> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-6.md).

# Legal compliance

Legal compliance — privilege, work product, court rules, bar discipline, malpractice exposure, retention.

Legal AI's compliance frame is **bar discipline + court rules + privilege protection** — not regulatory enforcement in the same sense as financial services or healthcare. But the consequences of misconduct are public, professionally damaging, and increasingly financial.

## Regulatory frame

| Regime                                | Applies when                                    | Evaluation-evidence shape                                       |
| ------------------------------------- | ----------------------------------------------- | --------------------------------------------------------------- |
| **Court rules of procedure**          | Filing AI-assisted briefs in any jurisdiction   | Citation-existence audit trail, attorney certification          |
| **Bar Rules of Professional Conduct** | All licensed-attorney practice; varies by state | Documentation of attorney supervision over AI output            |
| **Attorney-client privilege**         | Any AI processing of privileged communications  | Privilege-detection accuracy, tenant isolation                  |
| **Work-product doctrine**             | AI processing litigation work product           | Same as privilege                                               |
| **GDPR / CCPA / state privacy**       | Discovery / e-discovery handling personal data  | PII redaction, data subject rights handling                     |
| **Court sanctions**                   | Filing fabricated citations or unverified work  | Pre-filing evaluation evidence; *Mata v. Avianca* line of cases |
| **Malpractice insurance**             | All practice; carrier-specific requirements     | Documentation of AI-supervision protocols                       |

## Court rules and the *Mata* doctrine

*Mata v. Avianca, Inc.*, No. 22-cv-1461 (S.D.N.Y. June 22, 2023) and successor cases establish:

* Attorneys remain personally responsible for verification of every citation in a filing
* AI-generated material does not lower this bar
* Some courts (S.D.N.Y., N.D. Tex., others) now require disclosure of AI assistance in filings
* Sanctions cited in *Mata* line: $5K + reputational

**Stratix evaluation evidence supports court compliance:**

* Citation-existence audit trail — every filed citation tied to an evaluation that verified its existence
* Attorney-certification workflow — evaluation gate is hard; only after the attorney explicitly acknowledges can the output be acted on
* Audit retention — Enterprise tier retains the evaluation evidence indefinitely

## Bar Rules of Professional Conduct

State-by-state variance, but common themes:

* **Competence** (Rule 1.1) — attorneys using AI must understand its limitations
* **Supervision** (Rule 5.3) — AI as non-lawyer assistance must be supervised
* **Confidentiality** (Rule 1.6) — privileged material must not flow to third parties without consent
* **Communication** (Rule 1.4) — clients should be informed about AI assistance per state rules

## Attorney-client privilege

Privileged communications must not enter trace bodies in plaintext unless:

* Stratix Enterprise tier with executed terms protecting privilege (talk to legal)
* Tenant isolation enforced — privileged data confined to the firm's tenant

**Recommended trace-handling pattern:**

* Strip privileged content before posting to traces
* For privileged matter analysis, use BYOK custom models running in the firm's own infrastructure (no external SDK calls)
* All trace evaluations on privileged material must occur within the firm's tenant boundary

## Work-product doctrine

Same as privilege: never expose litigation work product to systems outside the firm's tenant. Audit-log who-accessed-what.

## GDPR / CCPA / state privacy in discovery

Discovery review at scale processes large volumes of personal data. Compliance considerations:

* PII / personal-data detection scorer at ≥99% recall
* Per-jurisdiction handling — EU subject data may not flow to US-region tenants without proper transfer mechanism
* Data Subject Right responses — Stratix supports DSR via <security@layerlens.ai>

## Malpractice exposure

Multi-million-dollar settlements documented for AI-assisted misconduct. Mitigations:

* Pre-filing evaluation evidence package per matter
* Attorney sign-off recorded against each evaluation ID
* Audit retention matching the longest applicable record-retention period

## Recommended setup

1. Enterprise tier with executed DPA and tenant isolation contractual terms
2. SSO with role-based access; client-matter-based segmentation
3. BYOK custom models for privileged-matter analysis (firm's own inference)
4. Citation-existence hard gate on every filed-output path (zero unverified citations reach a brief)
5. Audit retention matching state bar record-retention requirements
6. Per-matter audit log — every AI interaction tied to a matter file

## See also

* [Industry pattern: AI research citation verification](/4.2-industry-use-cases/pattern-2.md)
* [Enterprise](/more-in-this-section-2/legal.md)
* [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)