Skip to content

Professional secrecy and AI: what a lawyer can entrust to a tool

Professional secrecy does not stop at the door of a piece of software. Before entering a file into an AI tool, here is what the texts and the Barreau du Québec require.

Updated · By the Jurisync team

Key points

  • Professional secrecy is a fundamental right (Charter, s. 9) and it is absolute for lawyers (Act respecting the Barreau du Québec, s. 131): only the client or an express provision of law can release them from it.
  • According to the Barreau's guide, entering confidential information into an open AI system is a breach, even if nothing is actually disclosed.
  • A closed system under the firm's control reduces the risk; anonymizing and reading the terms of use remain necessary.
  • Lawyers answer for their collaborators and for the tools they give them (ss. 5, 35 and 61 of the Code of ethics).

What the texts say

  • Charter of human rights and freedoms, s. 9: everyone has a right to non-disclosure of confidential information; professionals may not disclose it without the client's authorization or an express provision of law, and the court must ensure this of its own motion.
  • Act respecting the Barreau du Québec, s. 131: lawyers must keep absolutely secret the confidences they receive; they are released only by the client, expressly or implicitly, or by an express provision of law.
  • Code of ethics of advocates, s. 60: lawyers preserve the confidentiality of all information about the client. S. 61: they take reasonable means so that their collaborators and the firm preserve it. S. 65: the exceptions, including the client's express or implied authorization.

Open system or closed system

The Barreau du Québec's guide to generative AI distinguishes two situations. An "open" system is publicly accessible and data is not kept in-house: entering information protected by professional secrecy into it is a breach, even if no one reads it.

A "closed" system under the firm's control reduces the risk. The guide still recommends anonymizing what can be anonymized and reading the tool's terms of use: who keeps the data, where, for how long, and whether it is used to train a model.

Precautions before using a tool

  1. Read the tool's terms of use and privacy policy.
  2. Know where data is processed and stored, and whether it is used for training.
  3. Prefer processing on the firm's own computer or server for client files.
  4. Remove or mask names, numbers and other identifying details before anything is sent outside.
  5. Obtain the client's informed consent when AI touches their information, and record it.
  6. Check every answer and every source before using it.
  7. Keep a record of prompts and checks.

If personal information is involved, Law 25 adds its own obligations: see our guide to Law 25 and artificial intelligence.

Students, assistants and firm policy

Lawyers take reasonable means so that their collaborators comply with their duties (s. 5) and supervise those working on the mandate (s. 35). A written policy on which AI tools are allowed, and for what, is the simplest way to show it.

The Barreau's guide also notes that the professional liability insurance policy did not cover claims arising from breaches of confidentiality, and that the policy changed on April 1, 2026. Check your coverage with the insurer.

Jurisync's approach

Jurisync starts from one rule: nothing that identifies a client leaves the firm without your decision. In private mode, the AI runs on the firm's own computer or server and nothing is sent. Your files are never used to train a model, and our teams have no access to them, neither for updates nor for support.

Frequently asked questions

Is the client's consent enough to use any tool?

The client can release the lawyer from secrecy, but consent does not replace competence, prudence or Law 25's obligations. Choosing the tool remains the lawyer's responsibility.

Does anonymizing a file settle the secrecy question?

It greatly reduces the risk, if the anonymization is real. In a file, specific context (dates, places, amounts) can be enough to identify a client; that is why local processing remains the safest route for files.

Is a tool hosted in Canada risk-free?

No. Where it is hosted matters, but so does what the provider does with the data, who can access it and what the contract says. Outside Québec, Law 25 also requires a PIA.

Sources

Official texts consulted for this guide. Always check the version in force.

  1. Charter of human rights and freedoms, CQLR c C-12, s. 9
  2. Act respecting the Barreau du Québec, CQLR c B-1, s. 131
  3. Code of ethics of advocates, CQLR c B-1, r 3.1
  4. Barreau du Québec, generative AI practical guide (in French)
  5. Canadian Bar Association, Ethics of Artificial Intelligence for the Legal Practitioner

This guide provides general information. It is not legal advice. Compliance remains each firm's responsibility.