In this guide · 8 sections
Short answer
Use enterprise-level AI tools whose terms exclude your data from model training, not free consumer accounts, for anything confidential. Verify every citation against authoritative sources before filing. Tell clients in your engagement letter how you use AI.
What MinLaw's GenAI guide says
MinLaw launched the guide on 6 March 2026 after a public consultation in September 2025. The full guide (PDF) sets out three principles:
| Principle | What it means | Professional rule it links to |
|---|---|---|
| Professional ethics | Lawyers remain ultimately responsible for all work products and must use the requisite knowledge, skill and judgment | Legal Profession (Professional Conduct) Rules 2015 |
| Confidentiality | Safeguard client data and understand how each tool processes and stores it | Rule 6 of the PCR, duty of confidentiality |
| Transparency | Consider telling clients about GenAI use, especially where substantial, affecting cost, or where data handling may not suit the client | Rule 5 of the PCR, honesty with clients |
The guide says Rule 6 is principle-based and, as with email or cloud computing, does not prohibit GenAI provided appropriate safeguards are in place. It also includes case studies, a sample internal GenAI governance policy and a sample engagement letter clause.
What the courts expect
The Supreme Court's Guide on the Use of Generative AI Tools by Court Users applies from 1 October 2024 to matters in the Supreme Court, State Courts and Family Justice Courts. It says court users are fully responsible for the content of their court documents and must ensure information is independently verified, accurate, true and appropriate. A pre-emptive declaration of AI use is not required unless the court asks, but you must be ready to identify AI use and explain how you verified the output.
The decision is on eLitigation. The lesson for a small practice is procedural: no AI-suggested authority goes into a document until someone has pulled the actual case or statute and read it.
Choosing tools for client confidentiality
MinLaw's guide ranks protection in increasing order: free-to-use tools, then enterprise-level off-the-shelf tools with safety features, then in-house systems, and says to prefer enterprise-level tools with the right assurances for confidential client data. For most small practices, that means a business or enterprise plan rather than personal accounts.
Free or personal AI accounts
Avoid for client data- Conversations may be used to improve models unless you opt out
- Settings can reset after updates, as MinLaw warns
- No admin control over who uses what
- Only for anonymised or hypothetical questions
Business or enterprise AI plans
Default for practice work- Terms exclude your data from training (check each vendor)
- Admin controls, access management and audit features
- Data processing terms you can show clients
- Check data residency if clients require it
Legal-specific or in-house tools
- Built on legal sources, often with citations
- Highest control over data
- Higher cost and setup
- Still needs verification of output
Check the actual terms, not the marketing. For example, OpenAI's help page on ChatGPT Business data says business data is excluded from training by default and encrypted in transit and at rest, while its consumer services may use content for training unless you opt out. MinLaw's guide asks you to verify that terms explicitly prohibit training on inputs and outputs, and to consider whether data may be stored outside Singapore.
Rules for using AI with client information
MinLaw suggests clear internal rules on data classification, handling and access. A short version a small practice can adopt:
Firm AI rules
Personal data in client files also falls under the PDPA. The PDPC's guidance on generative AI treats the organisation using an AI tool as responsible for compliance. Our guide to AI contract review limits covers what AI review can and can't safely do.
Checking citations and output
The guide says hallucination can't be fully eliminated, only reduced. Build verification into the workflow:
Treat every AI citation as unverified
Mark AI-suggested authorities in drafts until checked.
Pull the source yourself
Find each case, statute or article in an authoritative database or the official source, and read the relevant passage.
Check it is still good law
MinLaw's guide says to verify that sources are authoritative and that cases remain good law.
Prefer tools that show sources
Tools that cite or link the sources they used make checking faster, but still need checking.
Record who verified it
Note on the file who checked the authorities and when, so you can explain your verification if the court asks.
Engagement letter wording and client disclosure
MinLaw's guide suggests considering disclosure where GenAI is used substantially, affects the cost of legal services, or where the tool's data handling may conflict with a client's preferences or data residency needs. It suggests engagement letters, the practice's website or correspondence as channels. Its sample clause says the firm may use GenAI for research, document review, drafting and analysis under strict protocols, with outputs reviewed by qualified professionals and no client-sensitive information disclosed to external AI systems without safeguards. Adapt the wording with your own professional judgment.
Some corporate clients keep a whitelist of approved AI tools for their service providers. Ask at intake, and record any restrictions on the matter file.
Do it yourself or get help?
The policy and engagement letter are legal work for the practice. The IT side is making sure client data stays where it should: firm accounts with MFA, sharing restrictions, staff trained on what not to paste. If you're also setting up the practice's systems, see our small law practice IT setup guide, and for payment fraud risks, law firm cybersecurity.
Our Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users, blocks risky apps and legacy sign-in, sets external sharing rules for files, cleans up admin roles and adds a leaver checklist. Security Awareness Training (S$390) sets up a 12-month programme of short lessons with completion tracking. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront and brief us in writing. This guide is general information, not legal or professional conduct advice.
Frequently asked questions
Yes. MinLaw's March 2026 guide says the confidentiality rule does not prohibit generative AI if appropriate safeguards are in place. Lawyers remain responsible for all work, must protect client confidentiality, and should consider telling clients about substantial AI use. For confidential work, the guide prefers enterprise-level tools with proper data assurances over free tools.
Not pre-emptively. The Supreme Court's guide for court users, in force since 1 October 2024, says a declaration of AI use is not required unless the court asks. You remain fully responsible for your court documents, must verify everything, and must be ready to identify AI use and explain how you checked the output if asked.
In [2025] SGHCR 33, counsel cited an authority in written submissions whose name and case number had been produced by a generative AI tool. The case did not exist. The court ordered counsel to personally pay the other party S$800 in costs within 14 days and said citing a fictitious AI-generated authority is wholly impermissible.
Generally not. MinLaw's guide ranks free tools as the least protective. Consumer services may use conversations to improve models unless you opt out, and settings can reset after updates. If you must use a free tool, anonymise with placeholders, use hypotheticals or isolated clauses, and turn off retention and training. Use an enterprise plan for confidential work.
MinLaw's guide suggests considering it, especially where AI is used substantially, affects fees, or where the tool's data handling may not suit a client's requirements. It includes a sample engagement letter clause covering use for research, review and drafting, professional review of outputs and safeguards for client information. Adapt it to your practice.