Key Takeaways
- The duty of confidentiality applies to every page a firm scans, converts or uploads. ABA Model Rule 1.6(c) asks for reasonable efforts, and that test now covers AI document workflows.
- OCR is a privacy event. It turns images of pleadings, contracts and medical records into searchable text that can be copied, logged and sent to other systems.
- Most redaction failures are mechanical. Black boxes over live text, forgotten metadata and missed OCR errors cause more trouble than clever attacks do.
- Anonymizing before inference is the strongest control a firm has, because the model never receives real client names, account numbers or diagnoses.
- On-premises and private cloud deployment, matter-level access and human review do most of the work. Vendor promises alone are not reasonable efforts.
- Tools such as Questa AI sit in front of existing review platforms, so firms can keep the tools they know and change what those tools receive.
None of this requires a firm to stop using AI. It requires deciding where client data goes at each step, from the scanner to the production set, and being able to prove it.
The rest of this guide follows that path: what the ethics rules ask, where data hides, how redaction fails and what a defensible pipeline looks like.
Why Document Processing Is Where Law Firm AI Risk Starts
Most conversations about legal AI focus on the chat window. The bigger exposure usually sits one step earlier, in the documents. A litigation file can hold thousands of scanned exhibits, transcripts, medical records and bank statements. Before any AI tool can summarize that material, someone has to scan it, OCR it and load it somewhere.
A free online converter, a cloud OCR service or a plug-in that quietly uploads attachments can move privileged material outside the firm before a lawyer types a single prompt. Our piece on the hidden data risks of AI PDF converters shows how easily that happens.
What the Ethics Rules Actually Ask of You
Rule 1.6(c) and the reasonable efforts test
ABA Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Comment 18 lists the factors that decide what is reasonable: how sensitive the information is, how likely disclosure is without more safeguards, what those safeguards cost, how hard they are to put in place, and whether they make it harder to serve the client.
That list works well as a checklist for AI document processing. Medical records in a personal injury matter score high on sensitivity, and a consumer AI tool scores high on likelihood of disclosure. Anonymizing first, or processing on the firm's own servers, now costs far less than it once did. When safeguards become cheap and practical, the reasonable efforts bar moves up with them.
Opinion 512, competence and client consent
ABA Formal Opinion 512, issued in July 2024, was the ABA's first formal guidance on generative AI. It ties AI use to existing duties of competence, confidentiality, communication and reasonable fees. Comment 8 to Model Rule 1.1 already asked lawyers to understand the benefits and risks of relevant technology, and the opinion applies that to AI.
On confidentiality, the opinion treats self-learning tools with particular caution. Where a tool may use inputs to train or refine itself, it says the client's informed consent is needed before information relating to the representation goes in, and that boilerplate language in an engagement letter is not enough. Stripping identifying details before the AI step reduces how often that conversation is needed, though each tool and matter still needs its own judgment.
What California's 2026 guidance adds
State bars have issued their own guidance. The State Bar of California published updated Practical Guidance for the Use of Generative AI in the Practice of Law in 2026, replacing its 2023 version. It says lawyers must not input confidential client information into a generative AI solution that presents material risks to confidentiality or security without informed consent, and that marketing assurances are not enough.
The update also addresses agentic AI. Systems connected to email, document management or client files may have ongoing access to large volumes of confidential information, so lawyers must limit that access, monitor it and keep human review before anything leaves the firm. An agent that can read the whole DMS is a confidentiality decision, not an IT setting.
OCR Turns Paper Files Into Searchable, and Leakable, Data
Scanned pleadings, signed contracts, faxed medical records and photographed exhibits start life as images. OCR turns them into machine text, often stored as an invisible layer inside a searchable PDF. That text makes AI review possible, and it also makes the content easy to copy, index, log and transmit in ways a flat image never was.
OCR also makes mistakes, and those mistakes matter for privacy. A smudged scan can turn a Social Security number into a string a detector does not recognize, or split a client's name across two lines. A redaction step that only checks the OCR text can miss identifiers a human would spot instantly on the page image.
The practical answer is to run OCR in an environment the firm controls and test detection on the worst scans, not the cleanest. A guide to testing PII detection accuracy explains how to build that kind of test set.
Where Client Data Hides in Case Files
Client data is rarely confined to the obvious fields. Personal injury and employment files are full of protected health information in treatment notes and billing records. Family law files carry children's names and account numbers. Commercial disputes bury pricing, trade secrets and employee data inside email chains produced as images.
Exhibits add another layer. A bank statement attached to a motion or a scanned ID card can expose more than the pleading it supports. Federal Rule of Civil Procedure 5.2 already limits what can appear in court filings, allowing only the last four digits of Social Security and financial account numbers, the year of birth and a minor's initials. The full text is on Cornell's Legal Information Institute. A firm that applies the same discipline before AI processing, rather than only at filing, cuts most of its exposure at the source.
Redaction Failures That Still Catch Firms Out
The most common failure is cosmetic redaction. Someone draws a black rectangle over text in a PDF, but the words underneath remain in the file, and anyone can copy and paste them out. Court filings have been published this way, and the same thing happens when a redacted image sits over an OCR layer that still holds the original words.
Metadata is the second failure. Tracked changes, comments, embedded spreadsheets and file names can reveal what the visible page hides. The third is inconsistency. A witness redacted on page 4 but named in a footnote on page 37 is not protected. AI repeats these failures at scale, so verify redaction on the final rendered output.
It also helps to separate redaction from anonymization. Redaction removes information for good, which suits productions and filings. Anonymization swaps identifiers for consistent placeholders so an AI model can still follow who did what. The comparison of AI redaction and anonymization sets out when each one fits.
