I work in the AI space, and the rate of change over the past few months has been incredible. I believe artificial intelligence will change the face of legal practice in New Zealand. Used with appropriate privacy and data safeguards, it is an extraordinary tool.
Reading The Last Economy by Emad Mostaque has sharpened my thinking about what that change might mean. The book explores how increasingly accessible machine intelligence could reshape work and economic value. Its predictions are bold, but we do not need to agree with every forecast to take the implications seriously.
For me, two questions stand out. How do we protect the information clients entrust to us? And how do we develop the legal judgement needed to recognise when AI gets something wrong?
The opportunity for legal work
AI can help organise information, prepare initial drafts, compare documents and explore issues for further research. With appropriate review, it can reduce time spent on routine tasks and create more capacity for advice, negotiation and understanding what a client actually needs.
That potential is exciting. Faster production, however, is only useful if the resulting work is accurate, relevant and handled appropriately. The quality of the process matters as much as the polish of the output.
AI and the Privacy Act 2020
The Office of the Privacy Commissioner’s AI guidance makes clear that the Privacy Act applies to the use of AI involving personal information. For legal practices, privacy considerations sit alongside duties of client confidentiality and questions about protecting legal professional privilege.
Before using a tool with client information, we need to understand where the data goes, who can access it and what they are permitted to do with it.
That includes considering whether Information Privacy Principle 12, which concerns overseas disclosures, is triggered. A key distinction is whether an overseas AI provider acts solely as an agent storing or processing personal information on our behalf, or also uses or discloses it for its own purposes. In the former situation, IPP 12 generally does not apply to that transfer. In the latter, its application needs to be assessed. Calling a business a “service provider” does not settle the question: the agreements and actual practices matter. The Privacy Commissioner’s IPP 12 guidance explains this distinction.
Either way, there is still work to do to assess privacy, security and confidentiality.
Read the agreements and follow the data
Meaningful AI vendor due diligence requires looking beyond a product’s headline assurances. The relevant documents may include the service agreement, privacy policy, data processing agreement, security commitments and sub-processor terms, as well as the settings available under the particular subscription.
The questions I would want answered include:
Use and access: Can prompts, uploaded documents or outputs be used for model training, product improvement or other purposes? Who can access them, including for support or monitoring?
Location: Where is information stored, processed and accessed? A storage location alone may not explain the full flow of data.
Sub-processors: Which other providers handle the information, and what do they do? Can that list change, and what notice or options do we receive?
Contractual commitments: If a provider promises that it alone will process the information, is that reflected in the contract and service design? If it uses sub-processors, I would seek obligations at least as protective as the relevant commitments made to us, with clear accountability for their performance.
Retention and deletion: How long are prompts, files, outputs and logs kept? What happens to backups, and what does deletion mean in practice, including when the relationship ends?
Follow-through: How are commitments verified, changes communicated and incidents handled? Who in the practice is responsible for keeping the assessment current?
These are practical questions about whether we can rely on the service for the information and work we propose to put through it.
Client expectations and procedural confidence
Clients may welcome greater efficiency while also expecting clarity about how their information is handled. We should be able to explain our use of AI in plain language and identify when a particular use calls for a discussion with the client.
I also want procedural confidence: confidence that there is a considered process behind the result. That means knowing which tools are approved, what information may be entered, what must be checked, who reviews the work and when an issue needs to be escalated.
A policy has limited value if it does not shape everyday practice. The process needs to be understood and followed, then revisited as the tools and their terms change.
Knowing when AI is wrong
My other concern is professional capability. These tools can produce work that sounds persuasive, but using them well requires enough understanding to recognise an error, an omission or a conclusion that does not fit the circumstances.
An answer might refer to a real case but misapply it. It might overlook an exception, use the wrong jurisdiction or omit a procedural step. Checking that a citation exists is only one part of evaluating the answer.
This is a challenge for lawyers at every level. For junior lawyers, it also raises a question about how that ability is acquired. Researching an unfamiliar issue, working through authorities and revising a draft after feedback are part of learning to reason as a lawyer.
How will junior lawyers develop judgement?
If AI reduces the foundational work traditionally given to junior lawyers, or the number of junior opportunities available, we need to consider how the next generation will gain that experience.
Simply requiring “human review” leaves an important question unanswered: does the reviewer have the knowledge, time and support needed to identify a problem?
Firms could deliberately preserve opportunities for juniors to form their own initial view, explain their reasoning and compare it with an AI output. Supervised exercises could require them to check primary sources, identify missing facts and explain why a plausible answer is wrong. Involvement in client discussions and feedback from experienced lawyers would help connect that analysis to the decisions clients face.
AI can also support learning when used in a structured way, for example to generate alternative arguments for a junior lawyer to test. The educational value lies in the reasoning and feedback that follow.
I remain enthusiastic about what AI can make possible. Its benefits will depend on the care we take with client information, the processes supporting its use and the people whose judgement clients rely on.
If AI takes over more of the work through which junior lawyers traditionally learn, how will we develop the judgement we expect them to exercise?