Client Confidentiality, Privilege & AI Risk
Lawyers, accountants, and consultants hold information clients gave them in trust, and that duty doesn't pause when an AI tool is in the loop. This course covers the rules that apply to AI use on client matters, including confidentiality, privilege, competence, supervision, and candor, as professional guidance stood in September 2026. You'll learn how breaches actually happen, from the consumer-tool paste and vendor data flows to deepfake impersonation, fabricated citations, and shared tools that cross ethical walls. You'll finish with the firm controls and a personal checklist that keep AI use defensible on every engagement.
Course details
Duration
1h 21m 13s
Lectures
15
Video
1.5 hours
Quizzes
1
Level
Beginner
Course Description
Sending client information to a system outside the firm's control is a disclosure, even if no person ever reads it. This course shows lawyers, accountants, and consultants how AI tools put confidentiality and privilege at risk, and the controls that let a firm use them without a breach, a waiver, or a sanction.
What you'll learn
- What confidentiality, privilege, competence, supervision, and candor require when a tool is in the loop
- Four questions to ask before client information enters any tool
- Why the consumer-tool paste is a breach, and the vendor terms a firm needs
- Verification habits that defeat cloned voices, forged threads, and fabricated citations
- Keeping ethical walls intact inside shared AI tools
- Approved-tool lists, engagement-letter AI clauses, consent, incident response, and a reporting culture
Who it's for
Lawyers, accountants, consultants, and the partners, general counsel, risk staff, and teams who handle client information at professional firms.
15 short video lessons in three modules: The Rules; The Risks; and Controls.
This course is educational and is not legal, accounting, or professional-responsibility advice. Your firm's policies, general counsel, and professional rules govern.
Module 1: The Rules
-
1.1 Confidentiality in an AI WorldWhat the duty of confidentiality requires when a tool is in the loop.
In this lesson:
- State what the duty of confidentiality covers and requires
- Recognize when sending information to a tool is a disclosure
- Apply four questions before client information enters any tool
-
1.2 Privilege and Waiver
How using a tool can risk privilege, and how to avoid it.
In this lesson:
- Distinguish privilege from confidentiality and identify who holds it
- Recognize how a tool can put privilege at risk
- Apply privilege-preserving practice to AI-assisted work
-
1.3 Competence and Supervision
The duty to understand the tools you use, and to supervise the people and vendors who use them.
In this lesson:
- Describe what technological competence requires with AI tools
- Extend supervision to juniors, staff, tools, and vendors
- Keep competence current without becoming an engineer
-
1.4 Candor and Accuracy
The duty not to file, sign, or deliver what you haven't verified.
In this lesson:
- State the duty of candor and accuracy as it applies to AI-assisted work
- Apply the verification standard before anything leaves the firm
- Decide when the use of a tool must be disclosed
-
1.5 Regulator and Bar Guidance at Principle Level
What professional bodies have said about AI use, as of September 2026, and how to follow the guidance that governs you.
In this lesson:
- Summarize the five themes that recur across professional AI guidance
- Answer the questions the guidance expects a professional to answer
- Identify and follow the specific guidance that binds you
Module 2: The Risks
-
2.1 The Consumer-Tool Breach
Client data in a public assistant — how it happens, why it's a breach, and what to do when it's discovered.
In this lesson:
- Recognize how the consumer-tool breach happens in practice
- Explain why it's a breach regardless of the output
- Take the right first steps when it's discovered
-
2.2 Vendors and Data Flows
Where the data goes inside a vendor tool; agreements; training use.
In this lesson:
- Trace where client data goes inside a vendor AI tool
- Identify the vendor terms a firm needs before client information enters a tool
- Ask the right questions about any tool you use
-
2.3 Deepfakes and Impersonation
The client, the partner, the opposing counsel who wasn't — and the procedures that catch them.
In this lesson:
- Recognize the impersonation patterns that target professional firms
- Apply verification habits that defeat cloned voices and forged threads
- Respond correctly when an approach feels wrong
-
2.4 Fabrication and Reliance
The citation, the figure, the fact that wasn't — and why reliance is the real risk.
In this lesson:
- Recognize how fabrication shows up in legal, accounting, and consulting work
- Explain why reliance, not use, is the violation
- Apply the verification discipline that catches fabrication before it leaves the firm
-
2.5 Conflicts and Confidential Information in Shared Tools
Walls, access, and audit inside a shared AI tool.
In this lesson:
- Explain how a shared tool can breach an ethical wall
- Specify the access design a firm needs for shared tools
- Make the wall provable through logging and testing
Module 3: Controls
-
3.1 The Firm's Approved-Tool List
What the list contains, how it's maintained, and how you use it.
In this lesson:
- Describe what an approved-tool list entry must contain
- Explain how the list is maintained so it stays a control
- Use the list correctly in daily work
-
3.2 Engagement Letters and Client Consent
What to say about AI in the engagement letter, and when consent is required.
In this lesson:
- Draft the elements of an AI clause for an engagement letter
- Distinguish uses that require consent from those that need only notice
- Handle clients who restrict AI use and clients who want more of it
-
3.3 Incident Response for a Firm
The first hour, the client conversation, and the record.
In this lesson:
- Run the first hour of an AI-related incident at a firm
- Conduct the client conversation with candor and coverage intact
- Build an incident record that holds up when produced
-
3.4 Training and Culture
Reporting without blame in a firm.
In this lesson:
- Design AI training that changes behavior in a firm
- Distinguish a blame culture from a reporting culture
- Send the signals, as a senior professional, that build a reporting culture
-
3.5 Your Confidentiality Checklist
The one-page rules, your personal checklist, and your next engagement; the finale.
In this lesson:
- Keep the one-page rules for AI use on client matters
- Run the personal checklist on every engagement
- Complete Client Confidentiality, Privilege & AI Risk
Client Confidentiality, Privilege & AI Risk — Final Exam
Learn at your own pace
Study the materials at your convenience, you can always return to them to repeat
Certificate of completion
Complete every lesson and pass the final exam to earn a RiseCert certificate of completion you can download and share.
Your Name
Client Confidentiality, Privilege & AI Risk
RISECERT
CERTIFICATE
For demonstrated knowledge and successful completion of all course requirements for:
MM.DD.YYYY
Certificate Date
Ready to get started?
Enroll in Client Confidentiality, Privilege & AI Risk and earn your RiseCert certificate of completion.
Got Questions? We've Got Answers!
Answers to the most common questions about this course.
What is the Client Confidentiality, Privilege & AI Risk course?
Client Confidentiality, Privilege & AI Risk is a RiseCert online course for lawyers, accountants, and consultants who use AI tools on client matters. It covers the professional rules that apply, the ways AI puts client information at risk, and the firm controls that prevent breaches, waivers, and sanctions. It includes 15 video lessons (about 1 hour 25 minutes) and a final exam.
Who should take a course on client confidentiality and AI?
Lawyers, accountants, tax professionals, and consultants who handle client information, along with the partners, general counsel, risk and IT staff, and tool owners who set and enforce a firm's AI rules. Associates and staff benefit too, because the most common breach the course covers is a capable person with a deadline and a personal AI account.
Is putting client information into a public AI chatbot a breach of confidentiality?
As the course teaches it, yes. Sending client information to a system outside the firm's control is a disclosure, even if no person reads it. A personal account on a public assistant runs under consumer terms that may allow retention, human review, or training use, with no firm contract or record. The breach happens at the paste, however good the output is.
Can using AI tools waive attorney-client privilege?
It can put privilege at risk. Privilege protects confidential advice communications, the client holds it, and disclosure to a third party can waive it. As of September 2026 courts decide tool questions case by case, so the course teaches conservative practice: contracted tools that act as the firm's agent, a closed circle, prompts treated as documents, and asking when unsure.
What vendor terms does a firm need before client data enters an AI tool?
The course lists a written agreement covering confidentiality, security, and breach notification; no training or model improvement on the firm's inputs or outputs, stated plainly; limited, defined retention with deletion on request; listed subprocessors and known data location; and access controls with audit rights or assurance reports. Consumer or free-tier terms are not acceptable for client information.
Does the course cover deepfakes and impersonation fraud at firms?
Yes. A lesson covers cloned voices, synthesized video, and forged email threads used to change payment details, release documents, or alter instructions. As of September 2026 a familiar voice or face is not proof of identity, so the course teaches procedures: call back on a known number, confirm money and releases out of band, and treat urgency as the tell.
What should I do if I pasted client data into an unapproved AI tool?
The course's answer: stop using the tool on the matter and preserve the conversation, because it is the record of what went in. Report it the same day to general counsel or the firm's incident channel, assess with counsel, and let counsel decide how the client is told. Do not delete the conversation; hiding it is the second, worse breach.
Do I need client consent to use AI on a client matter?
Sometimes. The course explains that consent is required or expected when sensitive or privileged information enters a third-party tool, for uses the engagement letter didn't cover, for regulated data, and where client policy or a prior restriction applies. Routine drafting aids inside the firm's environment usually need notice in the engagement letter. When in doubt, ask.
Is the course only for lawyers?
No. The course is written for lawyers, accountants, and consultants alike. It notes where the professions differ, for example that privilege is usually a lawyer's protection and often narrower or absent for accountants and consultants, while confidentiality, competence, supervision, and candor apply across all three. Examples cover filings, audits, tax work, and consulting reports.
What will I be able to do after completing the course?
You'll be able to apply four questions before client information enters a tool, protect privilege in AI-assisted work, supervise people and vendors, verify AI output before it leaves the firm, spot impersonation attempts, keep ethical walls intact in shared tools, use an approved-tool list correctly, draft an engagement-letter AI clause, and run the first hour of an incident.
Do I need technical skills or prior AI experience?
No. The course is written for practicing professionals, not engineers, and there is no coding. It explains in plain terms where client data goes inside a vendor tool and which contract terms matter. Its competence standard is not technical expertise, but being able to explain why you trusted a tool on a matter.
Is the course content up to date?
Yes. The course summarizes professional and regulator guidance at principle level as of September 2026, including the five themes that recur across it and the spread of court certification requirements for AI-assisted filings. Because guidance keeps being revised, the course also shows how to find and follow the specific guidance that binds you.
How long is Client Confidentiality, Privilege & AI Risk?
The course has about 1 hour 25 minutes of video across 15 lessons, plus a final exam. Lessons run about five to six minutes each and are organized into three modules: The Rules; The Risks; and Controls. Most learners finish in two or three sittings.
Is the course online and self-paced?
Yes. The course is 100% online and self-paced, and your access does not expire. You can start, pause, and resume at any time on a computer, tablet, or phone with a modern web browser. There's nothing to install.
Is there a final exam?
Yes. The course ends with a 30-question multiple-choice final exam covering all three modules. You need a score of 80% or higher (24 of 30) to pass, and you can retake the exam as many times as you need. Finish all 15 lessons and pass the exam to complete the course and earn your certificate.
Do I get a certificate of completion?
Yes. After you complete all 15 lessons and pass the final exam, you can download a RiseCert certificate of completion from your account. It is a course completion certificate, not a license, professional certification, or continuing education (CLE or CPE) certificate.
Does the course count for CLE, ethics, or CPE credit?
No. The course is not currently approved for continuing education credit of any kind, including CLE or ethics credit for lawyers and CPE for accountants, by any bar, board, or accrediting body. For required credit hours, take a course approved by the relevant body. This course complements that training with practical AI confidentiality controls.
Is this course legal or professional-responsibility advice?
No. Client Confidentiality, Privilege & AI Risk is educational and is not legal, accounting, or professional-responsibility advice. It explains principles that recur across professional guidance, but the rules that bind you differ by profession and jurisdiction. Your firm's general counsel, policies, professional rules, and local law govern specific decisions.
How much does the course cost, and can I enroll my team?
The course costs $99 per learner as a one-time purchase, with no subscription or recurring fees. To enroll a practice group, office, or whole firm, contact RiseCert through the Contact Us page at risecert.org.
What is the refund policy?
All sales are final and no refunds are issued, as stated in the RiseCert Terms of Use. Please review the course description, lesson list, and these FAQs before purchasing, and contact RiseCert with any questions first.