Australian Law Societies' Checklist Asks Law Practices Choosing a Third-Party AI Tool Who Owns the Output and Whether the Contract Covers Its Errors

In February 2026 the Queensland Law Society, with the Law Institute of Victoria and the law societies of South Australia, Western Australia, the Australian Capital Territory, the Northern Territory and Tasmania, put out an AI selection and use checklist for legal practitioners. It is "designed to assist small and mid-tier firms to select and adopt AI tools built by someone else."

Its assessment, it says, focuses on two main points. Can the firm satisfy its confidentiality obligations to clients? And will the work product, which it describes as "AI Tool + procedural guardrails + human oversight," be "good enough that you will be confident putting your firm's name to it, and your name as the responsible practitioner?" Beyond the go or no-go decision, it says, a firm will need to supply guardrails, so the document "moves beyond a checklist for selection and suggests some of the conditions and controls that might be appropriate." Ideally, it says, a practice will hire an outside expert consultancy and set up a specialist project team before using AI in a legal context, and where resources do not allow this, "a law practice must still undertake a basic risk assessment." Parts of it follow, not the whole.

The Tool, Its Terms and the Firm's Data

The checklist warns that "Arrangements between AI companies and providers adding AI functionality into their own software can be complex," which "potentially adds new layers of risk and data sharing that does not arise from use of the core product." It asks whether the vendor can give a clear explanation of how the parts of the system interact and who controls them, and whether third-party systems the vendor does not control are used, and if so how their access to data will be governed.

On terms, it asks whether all the contractual terms, from the main provider and any others, are available. "Free or trial services may not provide clear terms, and in many cases the trade-off for a free service is wide data access," it says. "This is usually inappropriate for professionals." On data, it asks what each party given access to the firm's data says about how it will be used, and whether the data can be resold or used for training AI models. "Be careful which version of the privacy policy and terms of service you use," it says.

On reliability, it asks whether the vendor has research data showing the system's baseline accuracy, and a footnote adds that such information "must be approached with caution, and not only because it comes from the sales team." It also asks whether a manual system to find and correct errors is realistic, and whether the error checking will be "so onerous that all time savings become illusory?"

Vendor and Contractual Considerations

Its section on the vendor and the contract asks whether pricing is introductory, noting that "Many AI projects and companies are running at a loss." On indemnity it asks, "Does the contract include indemnities for errors caused by the AI tool? (Note: it probably won't, but you can ask.)" It says to "Be wary of warranties or indemnities flowing the other way, which may not be covered by your PI insurance." On the work itself, it asks who owns output information and documents, and says this "should be expressly addressed in the terms of use, and if not, in a written agreement with the vendor." On leaving, it asks whether the firm can easily stop using the tool, recover appropriate records and ensure that stored client data is properly deleted.

The contract question the checklist expects to lose is the one about errors. If the vendor will not answer for a mistake its tool makes, the practitioner whose name is on the work still does.

Checking, Records and Its Own Statement

Supervision, the checklist says, "is in two layers: first, someone taking personal responsibility for AI generated output, and checking it carefully." The second layer is the usual firm supervision systems, "to ensure that those checks are actually carried out as required by the policy." It asks whether the person checking is versed enough in the law and the individual facts to spot errors, and is given enough time to check properly. It asks whether prompts, logs and copies of drafts are preserved, and whether a record of the system's use can be easily incorporated into the client file, or "supplied to a Court if asked to explain the provenance of AI generated material."

The checklist also carries a statement of its own, headed "AI usage & verification statement." It says the document was prepared with the assistance of AI tools, which it names. Under "Uses included," it lists "a document review to identify SME self-assessment best practice," a summary of common self-assessment elements, and re-drafting assistance. It names who did the initial verification, and says approval came from the AI committees, working groups or relevant staff attached to each body that has adopted the guide.