Putting AI inside your Clio practice without handing over a privileged file

The pitch lands in every legal newsletter now: connect AI to Clio and stop clicking through matters to find the one document you need. It demos beautifully. Then the managing partner asks the question that actually matters. When this thing reaches into our matters, who is accountable for what it touches, and can we prove it later? Most of the time, nobody checked.

That question is the engagement. Settle it before you connect anything.

Two ways “just connect AI to Clio” goes wrong

The data takes a detour you didn’t authorize. Most consumer AI integrations route your prompts and the documents you attach through the vendor’s own service. For a firm, that means privileged matter content, an engagement letter, a sealed filing, leaving your control so the feature can work. The convenience and the exposure travel on the same wire, and you find out which folders went where only if you go looking.

It acts, and nobody signed off. Reading a matter is low-risk. But the same assistant that finds a document can move it, file a new version over it, or delete it. An assistant that is eager and slightly wrong renames the wrong file, drops a note on the wrong matter, closes a matter that wasn’t finished. In a practice where the document is the work, an unattended write is a malpractice question, not a productivity one.

Both failures come from the same mistake: treating “AI over Clio” as a feature you switch on instead of a system you operate.

The server is yours, or it isn’t

The first decision is where the assistant runs and whose account it uses. The version worth having registers as an application in your own Clio account, runs on your own machines, and signs in through Clio’s own login. Matter data and privileged documents move only between your machine and Clio. Nothing is sent to an outside service for the feature to function. When you want it gone, you revoke one connection and every door it opened closes at once.

That is the difference between renting a feature and owning an operation. A rented feature decides what happens to your data. An owned one does what you tell it, and stops when you say stop.

The audit answers “who touched this,” not “what was in it”

Every action the assistant takes against a matter or a document should land in an append-only record: the time, the person, the matter, the document, and what was done. And it should record exactly that and nothing more. The contents of the privileged document never go into the log, because a log that copies privileged content has only created a second privileged thing to protect.

This is the artifact that answers the ethics question. Who opened the Henderson file, when, and on whose authority. You can show it to a client, a regulator, or your malpractice carrier without exposing the work itself.

The one rule: nothing destructive happens without a person

Here is the rule, written so a managing partner can hold the firm to it:

The assistant prepares. A person decides anything that can’t be undone.

Concretely, reading and drafting run freely. But any move, overwrite, or deletion stops and shows exactly what it is about to change, then waits for a yes. Anything that leaves the firm, a filing, a client email, is attorney-approved. The assistant never gives legal advice and never signs off. When it is unsure, it pauses and routes to the responsible attorney instead of guessing.

Where the governance line sits is your call, not the tool’s

A two-person practice that trusts each other completely wants control and a record, without much ceremony. A firm with associates, contract attorneys, and matters that can’t cross between them wants something stronger: a rule for who may touch which matters, a human approval gate before consequential actions, and one firm-wide trail a compliance reviewer can read in a single place.

The point is that this is a dial you set, not a default the vendor sets for you. The same assistant should run firm-controlled today and firm-governed later, without being rebuilt. You move the line when the firm grows into it.

What good looks like

• The assistant runs on your own Clio account, with case data never routed through a third party.
• An append-only record of every action, by person and matter, that never stores the privileged contents.
• Nothing destructive or outbound happens without an explicit, human yes.
• A clear, written answer to “what can this assistant do, and on whose behalf,” before launch.
• The whole thing scoped to one matter workflow first, proven, then widened.

None of that is exotic. It’s the difference between connecting a chatbot to your practice and operating a system that happens to use AI.

Start with one workflow

If your firm is eyeing AI on top of Clio, the move isn’t to connect something and see what it does in your live matters. It’s to take the one document-and-matter workflow that costs you the most time, decide what the assistant may read and what it may never do unattended, and prove it on that workflow before it touches the rest of the practice.

That’s the work we do in a workflow diagnosis. No tools installed, no data moved. We map how a matter actually moves through your firm, where the privilege lines have to hold, and what a Clio assistant would need to obey to be both useful and safe. You walk out with the map whether or not you ever hire us.

Book a workflow diagnosis →