Quick answer
What should legal teams verify before using legal AI?
Verify what data enters the system, where it is stored and processed, which providers receive it, whether it is used for training, who can access it, how long it is retained, how deletion works and who reviews the output.
These questions should be answered for the actual deployment and provider chain. A product category or broad statement about “enterprise security” is not a substitute for deployment-specific evidence.
The data path
Separate the events.
Import
How does a document enter the workspace, and who has authority to provide it?
Storage
Where is the matter material stored, encrypted, backed up and deleted?
Processing
Which model or service receives content, in which region and under what terms?
Output
Where are answers, drafts, citations, logs and intermediate data retained?
Access
Which users, administrators and providers can view or act on the material?
Review
Who checks the result and remains accountable for any legal or compliance decision?
Due diligence
A practical legal AI security checklist.
Bounded start
Reduce uncertainty before real matter use.
- Use permissioned material.Confirm client authority, confidentiality and internal approval before upload.
- Limit the source set.Use only the documents needed for the selected workflow.
- Limit access.Assign named users and reviewer roles for the pilot.
- Test deletion and export.Verify what remains when a file, matter or pilot is closed.
- Record the reviewer.Keep the human decision and output responsibility visible.
Nomoy’s public trust materials intentionally describe an illustrative data path and evaluation questions. They do not claim certifications or deployment controls that have not been independently verified.
Frequently asked
Legal AI security questions.
What security questions should a law firm ask a legal AI provider?
Ask where documents are stored and processed, which providers receive data, whether data is used for training, how access is controlled, how long data is retained, and how deletion and incident response work.
Is document storage the same as AI processing?
No. They are distinct data events and may involve different systems, regions, providers and retention terms. Both should be documented.
Should real client documents be used in an initial legal AI test?
Only after confirming authority, confidentiality, data handling and review controls. A safer first step is a bounded pilot with permissioned or appropriately prepared material.