Map AI Connections Before a Law Firm Connects Data

Moses Dor, Adv. · November 8, 2026 · 7 min read

Map AI Connections Before a Law Firm Connects Data

By Moses Dor, Adv., an Israeli practising attorney and founder of BizLegal AI. Last updated: 2026-11-08.

A prompt describes a task. A connection decides which data the system can reach and what it can change. In a law practice, the connection deserves its own written review.

Start with one draft-only workflow and list every account, folder, label, API, and vendor involved. Do this before granting access.

Draw the shortest possible route

For an intake-table exercise, the route might be:

selected intake messages -> extraction step -> draft table -> lawyer review

Do not begin with the whole mailbox. Give the first test a dedicated label or a set of synthetic messages. The system should receive only the material needed for that run.

Add storage to the route. If the tool keeps prompts, attachments, logs, or generated tables, write down where each item is stored and who can retrieve it. "In the vendor" is not enough for an internal record.

Record whose data each connection holds

An account name does not identify the people whose information is inside it. A practice-management system can contain clients, prospective clients, opposing parties, witnesses, staff, and vendors.

Use a connection table:

| Connection | Data subjects | Read or write | Selected scope | Storage after run | Owner | |---|---|---|---|---|---| | Intake label | Prospective clients | Read | Messages chosen for the test | Source mailbox | Intake lawyer | | Draft folder | Firm staff | Write draft only | One output folder | Firm document store | Practice owner | | AI vendor | Depends on selected message | Process | One run | Verify in vendor terms | Practice owner |

If a row has no owner, the connection is not ready. Someone must be able to remove access, retrieve the log, and answer a data question.

Start read-only

Read access can still expose confidential information, so it is not harmless. It is easier to contain than write access.

A first test should not send a message, create a calendar entry, alter a matter record, delete a file, or file anything with a court or authority. The output goes to a draft location that the reviewer already controls.

Write access belongs in a later decision. It should not appear because a vendor requested a broad permission set during installation.

Ask what the vendor does with the data

The connection map should record answers to a short set of questions:

1. Are prompts, files, and outputs used to train any model?
2. Where are they processed and stored?
3. How long are they retained, including logs and backups?
4. Which subprocessors can receive them?
5. Can the firm delete the material and close the account?
6. What security and incident information does the vendor provide?
7. Does the contract cover professional, confidential, and personal data?

Marketing pages are not a substitute for the contract, privacy notice, data-processing terms, and product settings that apply to the account being used.

If an answer is unclear, record it as unclear. Do not turn silence into a favourable assumption.

Test the off switch

Removing the application from a dashboard is not a complete stop test. Check:

• the token or connection no longer works;
• scheduled runs stop;
• shared links no longer grant access;
• retained prompts, files, and outputs follow the stated deletion process;
• logs preserve enough information to show when access ended.

Record the date, tester, and result. A control that has never been tested is a plan, not evidence.

Check the client and jurisdiction questions

The connection map does not answer whether a client must be told, whether consent is required, whether a transfer is permitted, or whether the use is consistent with professional duties. It gives the responsible lawyer the facts needed to answer those questions.

ABA Formal Opinion 512 is nonbinding ABA guidance on applying existing Model Rules to generative AI. State rules and opinions control for US lawyers.

Israeli lawyers need separate analysis under applicable Israeli professional, confidentiality, privacy, privilege, and advertising rules. ABA guidance can be comparative material, but it is not Israeli authority.

Next step

The proposed asynchronous workshop uses the connection map after the role-card exercise. The workshop is parked. The waitlist and price question collect demand without opening checkout or sending marketing email.

This article is general educational information and software guidance. It is not legal advice, does not create an attorney-client relationship, does not recommend a vendor, and carries no CLE, CPE, or other professional credit. Do not include client names, matter facts, documents, screenshots, or credentials in the waitlist or workshop.