At half past six on a Thursday, a paralegal in the family department pastes a draft witness statement into a free chatbot to tidy the grammar before the partner reads it in the morning. The statement names the client, the opponent and a child of seven, and the firm has no record that any of it left the building.
Nobody meant any harm by it, the text came back cleaner, the paralegal went home, and the file shows nothing. Take an illustrative case of two people in a twenty person firm doing something similar once a week. That puts a hundred or so client documents a year into an outside service, and the firm cannot name the service, the country the processing happened in, or whether the text was kept.
The first instinct is to ban it. A prohibition announced at a Monday meeting changes the behaviour of the people who were never going to do it, and it moves everyone else onto a personal phone where you have no sight of anything at all. Staff reach for these tools because the work is hard and the deadline is close, and a ban addresses neither. What works is a sanctioned route paired with a written policy that names the tools you permit and says what each one can be used for, so the safe option is also the quick one.
Where the text goes
The question that decides whether a tool is safe is not how well it writes. It is what happens to the words once they leave the building. Ask whether the material is retained after the session ends, whether it trains a model, in which country the processing takes place, and whether a contract exists between your firm and that supplier at all. With a free consumer account the last answer is no. Your paralegal accepted consumer terms personally, the firm holds no rights against the supplier, no agreed security standard and no way to find out what became of the document.
Stripping out the names helps less than people expect. A witness statement stays identifiable from its facts, since the address, the dates, the school and the sequence of events describe one household and no other. Anyone holding the other side of the dispute would recognise it within a paragraph. Redaction is worth doing where it works, and it does not replace control over where the document travels.
You also need a record of what was sent, by whom and to what. If something goes wrong you have to assess it, and in some cases report it, on a short timetable, and no firm can assess an incident it cannot see. That is straightforward when the route is sanctioned and impossible when the work ran through someone's personal account. Supervision and training carry as much weight as any technical control, because the person at the keyboard has to know what good practice looks like at half past six with a hearing in two days.
What the rules expect
The SRA Standards and Regulations require you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. That duty attaches to the document and does not soften because the recipient is a piece of software rather than a person. Data protection law runs alongside it. Once personal data goes into an external service, the supplier is processing it on your behalf, which calls for a lawful basis, a written arrangement setting out what the processor can and cannot do with it, and a settled view of where the data sits. A free account gives you none of that, and the obligation stays with your firm.
That reasoning shapes how Bracton connects to your firm. The Bracton AI Assistant runs inside the case management system you already use, reading the record in place under permissions you set, so the work stays within your own system rather than being copied out to a service you have no agreement with. Every output goes to a qualified fee earner for sign off before anything is written back or sent, and the audit trail records what was done and by whom. Hosting is in the UK and client data is never used to train a model, and because Bracton has no customers yet both of those are commitments written into what a firm signs rather than a record of service already delivered. A firm wanting the same discipline across the whole file takes Bracton, the case and client management platform, in place of the system it runs now.
Test this on your own papers rather than in the abstract. Take one week of work in your firm and ask where the text went, and if you want to see what a sanctioned route looks like on your matters, book a client account review.