Ethics Hub

Scenario: Your firm invests in a bespoke AI system

You are working in-house for a large company. In the weekly team meeting, your boss announces that the firm has decided to invest in a new, bespoke, AI system, Do-It-All. They are excited about the new system, which they say will increase efficiency and help the team to work smarter, and automate routine tasks.

Several of your team members are also excited about Do-It-All, and can’t wait to start trying it out.

You ask some questions about the system’s security features, and about who has access to the data that is inputted into Do-It-All. Your boss responds, “The IT department has checked all the security and data protection requirements when they signed the purchase agreement and they have said it’s all fine, so there’s no need to worry.”

What, if anything, should you do?

Note that this guidance does not address data protection and information security considerations which form part of thinking about a new IT tool or system. You and/or your firm may wish to refer to the Information Commissioner’s Office’s guidance on AI, and on data protection more generally, or seek legal advice before procuring or adopting a new tool.

  • In this scenario, before using Do-It-All, you should ensure that you understand the system’s security and data protection features, including:
    • Who can view the information that you input into the system;
    • How long data inputted into the system is retained for;
    • Whether any data inputted into the system will be disclosed to a third party; and
    • Whether any data that inputted will be used to further train the system.
  • This is line with your duties under Principles 4 and 7 of the Code of Conduct.
  • You should also ensure that you understand how any data inputted into the system will be kept secure (for example, whether it is encrypted) and the protocol to be followed in the event of a data or security breach.
  • You should talk directly to the IT department and/or review the purchase agreement if necessary.
  • As a Costs Lawyer, you also have a duty under Principle 7 of the Code of Conduct to keep the affairs of your client confidential unless disclosure is required or allowed by law or if the client consents in writing to disclosure. This means that you should not input any confidential client information into any AI system without understanding whether the information will be accessible to others, and the security features of that system.
  • If your concerns are assuaged and you decide to use Do-It-All, you must ensure that you do not use it in a way that compromises your professional, regulatory and ethical duties. You should adopt appropriate safeguards to ensure that clients are protected.
  • Before deciding whether to use Do-It-All, you always consider whether it is appropriate for the task for which you intend to using it. You must be able understand how the system operates, and to be able to explain it clearly to clients, undertaking appropriate training if necessary.
  • If you use Do-It-All assist with research, drafting documents or any other legal tasks, you must critically review, verify – and where necessary – correct, all output to confirm that it is accurate and consistent with your own legal knowledge and experience.
  • You should never rely solely on Do-It-All for decision-making. Remember that no AI system can replace your own expertise, experience and judgement as a Costs Lawyer.

Principle 1.1 – You must act honestly and with integrity, not only in your professional life but also in your private life where your behaviour might reasonably be considered to undermine your adherence to the core ethical principles of the profession.

Principle 4.2. – Work must be undertaken with due skill, care and attention, with proper regard for the technical standard expected of you.

Principle 4.4 – You must maintain your competence to carry out your role and keep your professional knowledge and skills up to date.

Principle 7.1 – You must keep the affairs of your client confidential unless disclosure is required or allowed by law or if the client consents in writing to disclosure, having had the consequences of such consent explained to them. You must ensure that your client is able, in your reasonable opinion, to give informed consent to waiving their right to confidentiality.

Back to Ethics Hub