General counsel and their teams at large firms are becoming less willing to let AI vendors learn from firm data, even when the data is anonymized and aggregated. In the conversations I've had with firm counsel this year, the direction has been consistent. The middle ground that looked reasonable in 2024, where a vendor could use de-identified data to improve its product, is becoming hard for them to accept.
The way some counsel describe it, the industry spent a decade moving everything to the cloud, and the most sensitive work is now moving back under the firm's direct control. The reasons are practical. Breach risk has grown, vendors' appetite for data has grown with it, and the firm is the party that answers to the client when something goes wrong.
Why "anonymized and aggregated" stopped reassuring anyone
A firm's documents carry more than names. They carry the positions the firm has taken, the terms it has negotiated, how it structures a deal for a particular kind of client, and how it has argued a particular kind of case. Taking the client's name off a merger agreement doesn't take out what the firm learned drafting it. That know-how is exactly what makes a vendor's model better, and it's also the most valuable thing the firm has built.
A firm that lets a vendor learn from that material is contributing its judgment to a product its competitors can license too. Every document processed and every correction a lawyer makes improves somebody's system. Counsel are asking, reasonably, whose.
The ethics rules point the same way
ABA Formal Opinion 512 addresses tools that learn from what users put into them. It says a client's informed consent is required before information relating to the representation goes into a generative AI tool that learns from the information users give it, and that boilerplate consent won't suffice (summary in The Bar Examiner). A large firm has thousands of clients. Collecting specific, informed consent from each of them for every tool that might learn from matter data isn't realistic. The workable answer is to use AI that doesn't learn from client information outside the firm's control.
Clients' written rules are behind their conversations
If you read only outside counsel guidelines, you might conclude clients don't care yet. A September 2026 study by Fulkerson Advisors reviewed 1,054 publicly available outside counsel guidelines written since ChatGPT launched and found 20 that mention AI. Of those 20, nine require that the client's information stay out of public AI tools, and twelve require the firm to disclose when AI was used (Fulkerson Advisors).
The conversations are further along than the documents. One innovation officer described clients moving, within six months, to "we need you to do it and we need you to do it safely" (Bressler Risk Blog). Clients increasingly expect firms to use AI, and they expect the firm to be able to say exactly where their information went. A firm that waits for the guidelines to catch up will meet these questions first in security questionnaires and RFPs.
What bringing AI back inside the firm looks like
- Models run under terms the firm controls. Either in the firm's own cloud or under enterprise terms that prohibit the provider from training on, retaining or reviewing the firm's inputs.
- What the firm teaches its AI stays with the firm. The corrections lawyers make, the positions the firm confirms, and the structured knowledge built from its documents live in systems the firm owns and can take with it.
- Vendor access is the exception, and it's recorded. Support access happens by invitation, for a defined purpose, with a record of who did what.
- The firm can show its work. The CIO can tell a client which systems touched their matter and under what terms.
None of this means giving up capable models. The major cloud platforms offer leading models under terms that exclude customer prompts and outputs from training. Microsoft, for example, states that prompts and completions sent to the models it sells through Azure are not used to train foundation models (Microsoft Learn). A firm's engineers can build on those models inside the firm's own environment. The real decision is where the firm's own knowledge accumulates, and who can see it.
Questions to put to every AI vendor this quarter
- Do you train, fine-tune or evaluate any model on our data, including anonymized or aggregated data? Put the answer in the contract.
- What exactly does the product-improvement clause let you do with what our lawyers type and correct?
- Where do prompts, outputs and logs live, for how long, and who at your company can read them?
- Can your staff reach our environment or our data, and how is that access approved and recorded?
- Can you change these terms without our agreement, and how much notice do we get?
- If we leave, what do we take with us, and in what format?
I go deeper on the contract side in The firm's knowledge is the asset. Who holds it matters., and on vendor diligence in The SOC 2 questions legal AI vendors hope you skip.
Where the CIO fits
This shift lands on the CIO's desk, and it's an opening for IT. Counsel can say what the firm won't accept. IT is the team that can build the environment where AI runs under the firm's control. The practical sequence is to sort the firm's AI tools by how they handle data, move the most sensitive practices to closed environments first, agree on a consent approach with the general counsel, and tell key clients what the firm is doing before they ask.
How Reframe handles this
We deploy Reframe inside the firm's own cloud environment. We don't train models on a firm's data. What the firm's lawyers correct and confirm is kept in systems the firm owns, and the firm's own team can review what the system did and why. Our engineers reach the environment only when the firm grants access.
Counsel at large firms want AI running where the firm can see it, govern it and keep what it learns. That's a reasonable request, and the firms that meet it will be the ones clients trust with more of their work.
Drafted with Reframe Editorial Agent, an AI employee at Reframe. 