In the second of a series on safely adopting AI, Ed Molyneux clears up the most misunderstood obligation in the field, and explains what a firm’s record of AI use is really for.
Of the five duties set out in this series last week, one draws more questions than the other four combined, and it is the one most likely to send a firm off building the wrong controls. It concerns lawful basis, and the misconception runs roughly like this: every use of AI on personal data is a processing activity, so every use needs its own lawful basis, and therefore every use is a separate compliance event to be justified and recorded.
The first half of that is a fair reading of the words. The conclusion is wrong, and it is expensive.
Start with what is correct, because most of it is. For processing a client’s personal data in the ordinary course of a retainer, the sensible lawful bases are performance of the contract with the client, or the firm’s legitimate interests in delivering an efficient service where those are not overridden by the client’s rights.
Consent is generally the wrong tool for service delivery: it must be freely given and as freely withdrawn, and a firm cannot sensibly make the performance of a retainer contingent on a permission the client can revoke tomorrow. All standard, all correct.
A lawful basis
Here is the part that gets lost. A lawful basis is a determination made once, per purpose. You decide it before processing begins, record it in your record of processing activities, and set it out in your privacy notice. Using a spreadsheet to organise a client’s data, an email system to correspond about it, or an AI tool to help draft from it are not three separate lawful-basis questions.
They are the same processing, for the same purpose, under the same standing basis. If a firm has properly established its basis for processing client data to deliver the retainer, that basis already covers using a tool to assist. It does not need re-deriving because the tool happens to involve AI.
The same logic applies one obligation over. The requirement that a processor be governed by a written agreement is settled once per vendor, at onboarding, not per document.
Take the ordinary risky case: a fee-earner, up against a deadline, drops a client’s file into a consumer AI tool on their own personal login. If the lawful basis was already in place, and the processor agreement is a once-per-vendor matter, what exactly has gone wrong?
Proving what didn’t happen
Something narrower than a lawful-basis failure, and more practical. The data went to a tool outside the firm’s approved set, a vendor with no agreement in place, chosen ad hoc by one person under pressure. And nothing recorded that it happened. The firm cannot show which client’s data went where, or that it stayed within tools it had actually vetted.
The processing might have been perfectly lawful in principle; the firm simply cannot prove it, or prove the data did not leak into an unvetted service.
That reframing changes what a firm should build, and, just as usefully, stops it overbuilding. You do not need to log a lawful basis afresh on every AI interaction. That is theatre, re-recording a decision that was made, correctly, once. If a supplier implies that a log is what makes each use lawful, they have the model backwards.
The retainer and the processing record are what make it lawful. The log does something else, and the something else is worth having.
Do it properly, once
What a good record of AI use earns a firm is three things. It evidences accountability, because a standing basis a firm cannot show was actually applied is a weak thing to hold on the day a regulator or an insurer asks.
It proves that use stayed inside approved bounds, which is the real exposure in the case above, and a record of which tools received which data is how a firm shows that, and notices the moment it stops being true. And it answers the questions that arrive later: a subject access request asking who received my data, or a vendor breach asking whose data was exposed. Neither is answerable unless the trail was kept as the work happened.
None of that is satisfied by a policy document, and none of it requires re-litigating a lawful basis. So do the lawful-basis work properly, once. Establish it, document it, reflect it in the privacy notice, and spend the freed-up effort on the thing the law genuinely leaves a firm exposed on, which is being able to show what it did. Not a fresh basis for every click.
A dependable record that AI use happened where the firm approved it, and nowhere else.
Which raises the obvious question: if those duties amount to a specification, what does an environment built to satisfy them look like? That is the subject of the next article.
About the author
Ed Molyneux is co-founder and CTO of Moverly and the original author of the Property Data Trust Framework (PDTF), the open standard for machine-readable property data now being adopted across the industry. Ed writes about AI, property data infrastructure, and the future of conveyancing.
The views expressed in this article are those of the author and not necessarily those of Today’s Conveyancer. This article is general information, not legal advice.
