Harrington & Cole LLP
How a 650-attorney AmLaw 100 firm secured AI adoption across litigation, corporate transactions, and regulatory practice groups — without restricting the tools attorneys rely on.
Partners were using AI with client data — and no one had visibility.
Harrington & Cole LLP — a 650-attorney AmLaw 100 firm with offices across six cities — discovered a governance gap that no amount of acceptable use policies could close.
Associates and partners were using ChatGPT to draft client memos, summarize deposition transcripts, and research regulatory precedent. Paralegals were using Microsoft 365 Copilot to organize case files and generate first drafts of discovery responses. In every case, privileged client communications, case matter numbers, and confidential deal terms were flowing to external AI endpoints with no inspection, no enforcement, and no record.
The risks were specific and immediate. ABA Model Rules 1.6 requires attorneys to make reasonable efforts to prevent unauthorized disclosure of client information. Case matter numbers in AI prompts could expose the firm's client relationships — a competitive intelligence risk that opposing counsel firms actively monitor. Privileged legal strategy memos in AI conversation logs could waive attorney-client privilege entirely, with catastrophic consequences for active litigation.
The firm's general counsel was clear: blocking AI tools would drive adoption underground and create worse exposure. The firm needed to keep the tools and add the governance layer that didn't exist.
Arbitex Gateway — deployed across OpenAI and Microsoft 365 Copilot traffic.
Harrington & Cole deployed Arbitex Gateway as the enforcement layer between their attorneys and external AI providers. All ChatGPT and Microsoft 365 Copilot traffic routes through the gateway, where every request is inspected by the 3-tier DLP pipeline before any data reaches a model endpoint.
The IT security team worked with the firm's ethics counsel to configure six DLP rules targeting the firm's highest-risk data categories:
Case matter numbers trigger BLOCK actions — the request never reaches the model, preventing any exposure of the firm's client relationships. Attorney-client privilege indicators — keyword patterns that identify privileged strategy discussions, settlement authority, and case assessment language — also trigger BLOCK to prevent inadvertent privilege waiver. Client names and PII trigger REDACT, replacing sensitive values with placeholders so attorneys can still get useful AI responses for drafting and research workflows.
Opposing counsel strategy memos use AI-powered contextual validation to distinguish between general legal research and privileged case strategy — catching content that keyword rules alone would miss. Identity integration via SAML 2.0 ties every AI interaction to a specific attorney, practice group, and matter, creating the audit trail the firm's ethics committee requires.
Full AI access for every attorney. Full compliance for every interaction.
Within the first quarter, Arbitex processed over 4,200 protected conversations per month across the firm's AI traffic. The gateway blocks case matter numbers, privilege indicators, and opposing counsel strategy content before they reach model endpoints — each one a potential ethics violation or privilege waiver that was prevented without disrupting the attorney's workflow.
The firm achieved 100% ABA Model Rules 1.6 compliance attestation during its annual ethics review. The tamper-proof audit log served as the primary evidence that reasonable efforts were being made to prevent unauthorized disclosure — the exact standard the rules require. The ethics committee can reconstruct the complete enforcement history for any attorney, any interaction, any time period.
Zero client confidentiality incidents were reported in the first year following deployment. Associates report that productivity has been maintained — the redaction approach means attorneys get useful AI-generated drafts while client PII and case identifiers are stripped before the model processes the request. The firm's general counsel now cites the deployment as a model for responsible AI adoption in legal practice.
“We had 650 attorneys using AI tools with client data and no way to enforce our ethical obligations at the point of interaction. Arbitex solved the problem we couldn't solve with policies alone — it enforces ABA confidentiality requirements on every AI request, logs every enforcement action, and gives our ethics committee the evidence they need. Our attorneys kept their productivity tools. Our clients kept their privilege.”
Related Resources
Protect privileged communications across every AI tool your attorneys use.
Talk to an Arbitex engineer about DLP enforcement for case matter data, privilege protection, and ABA compliance evidence for your next ethics review.