Ask any managing partner whether the firm uses AI and the answer is usually "no, we have not approved anything". Ask the associates and the answer is different. Drafting a shareholders' agreement at 11pm, an associate will paste three pages of a client's term sheet into a free chatbot to get a first cut of a clause. Nobody logs it. Nobody approves it. It is simply faster.
That is the real exposure. Not a dramatic hack, but ordinary people trying to finish work on time.
What the law actually asks of you
The Nigeria Data Protection Act 2023 may apply to personal data handled by a law firm. The firm should assess its role, lawful basis, purposes, safeguards, contracts, and any cross-border processing with qualified counsel. The details depend on the facts and the service being used.
- Review whether the proposed AI use is compatible with the original purpose and has an appropriate lawful basis and safeguards.
- Check the provider's retention, model-training, access, subprocessors, security, and data-location terms; do not assume every service handles prompts the same way.
- Assess client confidentiality and privilege obligations with the firm's professional-conduct and legal advisers before sharing material with any third party.
Other regimes, including the GDPR where applicable, have their own requirements. Avoid treating one jurisdiction's analysis as a substitute for advice on another.
Why banning it does not work
Firms that circulate a memo banning public AI tools see the same thing a month later: staff use their personal phones instead. The tool is now invisible to you, and the firm still carries the liability. Prohibition without a sanctioned alternative converts a visible risk into an unmeasurable one.
The on-premises alternative
AI Box can run document indexing and question-answering locally when configured with a local inference service and local network access. This can reduce the need to send document content to a public AI service, but it does not remove the firm's privacy, security, or professional obligations. Verify model-provider settings, network egress, and integrations for your deployment.
- Client files are processed on hardware you own and can point at in the room.
- Answers can include source document and page references; reviewers should open and verify the cited material.
- Access is role-based: paralegals, associates, and partners can be limited to different folders.
- The application records selected activity and security events. It is not a complete audit trail of every document view, query, or downstream use.
AI Box answers from the documents you upload and shows the source document and page. Answers should still be checked against the cited page before they are relied on for legal, medical, or financial decisions.
Privacy, professional-conduct, and health-data obligations depend on your jurisdiction, organization, contracts, and deployment. Consult qualified counsel or your privacy officer before using AI with regulated or confidential records. A local appliance is not, by itself, a compliance certification.
A realistic first 30 days
- Pick one practice group and one document set — say, commercial contracts from the last two years.
- Index it on the appliance and let two associates use it for their normal drafting and review work.
- Compare time spent on clause location and precedent search against the previous month.
- Write the internal AI policy around the tool that now exists, instead of around a prohibition nobody follows.
The point is to give lawyers a research aid that can show source references, while keeping document handling local when the deployment is configured for local inference. Human review remains essential.