AI for Criminal Defence Lawyers: What Is Safe With Client Confidences

Yes, criminal defence lawyers can use AI, but only in ways that keep client confidences out of systems that could store or learn from them. Safe: research you verify, templates with placeholders, calendars and checklists, and tools under a contract you have reviewed. Unsafe: pasting facts, discovery, jail-call recordings or client statements into free or unvetted tools.

The reason the line is sharper here than in most practices is the stakes. A leaked fact can end up in a corporate dataset, and the accused is the one who pays. NACDL's president has put it plainly: client information cannot become a hidden data point in a corporate dataset. So the practical answer is a written client-data policy: tasks sorted by risk, plan settings checked, strict handling rules for discovery and recorded calls, and a small first pilot with no client facts in it. None of this is legal advice, and your jurisdiction's rules govern.

Follow me on Instagram@sagnikteaches

What the ethics guidance actually asks of you

Three pieces of guidance shape the checklist below.

Connect on LinkedInSagnik Bhattacharya

• NACDL's white paper. Parity in Practice: The Defender's Duty to Ethically Use AI, released in July 2026, offers a framework grounded in the ABA Model Rules for all types of defence practice. It covers benefits, risks, tool selection, oversight, data security and courtroom use, and includes a model AI use policy in an appendix that firms are expected to tailor. It calls itself a call to action: the adversarial system, it argues, demands that defenders achieve parity or risk representation that falls short of constitutional and ethical standards.
• NACDL's president's column. Writing in The Champion in early 2026, the president tied competence to understanding how a tool was trained, what data it relies on and where it is prone to error, and warned that introducing client facts into third-party systems that may store input for training or refinement raises serious confidentiality concerns.
• ABA Formal Opinion 512. Issued on 29 July 2024, it addresses generative AI and the duties of competence, confidentiality, communication, supervision, meritorious claims, candour towards the tribunal and reasonable fees. It restates Model Rule 1.6: information relating to the representation stays confidential unless the client gives informed consent, disclosure is impliedly authorised to carry out the representation, or an exception applies. It also says informed consent is not needed where no information relating to the representation goes into the tool, for example when you use it only for idea generation.

The common thread is that the old duties apply to a new tool. You need to understand it, verify its output, protect what clients tell you, tell them what you are doing where it matters and supervise anyone else who uses it. States and courts add their own rules. Opinion 512 notes that some courts now require lawyers to disclose their use of generative AI and tells lawyers to check the court's local rules, so check yours before the first filing.

Subscribe on YouTube@sagnikteaches

Safe and unsafe uses, task by task

The three questions behind the ratings are the ones to put in your policy: does it contain client facts, would a mistake reach a court or client unchecked, and does the tool's contract support what you are about to do?

Plan privacy settings to check before anyone logs in

The tools differ in ways that matter to a confidentiality duty. On the vendors' own pages in November 2026: ChatGPT's personal plans (Free, Plus and Pro) share chats for model training by default, with a switch called Improve the model for everyone to turn it off, and Claude's consumer plans list model training as opt-out. ChatGPT Business and Claude Team both state that they do not train on business content by default. Both business plans start at two seats, so a one-person practice pays for two or uses an individual plan, and both list a standard seat at $20 per user per month billed annually or $25 billed monthly. Clio's pricing page (as archived on 20 October 2026; the live page blocked automated reading) lists four plans starting at $49 per user per month, with AI drafting built in from the Core plan. Prices and names change, so check the vendor page before you buy.

A plan is a starting point, not an answer. For every tool, record the answers to this checklist in a dated note.

1. Training. Is our content used to train models on this plan? Where a setting controls it, who set it and when?
2. Retention. How long are prompts, files and outputs kept, and who can delete them? Temporary modes are not zero retention: OpenAI says it may keep a copy of a ChatGPT temporary chat for up to 30 days for safety purposes.
3. Human access. Can the vendor's staff read conversations for safety or support, and under what conditions?
4. Location and sub-processors. Where is the data processed, and who else touches it?
5. Contract. Is there a data processing agreement and a duty to notify you of a breach?
6. Access control. Enforced multi-factor authentication, individual seats and a way to remove a leaver the same day. No shared logins.
7. Memory and sharing features. Does the tool remember details across chats, or share them with a team? Read what your plan does on its own help page, and switch off memory for any account that touches case work unless you have a reason to keep it.
8. Exports and legal holds. Can you export what you need to keep, and delete the rest?

The deeper reading guide is what to check in an AI tool's privacy terms, and the free ChatGPT tutorial for lawyers explains why the free tier fails this checklist.

Discovery: read the order before you upload anything

Discovery is the highest-value target for AI and the easiest place to go wrong. A tool can index thousands of pages, find every mention of a name and cross-check a timeline. The discovery review tutorial shows how. Before you start, run a short pre-flight on every case.

1. Is there a protective order or agreement? Read what it allows. Some orders restrict copying, sharing with third parties or storage outside your office. A vendor may count as a third party. If the order is silent or ambiguous, ask, in writing, rather than assume.
2. Whose information is in it? Witnesses, complainants, minors, informants and co-defendants. Their personal data raises obligations separate from your client's.
3. Is it sensitive in kind? Medical, sexual-offence, child-related or national-security material often has its own rules. These stay out of general AI tools.
4. Does the tool's contract support it? Use a legal-specific platform or a contract-protected plan, and confirm the retention and deletion terms cover the file's life.
5. Can you verify the output? Every finding the tool surfaces must be checked against the source page before you rely on it. Treat the output as an index, not as evidence.

If any answer is "no" or "don't know", the discovery stays out of the tool and you do the review the traditional way, perhaps with a keyword search in your own document system.

Jail calls and recordings

Recordings are tempting for transcription because they are long and the audio is often poor. They are also loaded with risk. Voices of third parties who never consented to your tool, content that may be privileged if the client called a lawyer, and details that identify people in custody or the community. A cautious policy is a flat rule: recordings are not uploaded to a general cloud tool. If your firm wants transcription, choose a vendor with a contract, retention controls and a clear statement of how audio is handled, then test it on a non-case recording first. The poor-audio transcription test shows how to evaluate accuracy before trusting it, since a single mis-transcribed word in a call can change the meaning of what the client said.

Whatever the tool, a human listens to the passages that matter. A transcript is a finding aid, never the evidence, and the recording remains the source.

The firm-level client-data policy, one page

Turn the above into a document the whole firm signs. NACDL's model policy is an appendix to its white paper and is meant to be adapted. A one-page version for a small office might read:

AI USE POLICY - [firm name] - version 1, [date]

1. Approved tools: [tool A, plan] for tasks in Band 1 and 2; [tool B]
   for transcription with consent. No other AI tools on case matters.
2. Band 1 (no client facts): research summaries, templates, checklists,
   training notes. Verify every citation in the original source.
3. Band 2 (client facts, approved tool only): own anonymised bullets into
   letters; internal summaries. Reviewer named on the file.
4. Band 3 (never): client statements, discovery, jail-call recordings,
   sealed or sensitive material, anything under a protective order that
   restricts third-party sharing, unless the supervising lawyer has
   approved the specific tool and order in writing.
5. Court filings: signed by a lawyer who has checked every citation and
   quotation. Follow any court rule on AI disclosure.
6. Client consent: explained in the engagement letter; recorded on file.
   Clients who decline are flagged and no AI is used on their matter.
7. Records: one log line per use on a matter (date, tool, task, reviewer).
8. Incidents: wrong-tool paste reported to [name] the same day.
9. Review: policy and tool terms re-read every six months.

Notice item 4: the supervising lawyer's written approval is the only gate, and the approval is per tool and per order. That keeps edge cases from becoming habits. For a longer template, how to write an AI usage policy has a general base to adapt.

Telling clients, in words they can follow

Rule 1.4's duty to communicate and Rule 1.6's informed-consent requirement point to the same practice: explain, plainly, what you do with their information. Opinion 512 is blunt that general boilerplate added to an engagement letter is not enough for informed consent, which needs the lawyer's explanation of why the tool is used, what information it will see and the risks. A short paragraph works better when it is also said aloud.

I sometimes use software with AI features to help draft general letters
and organise my research. I do not put your story, your statements or the
evidence in your case into AI tools, and I do not let any tool keep or learn
from your information. Everything I send out is checked by me. If you would
prefer that no AI is used anywhere on your matter, tell me and I will note it
on your file.

If you plan to use a contract-protected tool on case facts, say so specifically: what tool, what information, why, and the risks, then record the client's agreement. Clients in custody may be less able to ask questions, so allow time and use plain language.

A worked example: a three-lawyer firm sets its rules

Take a firm with three defence lawyers, a paralegal and an investigator handling roughly 150 open matters, mixing misdemeanours and serious felonies. The paralegal has been using a free chatbot to tidy letters and the investigator has used an app to transcribe an interview. Nobody has told the lawyers.

1. Amnesty and inventory (week 1). The managing lawyer asks everyone to list every AI tool used on firm work, with no discipline for honesty. Four tools appear, two of them on personal accounts.
2. Incident review. The transcription app held a witness interview. The firm deletes it using the tool's controls, notes the incident and assesses whether any notification or client conversation is needed. This is a legal judgement, so the lawyer decides with advice, and the note goes in the firm's incident record.
3. Policy (week 2). The one-page policy above goes to the team, with Band 3 examples taken from real files. Free tools are banned on case matters.
4. Tool choice (weeks 2 to 3). The firm trials one business plan for Band 1 and 2 work and reads its terms against the eight-point checklist. Cost for four seats is about $80 to $100 a month on a list price of $20 to $25 per seat, which they confirm on the vendor page.
5. Engagement letter (week 3). The paragraph above is added and sent to new clients, and raised in conversation with existing clients on the next contact.
6. Pilot (weeks 3 to 6). See below.

The cost is a few hours of lawyer time and a modest subscription. The reward is that the team can use AI without fear, because they know where the lines are.

A first low-risk pilot, four weeks

A pilot works when it has one owner, one scope and a measurable result. For a defence firm, the safest first scope is Band 1: no client facts at all.

• Week 1. Build three templates with placeholders: a client update letter explaining a court date, a request-for-records letter and a bail-hearing checklist. Time how long each takes to draft today.
• Week 2. Use the tool for research summaries of public decisions on one recurring issue, such as a suppression argument. The paralegal checks every cited case in the original and records how many summaries contained an error or invented citation.
• Week 3. Try plain-language explainers for clients, such as what happens at a first appearance, checked by a lawyer against local rules.
• Week 4. Count the hours saved, the errors caught and the policy questions that arose. Decide what moves to Band 2, if anything.

Realistic result, illustrative: letter drafting time drops from about 25 minutes to about 10 including review, and research summaries save perhaps an hour each but 1 in 5 carries a citation or holding that needs correcting. That error rate is the argument for the verification step, and the figure to share with the team.

One client letter, before and after

A concrete example shows where the line sits. A lawyer needs to tell a client the date and purpose of the next hearing. The unsafe version pastes the charge, the client's name, the police narrative and the hearing notes into a chatbot and asks for a letter. Whatever the plan, the client's facts have now left the file.

The safe version uses a template written with no case facts at all.

Write a plain-English letter, 150 words, from a defence lawyer to a client
before a pre-trial hearing. Explain what a pre-trial hearing is, what the
client should bring and how to arrive, and that they should not discuss the
case with anyone else. Leave [client name], [date], [courthouse] and
[lawyer name] as placeholders. Do not predict the outcome.

Illustrative output: a friendly, accurate-sounding letter with the placeholders intact. The reviewer's fixes are small but real: the model wrote "you will be arraigned", which is the wrong stage, and implied the client needed no documents when the local court asks for identification. The lawyer corrects both, fills in the placeholders in the firm's own document system and sends it. The model saved ten minutes of wording, no confidence left the building, and the errors it made were caught because someone who knows the process read the letter.

Repeat that pattern for update emails, plea-explanation handouts and bail-condition summaries. Anything that requires the client's facts is written by a lawyer, or by a lawyer using a tool covered by Band 2 of the policy.

Training the team in thirty minutes

A policy only works if people can apply it at five in the afternoon. A short session with real examples does more than a long document.

• Show the three bands with five tasks each from your own caseload and ask the team to place them. Disagreements reveal where the policy is unclear.
• Demonstrate the fake-citation problem with a live example, then check it in a legal database. People remember a failure they have seen.
• Walk through the incident route: who to tell, what to write down, and that reporting a slip carries no penalty.
• Give each person the one-page policy, and ask them to sign that they have read it.

Keep attendance and the date. It shows supervision, which several of the ethics rules expect, and it makes it easier to explain the firm's approach if anyone asks.

Failure modes specific to defence practice

• Invented authority. A confident citation to a case that does not exist. Check every one in a real database. Opinion 512 lists citations to nonexistent opinions among the problems that have already reached courts.
• Softened facts. A summary smooths a client's statement into something safer than what was said. Quote from the source.
• Bias in tools. NACDL's president warned that defenders must resist tools that threaten due process and the presumption of innocence. Be sceptical of any tool that scores or predicts people.
• Shadow use. The tired paralegal on a Friday night with a personal account. Make the approved route easier than the unapproved one.
• Staff transcription. An investigator records and uploads an interview. Include investigators and interpreters in the policy and training.

For tool shortlists once the policy is in place, see the small defence firm shortlist. If you would rather map the policy with someone, that is what my AI implementation consultation covers. Either way, start with Band 1, write the policy before the pilot and keep the log from the first day.

Questions defence lawyers ask about AI and confidences

Does NACDL say defence lawyers should use AI?

NACDL's July 2026 white paper, Parity in Practice, frames ethical AI use as part of the defender's duty, grounded in the ABA Model Rules, and includes a model AI use policy. NACDL's president has separately warned that putting client facts into systems that may store input for training raises serious confidentiality concerns.

Is a paid plan enough to protect client confidences?

A business plan that does not train on your content by default is a better starting point than a free plan, but a plan is not a policy. You still need the contract terms, retention settings, access controls, client consent where required and a rule on what never goes in.

Can I upload discovery to an AI tool?

Only after you have read any protective order or agreement covering it and confirmed the tool's terms. Discovery often contains third parties' personal information and sometimes sensitive material. If the order restricts sharing or copying, a vendor may count as a third party, so ask the court or the prosecutor when in doubt.

What is the safest first pilot?

Use AI on material that is public or your own and contains no client facts: research summaries you verify, templates for letters and motions with placeholders, checklists and training notes. Run it for four weeks with a named reviewer, then decide whether to widen it.

Do I need client consent to use AI on their case?

The rule is that you cannot reveal information relating to the representation without informed consent unless disclosure is impliedly authorised. Whether using a given tool is a disclosure depends on how it handles data. For anything beyond no-client-data uses, explain the tool and its risks in the engagement letter, or in plain words, and record the consent.

Further reads

• Can Lawyers Use AI Note Takers in Client Meetings? — Note takers for client meetings and their risks.
• AI App for Lawyers: Score Accuracy, Privacy and Cost in a Short Trial — Score a legal AI app over a two-week trial.
• Best AI Chatbot for Lawyers: General Models vs CoCounsel — General chatbot or legal-specific tool, and when.
• Claude v ChatGPT for Lawyers: A Same-Task Test on Your Own Documents — Two assistants tested on the same legal task.
• AI Acceptable Use Policy for a Small Professional Firm — A policy template a small professional firm can adapt.
• AI Voice Agent for Lawyers: Cost and Safe Handling of Intake Calls — What a voice agent can and cannot do at intake.
• Best AI for Solo Lawyers: A Stack That Fits One Person — A lean AI stack for a lawyer practising alone.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: NACDL, Parity in Practice: The Defender's Duty to Ethically Use AI (July 2026) and its AI task force section; NACDL president's column on the ethics of AI in defence practice (The Champion, January-February 2026); ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024, archived copy); OpenAI help articles on data controls and temporary chats; ChatGPT Business and Claude pricing pages; Clio pricing page (archived 20 October 2026).