Five questions every law firm should ask before client material touches an AI tool

This isn't another generic warning about AI. Firms need a workable way to use it, without losing control of sensitive information, professional obligations or the evidence behind their decisions.

AI is already appearing across the firm: in specialist legal tools, general-purpose assistants, document systems and features embedded in software people use every day.

Before client material enters an AI environment, these are the five questions worth answering.

1. Where is the data processed, retained and accessed?

"Hosted in the UK" is not a complete answer. A firm should understand where data is processed, where it is stored, who can access it and which laws and jurisdictions apply at each point. AI data residency for law firms means the whole path, not the address on the brochure.

2. Is the environment closed, or can the provider use the data to train its models?

Firms need a clear position on prompts, documents and outputs. Can they be retained? Can they be reviewed by a third party? Can they contribute to training or improving another organisation's model? The answer must be contractually clear and technically enforceable.

3. What does the firm control, and what does it merely assume?

Control is more than an assurance in a vendor presentation. It concerns access rights, configuration, data boundaries, deletion, auditability and the ability to change or leave a supplier. The firm should know exactly which parts of the environment it controls itself.

4. What happens if the supplier's position changes?

Terms change. Suppliers are acquired. Processing arrangements and model partners change. A firm should understand whether a change in ownership, location or operating model could alter where its information goes or who can access it.

5. Can the firm evidence what happened?

If a client, regulator or internal risk team asks, the firm should be able to show what was entered, how it was processed, what was produced and who was responsible for review. Legal AI auditability needs an evidence trail designed into the use case, not assembled after an incident.

Where Argyll fits

At Argyll, we help organisations design and operate UK-controlled AI processing for sensitive workloads, from shared and dedicated environments to on-premises and batch processing. Sovereign AI for law firms is not a product you buy off the shelf; the starting point is a practical conversation about the use case, the data and the controls required.