# Law-firm employee AI-use control worksheet

Blank worksheet for planning and recording a synthetic control test. It provides general information based on Australian professional guidance; no completed test result is supplied.

Use invented inputs and aliases only. Do not put real client information, privileged material, credentials or matter identifiers in this worksheet. A synthetic test does not authorise production use.

## 1. Define the review

| Field | Record |
| --- | --- |
| Firm/team alias | [record] |
| Applicable jurisdiction and professional rules | [record] |
| Responsible lawyer and security/privacy owners | [record] |
| AI product, plan, account/workspace | [record] |
| Installed security client and release | [record] |
| Device OS/browser and input path | [record] |
| Policy version and intended rule | [record] |
| Provider contract/settings evidence | [record] |
| Aona hosting/processing and AI-provider handling, recorded separately | [record] |

## 2. Define the synthetic test

Illustrative rule: client contact details must not be submitted to an AI tool unless the firm has approved that use.

Challenge: Summarise the renewal notes for Fictional Client A. Contact: alex.morgan@example.com.

Comparison: Summarise the public renewal checklist without any client contact details.

| Field | Record |
| --- | --- |
| Expected action (confirm supported configuration first) | [record] |
| Test date and environment alias | [record] |
| Observed response to challenge | [record] |
| Observed response to harmless comparison | [record] |
| Available policy event / evidence reference | [record] |
| Unresolved behaviour, missing event or coverage gap | [record] |

## 3. Keep technical result and legal approval separate

| Field | Record |
| --- | --- |
| Technical result: not tested / pass / fail / unresolved | [record] |
| Reviewer and review date | [record] |
| Legal/privacy questions still open | [record] |
| Professional approval, if actually given, and its scope | [record] |
| Next action and review trigger | [record] |

Leave unavailable results blank or unresolved. Do not convert missing evidence into a pass. A product plan, region, contract or successful control test does not establish privilege or legal compliance.

## Sources and next steps

Sources checked: 21 September 2026. This is general information, not legal advice. Confirm applicable rules and firm or matter-specific decisions with the responsible lawyer.

- [Joint Australian legal regulators’ AI statement](https://lsbc.vic.gov.au/news-updates/news/statement-use-artificial-intelligence-australian-legal-practice)
- [Australian Solicitors’ Conduct Rules](https://lawcouncil.au/policy-agenda/regulation-of-the-profession-and-ethics/australian-solicitors-conduct-rules)
- [OAIC commercial-AI guidance](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)
- [Return to the law-firm guide](https://aona.ai/resources/guides/ai-governance-law-firms/)
- [Open the law-firm policy template](https://aona.ai/resources/templates/ai-policy-law-firms/)
- [Review the legal-team solution](https://aona.ai/solutions/ai-governance-legal/)