model trained specifically on our data, not just your general one?
About the infrastructure underneath
6
What does your security audit report actually cover, and does it include this AI feature specifically?
7
Name every company that touches our data, including your AI provider, your logging tools, and your backups, with matching data-protection agreements for each.
8
If we’re a government contractor or handle health information, does this specific product carry the required certification, or only the cloud infrastructure it happens to run on?
About who at the company can actually see your data
9
Which of your employees can actually open and read our case files, our prompts, or the AI’s responses, not just in theory, and under what circumstances, like a support ticket or a bug report?
10
What access level does someone internally need to reach that data, who decides who gets it, and is every access logged and tied to a specific person?
About everything this tool connects to
11
Exactly what can this tool access when we connect it to our document system, email, or calendar, and who reviews that access on an ongoing basis?
12
If your system is compromised, how far could it reach into our other connected systems?
About what happens to the data itself
13
When a document is deleted, is the fingerprint generated from it deleted too, everywhere, and can you demonstrate it?
14
“Zero retention”: at which point, exactly? The AI call itself, or your own database, logs, and backups too?
15
Could a subpoena or court order compel you to hand over data we store with you, and has that actually happened?