Criminal defense has a data problem that civil practice does not, and it is not about volume. It is that the material is the client’s worst day, it is often protected by a protective order, and the person it describes has not consented to anything except being represented.
What the rules already require
Model Rule 1.6 covers all information relating to the representation, whatever its source, absent informed consent or an exception, and it requires reasonable efforts to prevent inadvertent or unauthorized disclosure [1]. ABA Formal Opinion 512 applies that to generative tools and reaches a conclusion worth quoting in full:
Because many of today’s self-learning GAI tools are designed so that their output could lead directly or indirectly to the disclosure of information relating to the representation of a client, a client’s informed consent is required prior to inputting information relating to the representation into such a GAI tool. [1]
The opinion then closes the shortcut most firms reach for: merely adding general, boilerplate provisions to engagement letters purporting to authorize the lawyer to use these tools is not sufficient [1]. Informed consent means telling the client what kinds of information will be disclosed and what the risk is — which means you have to know [1].
California’s committee states the rule as a prohibition: a lawyer must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed consent as to the underlying risks [2].
Now consider what that requires you to explain to a client in a custody case, a sex case, or a case with a cooperating witness.
What provider terms actually say
The commercial answer is that business tiers do not train on your data. That is broadly accurate and worth reading precisely. OpenAI’s enterprise privacy page commits that it does not train its models on your business data by default, and lists retention control as a feature of specific products rather than a property of the platform [3]. Anthropic’s consumer policy is a different document entirely: chats from its consumer plans may be used to improve the models where the user has enabled it, where a conversation is flagged for safety review, or where the user has opted in [4].
Three things follow.
A default is a setting. It is the correct setting, and it is one an administrator, an updated agreement, or a staff member with a personal account can change.
Consumer accounts are not the same contract as the enterprise agreement your office signed, and the phone in a lawyer’s pocket is usually on the consumer contract.
And retention is not entirely within the provider’s gift either. In May 2025 a federal magistrate judge, in copyright litigation to which no law firm was a party, directed OpenAI to preserve and segregate all output log data that would otherwise be deleted, going forward, whether the deletion would have happened at a user’s request or because of privacy laws requiring it [5]. Whatever the merits of that dispute, it is a clean demonstration of the structure: your data-retention posture can be changed by an order in a case you have never heard of.
The Chief Justice noted the related concern in 2023 — that entering confidential information into an AI tool might compromise later attempts to invoke legal privileges [6]. That question is still open. Open questions are not a good foundation for a protective order.
What “local” has to mean to be worth the word
“On-prem” is used loosely enough to be meaningless, so define it by what you can test:
- The weights are on your disk. The model file lives on hardware you own, in the building, and it runs there.
- Inference is local. Pull the network cable and run a case. If it still works, it is local. If it fails, something was leaving.
- No telemetry carrying content. Crash reports and usage counts are one thing; prompts, documents and outputs are another. Ask which fields are transmitted and get the list.
- Retention is yours. Logs, caches and intermediate artifacts sit on your storage, under your deletion policy and your litigation holds, not someone else’s.
- It survives the vendor. If the company disappears on a Tuesday, does the install keep working through trial?
An office that can answer those five points does not need to negotiate informed consent for the disclosure of client information to a third party, because there is no disclosure to a third party. The confidentiality analysis collapses back to the one you already run for your file server.
This is why Apodicta ships with a model and runs on hardware in the office: the guarantees are code that executes locally, so the same gates apply whether the narrative layer is the local model or a frontier model you have separately decided is appropriate for a particular task. The default is the one the duty points to.