9
The Word That Decides Your Liability Starts With “Reasonable”
Pull up the duty that governs your work and you will eventually trip over the same word. It appears in competence rules for lawyers and accountants, in the standard of care every professional carries, and in the question an insurer forms when a claim lands. The word is reasonable. It has always been there. What changed is that it now has an appendix nobody gave you.
Reasonable no longer means what it meant three years ago. The community that decides it—your clients, your malpractice carrier, the regulator with a file on your desk—has quietly decided that a professional who does not account for the tools already in their own building is no longer behaving reasonably. No statute had to move. No new rule had to drop. The standard simply relocated.
Why “reasonable” moved underneath you
Standards of care are not voted on. They settle like sediment, one authority at a time. A client asks how their confidential records are handled and does not like the shrug. A carrier reviews a claim and notes that a junior associate ran a conflict check through a consumer chat tool. A firm loses a matter because an answer it fed a public model is now evidence somewhere it cannot see. None of these is a new law. Each is just one more layer of what a careful professional would have done.
Here is the uncomfortable arithmetic: the exposure rises from the ordinary, not the exotic. It does not take a grand leak to change the standard. It takes a partner who concludes that because the whole firm uses the same tool, the practice must be fine.
The four ways a firm becomes the cautionary example
When we sit across from a managing partner and map where the standard has quietly moved, the same four gaps surface every time.
1. Public prompts are treated as private. A phrase pasted into a free assistant is a transfer of your client’s confidential matter to terms you cannot read, retained on systems you do not control. Reasonable professionals stopped calling that a risk and started calling it a known exposure.
2. “We have a policy” gets confused with “we have control.” A document that says employees should be careful does not tell you what is actually running, where, or on whose authority. A policy nobody can verify is a policy that does not protect you.
3. Competence gets updated slower than the tooling. The duty to stay current was always there. Now the baseline includes knowing what a language model can and cannot do with your data—and being able to say so when asked.
4. The client’s new question goes unanswered. More clients now ask, as a condition of engagement, how their matter will be handled. A vague answer today becomes a painful admission the day something goes wrong.
The test most firms cannot pass yet
Try the version of the question that matters. Hand a senior person a list of ten ordinary tasks—a conflict check, a draft, a code review, a data call—and ask what tool runs each one, what happens to the input, and how long it is kept. The firms that can answer without checking are rare. That answer, on that day, is a fair snapshot of where your standard of care actually stands.
Getting ahead of the shift
You do not have to wait for the claim to set the precedent for your firm. The firms that have handled this well started with the same move: they stopped debating the principle and started measuring their own ground. Know what runs where. Decide deliberately what a reasonable firm keeps inside its own walls. Write it down so the answer does not live in one person’s head. And when a client asks, be able to say it plainly.
The word in the rule has not changed. The ground beneath it has. Getting your firm onto that ground is a project, not a policy bullet—and like most projects worth doing, it starts with a clear look at where you are right now.
Run the Confidential AI Exposure Checklist and see exactly where your firm stands before the standard moves any further.