Which AI Assistants Are Architecturally Safe for Client-Confidential Work in Law and Accounting

AI assistants for client-confidential work in law and accounting should be judged by architecture alongside their features and privacy promises. On-premise deployment does the most to keep data away from third parties, while enterprise cloud tools rely on protections that can be enforced and data flows that have been checked. For a tool to be usable, it must keep inputs out of training, keep client information separate, and support access controls and accountability.

Why law and accounting firms face a confidentiality problem that general AI guidance does not solve

A junior associate pastes a merger agreement into a public chatbot to get a quick summary. The document includes confidential financial data, trade secrets, and privileged communications. The summary arrives, but the information has crossed a boundary. Sharing privileged material with a third party that does not do enough to protect confidentiality can weaken attorney-client privilege even if no breach follows.

For accountants, the same action intersects with a different set of duties. IRC Section 7216 imposes criminal penalties on preparers who disclose return information without proper client consent. The FTC Safeguards Rule under GLBA, IRS Publication 4557, the AICPA Code of Professional Conduct, and state accountancy rules also shape how firms protect client information. Professional confidentiality has no AI carve-out. A convenient interface does not lower the obligation attached to the information entered into it.

Yet adoption has outrun governance inside firms. Without a sanctioned option, staff can turn to personal ChatGPT accounts and free browser extensions without an installation or IT ticket. The exchange looks like conversation rather than file transfer, so traditional file-transfer controls may not detect it. That makes shadow AI particularly dangerous in these professions. General advice about avoiding sensitive prompts leaves unresolved which systems staff can actually use when sensitive information is the work itself.

How the courts and regulators moved from guidance to enforceable consequence in 2026

United States v. Heppner made tool choice legally consequential in 2026. Judge Jed S. Rakoff ruled that documents the defendant generated through a third-party AI tool were not protected by attorney-client privilege or the work product doctrine. The court looked only at publicly available AI platforms that had no explicit confidentiality covenants. That limit is important to the comparison. The ruling left open whether a tool that specifically promises confidentiality would support a different outcome rather than deciding that all AI use defeats privilege.

A second 2026 ruling brought the distinction into eDiscovery. The court granted defendants’ request for an amended protective order, permitting only closed AI tools. Judicial scrutiny therefore reaches beyond whether information has demonstrably leaked. It can reach the conditions under which information was shared. A reasonable expectation of confidentiality depended in part on the tool’s terms and handling of data.

ABA Formal Opinion 512, issued July 29, 2024, sets out the professional duties behind that scrutiny. It applies duties including competence, confidentiality, supervision, fees, and candor to AI use, and requires lawyers to research provider terms and policies before submitting confidential information. Retention and training are central questions. The opinion also requires informed client consent before representation information goes into a self-learning AI tool, and boilerplate engagement-letter language does not meet that requirement.

State guidance adds obligations without creating a blanket enterprise-contract exemption. Pennsylvania requires firms to tell clients about AI’s benefits, risks, and limits, and to get consent before using certain tools. New York’s proposed S2698 would require an AI-disclosure affidavit for covered court filings. These developments do not all create the same legal requirement. Together, however, the rulings and guidance move the question from whether a firm should have a policy to whether it can demonstrate that its tool’s architecture supports confidentiality.

What "architecturally safe" actually means — the technical criteria that determine whether a tool is usable for confidential work

An architecturally safe system limits what can happen to client information through its design. A no-training commitment addresses one use of that information, but does not establish where processing occurs, who can access inputs, or how long records survive. Those are separate properties. Enterprise contracts can change what a provider is allowed to do while leaving the architecture as it is.

Zero data retention, or ZDR, means the AI vendor keeps no record of an interaction once the response is returned. It removes vendor-side retention exposure, but does not protect data in transit, control endpoint risks, or create an audit trail. Encryption and access controls remain necessary. A firm also needs to know which layer provides ZDR, because a commitment from an underlying model provider does not by itself describe every system between the user and that provider.

Isolation has both an external and an internal dimension. A virtual private cloud can separate workloads, but VPC isolation is not sovereignty, since the US CLOUD Act applies to American cloud providers regardless of server location. Inside the firm, a proprietary assistant can still cross ethical walls if information is not isolated by client engagement. Firm-only does not mean client-isolated. An update that turns on embedded AI in an approved SaaS product can also change where data goes, under terms the firm did not review when it approved the product.

For the strictest requirements, inference can run on open-weight models on hardware inside the firm’s WAN or LAN without an outbound internet call. Ollama and Jan make that deployment operationally possible, although local deployment still requires security management. It is not the only position on the spectrum. Consumer-tier tools give no confidentiality guarantees, enterprise cloud platforms process data in the cloud under protections set out in contracts, and on-premise deployment keeps data away from third parties when it is properly contained.

Which AI assistants can lawyers and accountants use with sensitive client information?

Harvey is an enterprise cloud tool for large law firms and enterprise legal departments. It does not train on customer inputs, and its certifications include SOC 2 Type II and ISO 27001. Its infrastructure runs on Azure. That separates its protections from consumer-tier use without making it an on-premise or sovereign option, because CLOUD Act jurisdiction remains relevant. Certifications and no-training terms also do not, by themselves, answer every question about retention or ethical walls.

Thomson Reuters CoCounsel Legal combines professional AI with Westlaw and Practical Law content. That integration addresses a legal-research gap a general-purpose assistant does not fill. Its protections include SOC 2 Type II, ISO 27001, and encryption in transit and at rest through Thomson Reuters infrastructure. It remains a hosted cloud product. No on-premise deployment option is indicated in the supplied information, so its research strengths should not be mistaken for a different data-exposure model.

GC AI serves in-house counsel through a cloud-hosted architecture with no training on customer prompts, documents, or outputs. It uses SOC 2 Type II and SOC 3 certified infrastructure, AES-256 encryption, and ZDR agreements with underlying model providers wherever feasible. The agreement must cover the provider and processing path the firm actually uses, so the firm needs more than proof that some ZDR agreements exist. These protections distinguish it from consumer tools, but do not remove cloud jurisdiction exposure.

Microsoft 365 Copilot’s general tier is a different product from the legal assistants integrated into it. Its core experiences operate within Microsoft’s service environment, but prompts leave the tenant boundary for processing, and OpenAI-operated infrastructure outside Azure is enabled by default as a subprocessor for eligible tenants as of July 2026. It does not use customer data for model training. However, the general tier does not provide legal research content, legal-grade ZDR agreements with underlying model providers, or matter-level isolation.

Harvey launched as an agent inside Copilot and a plugin for Copilot Cowork on June 16, 2026, while CoCounsel also integrates with Copilot. Deploying a legal-specific integration is therefore architecturally different from using Copilot’s native assistant for legal work. A firm looking at either integration needs to check the terms and data flow for that setup, because it cannot assume the host interface supplies every protection.

AirgapAI sits at the on-premise end of the spectrum. Privileged documents stay inside the firm’s network, with no third-party cloud infrastructure and no outbound network call. That removes the risk of a vendor keeping the data and of those transfers bringing it under a cloud provider’s jurisdiction. The trade-off is operational and security management overhead. Its approach is particularly relevant to firms with strict sovereignty requirements, including those operating under EU or other non-US regulatory regimes.

Confidant uses privacy-preserving architecture to do confidential work while keeping user data away from third parties. Its stated principles are no collection, no monetization, and no training on inputs. Privacy is built in rather than added by contract. That approach addresses whether confidentiality is protected after Heppner through how the system handles information as well as what its terms allow. The description does not establish every detail of access control or auditing, so those remain separate questions rather than protections to infer from the privacy model.

What voice AI and meeting notetakers add to the architectural risk picture

A professional may choose which document to have processed, while an auto-joining notetaker can join every meeting on the calendar once it is installed. It can capture litigation exposure, personal financial distress, or M&A plans without a fresh decision to share each disclosure. The input is spontaneous and difficult to retract. Many voice and notetaking apps send live audio and recordings through shared public servers, which puts that information outside the firm’s control.

The duty of confidentiality applies to audio too. Handing personal data to a vendor does not transfer the firm’s responsibility, and a compromised open cloud server can leave the firm facing the consequences. Treating a transcript as an administrative convenience therefore understates what has been disclosed. A private voice setup keeps client audio in an environment that the firm controls. Whether the data leaves that environment remains relevant for both notetakers and assistants.

How to evaluate any AI tool against the architectural criteria before deploying it for client work

The practical evaluation should proceed through four sequential gates, beginning with whether client data leaves the firm’s environment. Consumer-tier tools send it out with no confidentiality guarantees, while enterprise cloud platforms send it out under contract. On-premise deployment can keep it inside. Before looking at features, the firm should find out where processing takes place, because every later question depends on who gets the information. Passing this gate does not substitute for the remaining three.

The second gate concerns the terms of service and underlying model agreements. The firm should check no-training provisions, what is kept after processing, breach notification terms, and data residency. Provider layers must be examined separately. The firm needs to understand the agreements that govern the LLM providers that get client information, even when the vendor has a privacy statement. For lawyers, the ABA opinion makes researching these policies part of competent use before confidential information enters the tool.

The third gate is matter-level isolation and role-based access. Can information from one client engagement become available to someone working on a conflicted engagement? ZDR does not answer that question. The firm should establish whether technical access controls enforce ethical walls rather than assuming that a firm-wide account provides adequate separation. Even a system that keeps all data inside the network can fail this test of confidentiality within the firm.

The fourth gate is a defensible audit trail. Courts, regulators, or clients may ask how AI was used on a particular engagement, and the firm needs documented records that support its answer. ZDR at the vendor does not create those records for the firm, and the supplied information does not establish a universal New York logging requirement. The firm must be able to explain its conduct regardless of what an unspecified future rule might require.

A written policy needs technical enforcement behind it. The notes recommend controls that limit access to public AI tools through the network, watch for confidential information leaving the environment, and give staff an approved alternative that is easy to use when a deadline is near. Leadership’s diagnostic is whether it could give a client or opposing counsel a clear account of AI use on their engagement. For the strictest requirements, only on-premise or privacy-by-architecture approaches such as Confidant’s can clear all four gates without relying on contractual assurances for third-party confidentiality, provided their isolation, access controls, and audit capabilities are also established.