How Ontario Lawyers Can Use AI Without Risking an LSO Complaint

AI is genuinely useful for legal work. It can summarize, draft, research, and retrieve in seconds. The problem isn't AI itself — it's how most lawyers are using it. Paste a client's contract into the wrong tool and you've turned a productivity win into a potential complaint to the Law Society.

The good news: using AI safely in an Ontario practice isn't complicated. It comes down to a few clear rules. Here's the playbook.

Rule 1: Know Which Two Rules Apply

There's no standalone "AI rule" from the LSO yet, but two existing rules already govern this: Rule 3.3-1 (confidentiality) and Rule 3.1-2 (competence). Together they require you to keep client information in strict confidence and to understand and manage the risks of the technology you use.

Everything below is really just applying those two rules to AI.

Rule 2: Separate "Public" AI Work From "Client" AI Work

Not all AI use is risky. The line is whether client-identifiable information is involved.

Generally safe — using a general AI tool for:

• Legal research on public law
• Drafting templates and public-facing content
• Brainstorming arguments in the abstract
• Learning a new area of law

Not safe — putting any of this into a non-compliant tool:

• A client's name plus the nature of their matter
• Contract terms, pleadings, or correspondence from a real file
• Family, immigration, estate, or financial details
• Anything you'd describe as confidential or privileged

The single most common mistake is treating these two categories the same. Pasting client documents into ChatGPT is the textbook example of crossing the line.

Rule 3: For Client Work, Use a Tool That Meets the Bar

When client information is involved, the tool has to clear a specific bar. It must:

1. Store data on Canadian servers — beyond the reach of the US CLOUD Act and foreign compelled disclosure.
2. Come with a Data Processing Agreement — your documented evidence of reasonable measures under Rule 3.1-2.
3. Never train AI models on your data — your client's information can't become part of someone else's system.
4. Keep audit logs — so you can show who accessed what, and when.
5. Isolate data per matter — keeping information scoped to the file it belongs to.

If a tool can't check all five boxes, don't put client data through it. It's that simple.

Rule 4: Document Your Process

Competence under Rule 3.1-2 isn't just about making good choices — it's about being able to show you made them. Keep a short record of:

• Which AI tools you use, and for what
• Where each one stores data
• The DPA you have in place
• Your policy on what does and doesn't go into general AI tools

If a question ever arises, "I understood the risks and here's how I managed them" is a very different position than "I didn't think about it."

Rule 5: Don't Wait for the LSO to Force the Issue

The Law Society hasn't issued comprehensive AI guidance yet, but that's not the same as permission. Confidentiality and competence obligations already apply, and AI-related complaints are a matter of time. Getting your setup right now costs you nothing; getting caught behind it could cost a great deal more.

The Bottom Line

You don't have to choose between using AI and staying compliant. You have to be deliberate: keep public AI work and client AI work separate, and route anything involving client information through a tool built for the Canadian legal bar.

Surface is that tool — AI over your own documents, on Canadian servers, with a DPA available on request, no model training on your data, and full audit logs. See how it's built for LSO compliance.