If your firm hasn't approved an AI tool, there's a good chance your lawyers have approved one for themselves.

Nearly half of Victorian lawyers working in law firms (46%) now use AI tools in their practice, according to the Victorian Legal Services Board + Commissioner's 2025 lawyer census. More than half of those users reach for it daily or weekly. Most rely on general-purpose tools such as ChatGPT, Claude, Gemini or Copilot. Only 42% of lawyers work somewhere with AI guidelines.

The census doesn't ask whether those tools were approved. Thomson Reuters did ask, drawing on 736 law firm professionals for its July 2026 Future of Professionals paper. More than a third use AI tools their firm hasn't authorised.

Writing a ban into the policy changes less than you'd hope. The University of Melbourne and KPMG's 2025 study found 48% of Australian employees who use AI have used it in ways that breach workplace policy, including putting sensitive company information into free public tools. And 60% admit to hiding their AI use at work.

Nothing lands on the matter file

Every firm worries about client data leaking, and it should. The regulators' joint statement from December 2024 is plain on this: confidential client information can't safely go into a public chatbot.

My read is that the bigger problem for a law firm is the matter file.

When a lawyer works a matter through a personal ChatGPT account, the firm has no record of what went in or what came back. The same joint statement asks firms to consider recording when and how AI was used on a matter, and disclosing it to a client who asks. It also asks how that use is reflected in costs. You can't record what you can't see.

Then the lawyer resigns. Their chat history goes with them, in their account, on their phone.

Few partners would accept a solicitor keeping matter correspondence in their personal Gmail. A personal AI account is the same arrangement with better grammar.

Why the ban on its own fails

Plenty of AI policies stop at a list of what's prohibited. The prohibition is right. Client information has no business in a free chatbot, and the policy should say so.

Stopping there is where it goes wrong. Your lawyers still have a deadline and a stack of documents, and there's a tool on their phone that would summarise them in a minute. A ban leaves that need exactly where it was and moves the work somewhere you can't see it. That is what the 60% figure describes.

The firms getting traction pair the rule with a tool. Gilbert + Tobin gave its people ChatGPT Enterprise and, for legal work, Harvey. By June 2026, 87% of enabled seats were in active use, partners included, according to a September 2026 OpenAI customer story. Read that as the vendor's account, but the direction is clear enough.

A 20-lawyer firm doesn't need Harvey. It may already pay for a secure general-purpose AI platform, and its research platform and practice management system are adding AI of their own. The approved tools are often already in the building, half switched on, or with staff who simply aren't trained to use them properly.

Start with an AI usage report

In a partner briefing I ran for a Victorian firm last month, the partners already had AI guidelines and regular reminders. That put them ahead of most of the profession. Their first step was still a usage report. They didn't yet know how much of their people's AI use was happening outside the tools and rules the firm had set.

Before you rewrite your policy, ask for one. A useful usage report combines what your systems can see with what they can't. Your IT provider can show which AI services are being reached from firm devices and networks. That misses the personal phone and the home laptop, which is where personal accounts live, so a short anonymous staff survey belongs alongside it.

The letter at the end of this article sets out exactly what to ask your IT provider for, item by item.

Tell people why you're asking before you ask. If the report feels like surveillance, the people already hiding their AI use will hide it more carefully. Present it as sizing the problem, and make it clear nobody is in trouble for what it finds.

Then meet the need, team by team

The report shows you where your people need AI most. If half your litigation team builds chronologies in personal ChatGPT accounts, that's where to start. Give them an approved tool that does chronologies, with a clear rule on what client information can go in and who checks the output.

Then show them how, in their own team meeting, on their own matters. Partners go first. Nobody trusts a tool the partners won't touch.

Your lawyers have already decided AI is useful. The decision left for the firm is whether that work happens on the matter file or off it.

If you want to start this week, I've prepared a one-page letter you can send your IT provider to request the report. Request a copy here.

Sources