BAQ Guidelines for Cyber Risk Management and for the Use of AI in Legal Practice

In November 2025 the Bar Association of Queensland issued guidelines in relation to cyber security and artificial intelligence respectively to assist members in the conduct of their practices.

The legal profession is becoming an increasingly regular target of cybercrime attacks, and the Bar is no different. That is particularly the case given the number of confidential client documents members hold in their practice, and the nature of sole practitioners being responsible for their own infrastructure and cyber security.

Additionally, the growing availability of Artificial Intelligence (AI) tools and the efficiency gains they offer, must be balanced against their limitations. Careful consideration is required to determine how these tools should be used before they are adopted in practice.

The Bar Council considered it necessary to engage a third-party technology consultant to assist with the development of guidance documents so that members develop a sound understanding of how to use AI within their practice and how members might safeguard themselves against cyber risk.

Technology and data systems underpin many of the services delivered by barristers. While these tools offer efficiency, they can also present challenges regarding data security and professional responsibility.

To assist members in meeting these challenges, the Association, with the assistance of Willis Towers Watson, has developed the following guidance documents:

1. Guidelines for Cyber Risk Management
2. Guidelines for the Use of Artificial Intelligence in Legal Practice

The Guidelines for Cyber Risk Management outline some “minimum cyber security controls” that all members should implement to increase the strength of their security measures, safeguard confidential information and protect from cyber threats. Additional controls for larger and more complex practices are also set out in these guidelines.

The Guidelines for the Use of Artificial Intelligence in Legal Practice are concerned with the responsible use of AI tools, including Large Language Models (LLMs). While AI can improve efficiency, it contains a number of limitations, such as the potential for “hallucinations”.

Cybersecurity is a shared risk and the careless use of technology can have lasting effects on your practice, your clients and the administration of justice. Failing to take adequate measures to effectively manage cyber risk may also, in certain circumstances, constitute unsatisfactory professional conduct or professional misconduct. You are encouraged to review these guidelines and consider what changes may be necessary in your practice