LSO Rules 3.1-2 and 3.3-1: What Ontario Lawyers Need to Know About AI

The Law Society of Ontario hasn't published a comprehensive AI policy yet. But two existing rules in the Rules of Professional Conduct already govern how lawyers can — and can't — use AI tools in their practice.

Understanding these rules is the difference between using AI as a competitive advantage and exposing yourself to a professional conduct complaint.

Rule 3.3-1: Confidentiality

This is the core rule. It states that a lawyer must "hold in strict confidence all information concerning the business and affairs of a client acquired in the course of the professional relationship."

The rule doesn't have exceptions for convenience. It doesn't matter that a tool is popular, cheap, or impressive. What matters is whether your client's confidential information remains protected.

When you use an AI tool that stores data on US servers, processes it through systems governed by US law, and retains it for model training, you are potentially breaching this rule with every client document you submit.

What "Strict Confidence" Requires in Practice

The LSO has not defined "strict confidence" with a checklist, but a reasonable interpretation requires:

• Client data cannot be accessible to third parties without authorization
• Data cannot be used for purposes beyond the legal matter
• Data must be stored in a jurisdiction where it is protected from foreign government access
• You must be able to demonstrate, if asked, that you understood where your client's data went

Rule 3.1-2: Competence

This rule requires lawyers to provide "competent representation," which includes the obligation to understand the technology they use in their practice.

Commentary 4A to Rule 3.1-2 explicitly states that a lawyer "should understand the benefits and risks associated with relevant technology" and "take steps to manage the risks."

This is where most lawyers are unknowingly exposed. Using ChatGPT for client work isn't just a confidentiality issue — it's also a competence issue if you haven't understood and managed the risks of doing so.

What Competent Technology Use Looks Like

Under Rule 3.1-2, you should be able to answer yes to all of the following:

• Do I know where this tool stores my clients' data?
• Do I have a Data Processing Agreement with this provider?
• Do I know whether this tool uses client data to train its AI models?
• Can I produce an audit log of who accessed client information if required?
• Is the jurisdiction where data is stored protected from foreign access under Canadian law?

If you can't answer yes to all of these questions about your current AI tool, you have a competence issue under Rule 3.1-2.

The CLOUD Act Problem

The US CLOUD Act allows US authorities to compel American companies to provide data stored anywhere in the world. OpenAI, Google, Microsoft (for consumer products), and virtually every major US AI provider is subject to this law.

This means that even if your data is technically stored in a Canadian data centre operated by a US company, it may not be protected from US government access.

The only reliable protection is to use a provider that:

• Is not subject to US jurisdiction, or
• Stores data exclusively on Canadian servers operated under Canadian law with appropriate contractual protections

What to Do Right Now

If you're currently using ChatGPT, Google Gemini, or any US-based AI tool for client work, here are your immediate steps:

1. Stop submitting client-identifiable information to these tools
2. Review what you have already submitted and assess whether any confidentiality obligations were breached
3. Implement an AI tool that meets Canadian data sovereignty requirements
4. Document your process so you can demonstrate compliance if asked

The LSO is watching this space. AI-related professional conduct complaints are coming. Being ahead of this now costs you nothing. Being behind it could cost you significantly more.

Surface is built for exactly this situation — AI for Ontario lawyers that keeps all data on Canadian servers and offers a Data Processing Agreement available on request. Learn more about our compliance approach.