Courts and regulators are sending a clear message: AI usage now requires governance

For partners, general counsel, risk leaders and professional services firms

Over the past 12 months, Australian courts, regulators and legal bodies have started moving from discussing AI as a productivity tool to treating AI usage as a governance, confidentiality and compliance issue.

This shift is important for lawyers, professional services firms and enterprises generally because it signals that AI usage is no longer simply an internal IT matter.

It is rapidly becoming a governance and operational risk issue.

Recent developments

Recent developments include:

• The Supreme Court of Victoria issuing guidance around confidentiality, verification and human oversight in AI usage. Read the Hall & Wilcox summary
• The Federal Court of Australia introducing a Generative AI Practice Note addressing responsible AI use in proceedings. Federal Court GPN-AI
• Legal commentary increasingly warning that public AI systems may undermine confidentiality and legal professional privilege. Clayton Utz on LPP and AI workflows
• Law societies warning practitioners not to enter confidential or privileged information into public AI systems. ACT Law Society guidance
• APRA warning regulated entities that where organisations fail to adequately identify, manage or control AI risks, APRA may pursue stronger supervisory or enforcement action. APRA letter to industry on AI

This is significant because most organisations already know their staff are using:

• ChatGPT
• Copilot
• Claude
• Gemini

The problem is that many firms still have little practical visibility or enforcement around:

• what data is being entered into AI systems
• whether confidential material is being exposed
• whether employees are using approved AI platforms
• whether AI policies are actually being followed

Policy and training are not keeping pace

Historically, firms relied on:

• policy documents
• staff training
• broad AI bans

But these approaches are becoming increasingly ineffective as AI adoption accelerates.

The challenge is no longer whether employees use AI.

The challenge is whether organisations can demonstrate governance and control over that usage.

This is where technical enforcement and monitoring become important.

What Airentect is built to do

Airentect is being developed to help organisations enforce enterprise AI data security policies in real time.

The platform is designed to:

• inspect prompts before they reach AI systems
• detect sensitive or confidential information
• block, redact or allow prompts based on company policy
• create auditability and reporting around AI usage

For legal firms and professional services organisations, this becomes particularly important where:

• confidentiality obligations apply
• privileged information is involved
• sensitive client information is handled
• governance expectations are increasing

Consequences of poor AI governance

There are also increasingly real legal and regulatory consequences attached to poor AI governance.

These may include:

• Privacy Act penalties for data breaches involving AI systems
• Loss of legal professional privilege where confidential or privileged material is entered into public AI tools
• Regulatory enforcement, including stronger APRA supervisory action where AI risks are not managed proportionately
• Professional negligence exposure where firms cannot show reasonable care around client confidentiality
• Litigation risk arising from disclosure, misuse or unverified AI-assisted work product
• Reputational damage when clients, courts or regulators lose confidence in how AI is used

This article is general information about emerging risk themes, not legal advice for your firm.

Beyond policy alone

As courts, regulators and professional bodies continue focusing on AI governance, organisations will increasingly need more than policies alone.

They will need operational controls capable of demonstrating responsible AI usage in practice.

If you lead a law firm or professional services team and want to see how prompt-layer enforcement applies to your workflows, read our Legal industry overview or enquire about a demo.

Airentect helps security and compliance teams govern major AI chat assistants across the organisation with policy-aligned checks, visibility and audit-friendly controls. We are headquartered in Sydney and work with regulated mid-market organisations across Australia.

Questions about AI governance for legal or professional services? Email info@airentect.com.