Privilege waiver, confidential prompts and vendor reuse of client material are the strongest professional concerns. De-identification, technical isolation and proof that controls actually operated are less visible questions, but they determine whether the method provides meaningful risk reduction.
What is a "clean room" approach to AI and client data, and what problem does it solve? (isolation + data minimisation; distinguish from adtech data clean rooms)
For this guide, a clean room is a controlled method for preparing the minimum necessary client data, processing it only in an approved isolated AI environment, restricting access, retention, training and export, and recording what happened. It is not the advertising-industry meaning of a data clean room, which usually describes a platform where organisations match or analyse customer datasets for advertising or measurement. The method addresses uncontrolled disclosure, vendor reuse, cross-client leakage, unnecessary personal information and the loss of traceability that can occur when raw files are pasted into general-purpose AI services. It can reduce privilege, confidentiality, privacy and security risk, but it does not guarantee privilege will survive or make an otherwise impermissible use lawful.
- Law firm, accounting practice, consultancy or other professional adviser — Use matter-specific approval and segregated workspaces where prompts or source material may contain client confidences, legal advice, litigation material or personal information.
- Organisation already using enterprise AI — Treat the clean room as a controlled data-handling workflow layered over the approved AI platform, not as a claim that the platform is inherently safe.
The organisation's AI clean room is a data-isolation and minimisation method, not an advertising data clean room and not a guarantee of legal professional privilege. Before client material is used with AI, the approved user must confirm the purpose, remove information that is not necessary, sanitise or de-identify information where appropriate, use only the approved isolated environment, restrict access to authorised matter personnel, prevent unauthorised training or reuse, apply the approved retention period, review the output and retain evidence of the approval and controls.
Legal professional privilege — how can putting privileged material into an AI tool risk waiver, and how does isolation/minimisation reduce that risk?
Legal professional privilege protects qualifying confidential lawyer-client communications and litigation material, but the privilege belongs to the client and can be lost by consent or conduct inconsistent with maintaining confidentiality. Uploading privileged content to an AI provider can create waiver risk where the provider, its personnel, subprocessors or other users may access, retain, reuse or expose the material, although Australian law does not say that every limited confidential disclosure to any third party automatically waives privilege. A clean-room process reduces the risk by avoiding raw privileged material where possible, extracting only the minimum proposition or facts needed, segregating matters, limiting recipients and purposes, prohibiting training and human access, and controlling outputs. Whether privilege remains is fact-specific and should be assessed by an Australian lawyer with authority to act for the client; no architecture or contract can guarantee the outcome.
- Solicitor or law practice using AI on a client matter — Identify the privilege holder, the dominant purpose, the proposed recipients and uses, and whether client authority or matter-specific advice is required before any upload.
- Litigation or anticipated litigation — Also check court orders, suppression obligations, the implied undertaking governing compulsorily produced material and matter-specific practice directions.
Privileged or potentially privileged material must not be entered into an AI system unless the responsible lawyer has completed and recorded a matter-specific privilege assessment and approved the exact use. The user must use the least informative input capable of achieving the approved purpose, exclude source documents unless specifically authorised, restrict the workspace and outputs to persons entitled to the underlying material, prohibit training and unrelated reuse, and preserve the confidentiality and purpose limitations applying to the source. Client authority must be obtained where required. Approval reduces risk but does not guarantee that privilege is preserved.
Confidentiality and professional duties — what do Australian solicitors' conduct rules and professional-body guidance require when using AI?
A solicitor must deliver legal services competently and diligently, protect confidential client information, follow lawful and competent instructions, and reasonably supervise the people involved in the matter. Using AI does not transfer those duties to the vendor or model: the solicitor must understand the tool, control what is disclosed, verify outputs and remain responsible for the work. Under current Uniform Law conduct rules, confidential information cannot be disclosed outside the permitted practice team unless an exception such as client authorisation or legal compulsion applies. Federal Court guidance also warns that public tools may expose information and that even a ringfenced tool can breach obligations when its outputs are used for another purpose.
- Solicitor practising under the Legal Profession Uniform Law — Apply rules on competence, client instructions, confidentiality and supervision to the entire AI-assisted workflow, including vendor access and staff use.
- Matter before the Federal Court of Australia — Apply GPN-AI, any matter-specific orders and the Court's disclosure expectations in addition to professional conduct duties.
A solicitor remains professionally responsible for all AI-assisted legal work. Client-confidential information must not be disclosed to an AI provider, its personnel, subprocessors or another user unless disclosure is permitted by the applicable conduct rules, client instructions and law. The responsible solicitor must understand the tool's material limitations, supervise its use, verify every material proposition and source, restrict outputs to the approved purpose and ensure that AI use does not mislead a client, court, opponent or third party.
Privacy Act — how do APP 6 (use/disclosure), APP 8 (cross-border disclosure) and APP 11 (security) apply when personal information is put into an AI system?
APP 6 requires a covered entity to determine whether entering personal information into AI is the original collection purpose or a permitted secondary use or disclosure; a new AI-related purpose may require consent or another exception. OAIC treats the input as a use where the information remains under the organisation's effective control and as a disclosure where it becomes accessible outside the organisation and is released from that control. If an overseas provider or subprocessor receives it, APP 8 generally requires reasonable steps before disclosure and can leave the Australian entity accountable for the overseas recipient's conduct. APP 11 requires reasonable technical and organisational security throughout the information lifecycle, including vendor due diligence, access restrictions, monitoring, retention limits and secure destruction or de-identification when information is no longer needed.
- APP entity using client personal information in AI — Document the purpose, APP 6 basis, data flows, effective control, overseas recipients, security measures and retention before enabling the use.
- AI service with offshore hosting, support or subprocessors — Assess actual overseas access and disclosure, contractual controls and section 16C accountability rather than relying only on the location label of the primary data centre.
Personal information must not enter the AI clean room until the approved owner has documented the permitted purpose under APP 6, whether the processing is a use or disclosure, every organisation and country that may access the information, the APP 8 basis and safeguards for any overseas disclosure, and the reasonable APP 11 security and lifecycle controls. Sensitive information requires heightened assessment. Publicly available AI tools must not receive client personal information unless a documented legal and privacy assessment expressly permits the use.
Data minimisation and de-identification — what does OAIC guidance support, and where are its limits (re-identification risk)?
Minimise first: use a legal issue, abstracted fact pattern, synthetic example or selected extract instead of an entire file wherever the task permits. Removing names is only the first de-identification step; dates, rare events, locations, job titles, relationships, matter facts and combinations of attributes can still identify a person. OAIC says de-identification is contextual risk management, not an exact science, and the re-identification risk must be very low in the actual data-access environment. Environmental controls such as restricted access, matter segregation, contracts, output controls and a secure analysis setting can complement data alteration, but de-identification does not remove confidentiality, privilege, intellectual-property or purpose restrictions that protect information for reasons other than personal identifiability.
- Professional working with a single client matter — Use placeholders and generalised facts, remove direct and quasi-identifiers, and consider whether an insider or person familiar with the matter could still recognise the client.
- Rich, linked or unusual dataset — Use specialist de-identification assessment and test the actual AI environment, auxiliary data, users, outputs and foreseeable future access.
Only information reasonably necessary for the approved AI task may be used. The preparer must remove direct identifiers and assess or alter quasi-identifiers, unique facts, combinations and contextual clues. De-identification must be assessed in the actual clean-room environment, including its users, other available data, infrastructure and governance controls, until re-identification risk is very low. Information must remain classified and protected where it is confidential, privileged, proprietary or purpose-restricted even if it is no longer personal information.
Technical isolation — what recognised controls back the approach (secure enclaves / confidential computing, air-gapping, no-training-on-inputs, retention limits, access control)? Reference ACSC/ASD and NIST where possible.
Use layered isolation appropriate to the material: a private tenant or local deployment, matter-specific repositories and indexes, restricted network paths and connectors, separate keys, role-based access, MFA, DLP and controlled output channels. For the highest-risk tasks, an offline or air-gapped workflow may be appropriate, while confidential computing and trusted execution environments can reduce exposure of data while it is being processed in shared infrastructure. ASD's current ISM supports fine-grained and role-based access to AI data, prohibits model training or improvement on organisational data without informed explicit data-owner consent, and calls for secure deletion of prompts and outputs when sessions are removed. These measures do not cure bad authorisation, malicious output, prompt injection, cross-matter retrieval or endpoint compromise, so human review, content filtering, monitoring and ordinary security controls remain necessary.
- Standard confidential client work — Use an approved enterprise environment with matter segregation, no-training controls, restricted administrators, encryption, short retention, DLP, logging and controlled connectors.
- Highly privileged, restricted or exceptionally sensitive material — Consider local, offline or air-gapped processing, confidential computing with attestation, and output-only release after legal and human review.
- Organisation using retrieval-augmented generation — Enforce matter-level permissions at retrieval time, segregate vector stores and embeddings, and prevent the model from retrieving material the requesting user could not access directly.
The AI clean room must use an approved isolated environment with least-privilege role-based access, multi-factor authentication, segregated client and matter data, approved encryption and keys, restricted connectors and network egress, data-loss-prevention controls, monitored administrative access, controlled outputs and secure deletion. Organisational data must not be used to train, fine-tune or improve a model without informed and explicit data-owner approval. The highest-risk use cases must use an offline, air-gapped or equivalently isolated workflow where required by the risk assessment. Confidential computing or a trusted execution environment may be used as an additional layer, not as a substitute for authorisation and secure application design.
Vendor selection and contracts — what terms make an AI tool "clean-room safe" (data residency, no training, deletion, sub-processors, audit)?
No product is universally clean-room safe; the status should be an internal, use-case-specific approval based on the service terms, architecture, configuration and client matter. The contract and due diligence should identify every data flow, storage and processing region, remote-support location, affiliate and subprocessor, and should prohibit training, fine-tuning, model improvement and unrelated product development from prompts, files, outputs, embeddings and metadata unless specifically authorised. Require defined retention and verified deletion, encryption, access control, incident notice and cooperation, change notice, export and exit rights, audit or assurance rights and flow-down of the same protections to subprocessors. Australian residency is useful but not conclusive where overseas personnel, subprocessors or foreign legal powers can access the information.
- Law practice buying a legal AI platform — Review privilege and confidentiality terms, human support access, matter segregation, model and retrieval architecture, output ownership and the provider's right to reuse anonymised or derived data.
- APP entity using an overseas provider — Use APP 8-compliant contractual and oversight controls and identify each country and subprocessor that may receive or access personal information.
An AI service may be approved for clean-room use only after documented legal, privacy and security due diligence and execution of suitable contract terms. The agreement must identify data locations and flows, all subprocessors and remote-access locations; prohibit unauthorised training, fine-tuning, model improvement and secondary use; define retention, backup and verified deletion; require encryption, matter segregation, access control, incident notification and cooperation; flow obligations to subprocessors; provide change notice, data export and termination assistance; and give the organisation meaningful rights to verify compliance. Approval is limited to the recorded use cases and data classes.
What the clean room is NOT — its limits, and what it does not replace (legal advice, consent, client instructions, a security program).
A clean room is not a privilege guarantee, blanket client consent, Privacy Act exemption, accuracy control or permission to ignore court restrictions and professional duties. It does not turn an unauthorised purpose into an authorised one, and client consent may be required without being sufficient to resolve every legal issue. It also does not make de-identified content free of confidentiality or cross-matter restrictions, and a ringfenced system can still misuse or reveal information through its outputs. The method must sit inside a wider security, privacy, records, incident-response, vendor-management and professional-supervision program, with legal advice for high-risk or uncertain uses.
- Client or matter with special confidentiality, privilege or court restrictions — Treat the clean room as one control and obtain specific legal advice and client instructions before using the material.
- Approved enterprise or locally hosted AI — Continue to apply purpose limits, human verification, output restrictions, access review, incident response and ordinary cyber-security controls.
Clean-room approval does not guarantee legal professional privilege, confidentiality, privacy compliance, accuracy or freedom from security incidents. It does not replace client instructions or consent where required, matter-specific legal advice, court orders and undertakings, professional judgment, human verification, records obligations or the organisation's security and privacy program. A use must be refused where the lawful purpose, authority, residual risk or available controls are inadequate, even if the proposed AI tool is otherwise approved.
Evidence and governance — how do you prove the clean room actually operated (logs, records, DLP, approvals, review)?
Maintain an approved-use-case and matter register showing the purpose, data owner, privilege and privacy assessment, permitted users, platform, model, configuration, region, retention and output restrictions. Preserve vendor due diligence and contracts, configuration evidence for no-training and access controls, data-preparation and de-identification records, access reviews, DLP events, administrative logs, output-review sign-off, deletion evidence, exceptions and incidents. Logging must itself be designed safely: raw privileged prompts should not be copied into a less protected monitoring system merely to prove the control, so metadata, secure hashes, sealed records or restricted privileged logs may be more appropriate. Reassess vendors, configurations, models and use cases regularly and after a material change, incident or new legal requirement.
- Professional practice operating matter-specific clean rooms — Tie each approval, workspace, user, prompt record, output and deletion event to the client and matter without exposing raw content to broader administrators.
- Organisation subject to audit or privacy assurance — Map each policy promise to configuration evidence, logs, tests, contract terms, access reviews, corrective actions and management review.
The Clean Room Owner must retain evidence of the approved purpose, client or data-owner authority, privilege and privacy assessment, data classification and minimisation, approved platform and model, security configuration, data location, no-training setting, authorised users, access reviews, DLP and monitoring results, output verification, retention and deletion, vendor assessment, contract, exceptions, incidents and periodic review. Evidence must be protected to the same level as the underlying matter. Raw privileged prompts must not be duplicated into general logging systems where metadata, hashes or a restricted evidentiary record can prove operation with less exposure.
What's my next step?
Common misconceptions
- This methodology is the same thing as an advertising data clean room used to match customer datasets. VERIFIED
- Using an enterprise, private or locally hosted AI product automatically guarantees that legal professional privilege is preserved. INFERRED
- Every voluntary disclosure of privileged material to any third party necessarily waives privilege. VERIFIED
- A vendor promise not to train its base model means the vendor cannot retain, inspect, disclose, derive value from or allow subprocessors to access prompts and outputs. INFERRED
- Removing names and addresses always makes a client file de-identified under the Privacy Act. VERIFIED
- Australian data residency alone prevents APP 8 from applying and removes all foreign access risk. INFERRED
- Client consent by itself guarantees privilege, satisfies every Privacy Act requirement and permits use despite court orders or purpose restrictions. INFERRED
- Confidential computing, a secure enclave or an air gap guarantees that confidential information cannot leak. INFERRED
- Once privileged information is entered into a ringfenced model, its outputs may be reused freely for another client or purpose. VERIFIED
- De-identification removes contractual confidentiality, legal professional privilege, intellectual-property rights and implied-undertaking restrictions. INFERRED
- A clean room replaces matter-specific legal advice, client instructions, human verification and an organisation-wide security and privacy program. VERIFIED
- A vendor certification or security questionnaire proves that the clean-room controls operated for a particular prompt, matter and output. INFERRED
- A local model is automatically safe even if access permissions, source data, connectors, logs and outputs are poorly controlled. INFERRED
Obligations at a glance
The obligations most relevant to this guide, with the regulator, the trigger and the timeframe. Follow the source links in the appendix for the authoritative wording.
| OBLIGATION | REGULATOR | TRIGGER | TIMEFRAME | PENALTY |
|---|---|---|---|---|
| Client legal privilege for legal advice and litigation material | Federal courts applying the Evidence Act 1995 and courts in participating uniform-evidence jurisdictions | A party seeks to adduce qualifying confidential lawyer-client communications or documents made for the dominant purpose of legal advice or litigation. | Assess before disclosure to an AI service and throughout any later use or disclosure of prompts, source material and outputs. | |
| Privilege waiver or loss through inconsistent disclosure | Australian courts | The privilege holder consents to disclosure or acts inconsistently with maintaining the confidentiality protected by legal professional privilege. | Before any third-party disclosure or cross-purpose use, including proposed AI processing. | The legal consequence may be loss of privilege over the disclosed communication or related material; the outcome is fact-specific. |
| Solicitor confidentiality, competence and supervision duties | Legal Services Council and relevant state or territory legal profession regulators | A solicitor or law practice uses or supervises AI in delivering legal services or handling confidential client information. | Ongoing throughout the engagement and AI-assisted workflow. | Unsatisfactory professional conduct or professional misconduct consequences may apply depending on the breach and jurisdiction. |
| Federal Court GPN-AI obligations and expectations | Federal Court of Australia | A person uses generative AI in connection with a Federal Court proceeding or material filed with or sent to the Court. | Before and throughout use, with disclosure when the Practice Note or Court requires it. | Potential consequences include adverse costs orders and issues concerning compliance with legal and professional obligations. |
| APP 6 permitted use or disclosure | Office of the Australian Information Commissioner | An APP entity proposes to use or disclose personal information by inputting it into or generating it through an AI system. | Establish the primary-purpose basis or an APP 6 exception before the use or disclosure and reassess if the purpose or data flow changes. | |
| APP 8 cross-border disclosure | Office of the Australian Information Commissioner | An APP entity discloses personal information to an overseas AI provider, affiliate, support team or subprocessor. | Take reasonable steps before disclosure and maintain oversight while the overseas recipient handles the information. | |
| APP 11 security and lifecycle protection | Office of the Australian Information Commissioner | An APP entity holds or controls personal information in an AI workflow, including through a service provider. | Ongoing throughout collection, preparation, input, processing, output, storage, access, retention and destruction or de-identification. | |
| ISM organisational-data training restriction | Australian Signals Directorate, Australian Cyber Security Centre | An organisation applies ISM control 2103 to organisational data generated, collected or processed by AI applications. | Obtain informed and explicit data-owner consent in advance of any training, fine-tuning or model-improvement use. | |
| ISM secure deletion of AI chat prompts and outputs | Australian Signals Directorate, Australian Cyber Security Centre | An organisation applies ISM control 2123 and removes AI chat sessions. | Securely delete all associated prompts and outputs when the chat session is removed. |
Sources
- Evidence Act 1995 primary
- Mann v Carnell [1999] HCA 66 primary
- Mann v Carnell reasons for judgment primary
- Legal Profession Uniform Law Australian Solicitors' Conduct Rules 2015 primary
- Use of Generative Artificial Intelligence Practice Note (GPN-AI) primary
- Law Council submission: Artificial intelligence use in the Federal Court of Australia primary
- Law Council submission on generative AI in Fair Work Commission cases primary
- Guidance on privacy and the use of commercially available AI products primary
- Chapter 6: APP 6 Use or disclosure of personal information primary
- Chapter 8: APP 8 Cross-border disclosure of personal information primary
- Chapter 11: APP 11 Security of personal information primary
- De-identification and the Privacy Act primary
- Engaging with artificial intelligence primary
- AI data security primary
- Deploying AI systems securely primary
- Guidelines for software development primary
- Guidelines for procurement and outsourcing primary
- Information Security Manual (June 2026) primary
- NIST IR 8320: Hardware-Enabled Security primary
- Data Collaboration Platforms Explainer primary
- Am I going crazy or? forum
- English as a Second Language in a workplace forum
- Accidentally shared sensitive info and this triggered IT alert forum
- How often do you use ChatGPT for work? forum
- Auscorpers - can we admit the computers have taken over! forum
- Honestly sick to my stomach about AI as a Software Engineer forum
- I use AI for basically everything I do at work forum
This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.