Dictation for lawyers: how to keep client confidences out of the cloud
Dictation is back. Phones and AI make it faster than ever to turn a client meeting, a memo or a letter into text. But every tool that touches client information raises a confidentiality question. Here's how to think about it, with a practical checklist for choosing a dictation setup.
Your duty doesn't change with the tool
Under ABA Model Rule 1.6(c), a lawyer must make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Most US states have adopted a version of that rule, and the duty of technological competence means you're expected to understand the tools you use well enough to protect that information.
A dictation app is one of those tools. If it sends audio to a server, a third party now holds client confidences: the transcription vendor, its cloud provider and possibly human reviewers or typists.
What ABA Formal Opinion 512 adds
In July 2024, the ABA issued Formal Opinion 512, its first guidance on generative AI. Commentators have drawn out a few points that matter for dictation and AI summaries:
- Confidentiality is the central concern. The opinion flags the risk of disclosure when client information goes into "self-learning" AI tools, even tools used only inside a firm.
- Informed consent may be needed. Before putting information relating to a representation into a self-learning tool, lawyers should generally get the client's informed consent.
- Boilerplate isn't enough. A generic clause in an engagement letter doesn't amount to informed consent.
- It's guidance, not law. ABA opinions aren't binding, but they're influential. Check what your own state bar has said.
Cloud transcription vs on-device transcription
Cloud dictation services upload your audio, transcribe it on their servers, and often keep the audio and text for some time. Human transcription services add another layer: people outside your firm listen to the recording.
On-device transcription runs speech recognition on your phone or computer. The audio stays with you, which removes the third party from the picture and makes the confidentiality analysis much simpler.
A checklist for any dictation app
- Where is the audio processed? On your device, or on the vendor's servers?
- Is anything retained? Audio, transcripts and summaries: by whom, and for how long?
- Is your content used to train models? Look for an explicit "never", not "may be used to improve our services".
- Who can access it? Vendor staff, contractors, human transcribers, subprocessors.
- How is it protected? Encryption on the device and in transit, plus a lock on the app itself.
- Does it require an account? An account usually means data synced to the vendor.
- Can you export cleanly? Word or PDF, ready for your document management system.
- Can you delete everything? Including copies the vendor holds.
A privacy-first dictation workflow
- Dictate memos, attendance notes and letters with an app that transcribes on the device.
- File transcripts by matter, in an encrypted and locked space.
- Proofread names, dates, amounts and citations before relying on any transcript or summary.
- Export the final text to your document management system, then delete the audio if your retention policy allows.
- If you record a meeting with a client or anyone else, get their consent and follow the recording laws where you are.
Note: this guide is general information, not legal advice. Your jurisdiction's rules of professional conduct and ethics opinions apply.