Before you start
This course gives general information. It is not legal advice. Your regulator's rules and your employer's policy always come first.
In Level 1 you saw what AI can and cannot do in legal work. This level covers the question to ask before you use any tool: am I allowed to use this tool, and in this account? Two people can use the same chatbot, one through a firm-managed enterprise account and one through a free personal login. The two accounts can handle data in very different ways. For a lawyer, that difference matters more than which product you pick.
Think of a client account and your personal bank account. You can take money out of both, but only one has the firm's controls, audit trail and contract behind it.
Task 1: Find your workplace AI policy
Do this first, before you open any AI tool for work.
- Search the intranet or staff handbook for 'AI', 'generative AI', 'acceptable use' or 'technology policy'. In chambers, look in the chambers handbook or ask the senior clerk.
- Check the IT and information security policies. AI rules are often placed there instead of in a separate document.
- Ask the right person if you cannot find anything. That may be your supervisor, the COLP, the risk or compliance team, the head of chambers or in-house legal operations.
- Do not take silence as permission. If there is no policy, the safe answer is 'not yet approved'.
Task 2: Read the policy and record five things
Open a note and write down the following:
- Permitted tools: the exact product and account type, for example 'Microsoft Copilot Chat signed in with your work account'. 'Copilot' on its own is not specific enough.
- Prohibited uses: for example, no client names in tools that are not approved, no uploading court bundles, no drafting that is filed without review.
- Approval route: who decides whether a new tool is allowed, and how to ask.
- Verification and supervision rules: who must check AI output, and how.
- Disclosure rules: whether you must record or tell anyone when you have used AI.
If an item is missing from the policy, write 'not stated' next to it. That is a question to raise with your supervisor or IT team.
Task 3: Tell consumer and enterprise accounts apart
The summary below comes from the vendors' help pages as of October 2026. Settings change, so check the current pages yourself before relying on it.
ChatGPT (OpenAI)
- Consumer (personal Free, Plus or Pro accounts): chats can be used to improve models unless you switch off 'Improve the model for everyone' under Settings > Data Controls. Temporary Chats are not used for training and are deleted from OpenAI's systems after 30 days.
- Business and Enterprise: OpenAI states that it does not train on business data by default. Enterprise owners can set custom retention (minimum 90 days).
Gemini (Google)
- Personal Google account: when Keep Activity is on, Google may use your activity to improve its services, including training generative AI models. A subset of chats is read by human reviewers, and reviewed chats are kept for up to three years. With Keep Activity off, chats are kept for 72 hours.
- Work account (Google Workspace): different terms apply. Google states that Gemini in Gmail, Docs, Drive and other Workspace apps does not use your content to train models.
Claude (Anthropic)
- Consumer (Free, Pro, Max): you choose whether chats are used for training. If you allow it, retention is five years. If you do not, it stays at 30 days.
- Claude for Work, Enterprise and the API: covered by Anthropic's Commercial Terms. The consumer training choice does not apply to them.
Microsoft Copilot (formerly Microsoft 365 Copilot)
- Signed in with a work account: enterprise data protection applies. Prompts and responses are covered by Microsoft's Data Protection Addendum and are not used to train foundation models.
- Watch out: web search queries sent to Bing are handled under separate Microsoft terms. A personal Microsoft account is a consumer service.
The lesson: switching off a training setting on a personal account does not make it an approved firm tool. It still has no firm contract, no admin controls and no audit trail.
Task 4: Check which account you are actually using
- Look at the profile icon. Is it your work email or your personal email?
- In Copilot, check that you are signed in with your work account and that the enterprise data protection notice appears.
- In ChatGPT, Gemini or Claude, open Settings and check the plan or workspace name.
- If you are not sure, stop and ask IT before you paste anything work-related.
Task 5: Ask whether a tool is approved
If a tool is not on the approved list, ask before you use it. Adapt this template:
Subject: Approval query: [tool name and plan]
Hi [name], I'd like to use [tool, e.g. Claude Team via a firm workspace] for [task, e.g. first drafts of internal research notes, with no client-identifying information]. Could you confirm: (1) whether it is approved, (2) which account type I should use, and (3) any restrictions on the data I can enter? I've read [policy name, date]. Thanks, [name]
Keep the reply. It is your record that you checked.
Checklist before using any AI tool for work
- I have found and read the current AI policy
- The tool and the account type are on the permitted list
- I am signed in with my work account, not a personal one
- My task is not on the prohibited list
- I know who checks the output
- If anything is unclear, I have asked in writing
Try it on your own work
This week, find your organisation's AI policy, record the five items from Task 2, and send one approval query for a tool you would like to use.
Key takeaways
- No policy found does not mean permission. Ask before you use.
- The account type matters as much as the brand. Consumer and enterprise versions of the same tool handle data differently.
- Consumer training settings reduce risk but do not make a tool approved.
- Vendors' terms change, so check the current help pages and date what you rely on.
- Ask in writing and keep the reply as your audit trail.