Closed System Legal AI: What the Term Should Mean

A closed system in legal AI is a tool that keeps each firm's documents and results walled off: nothing you upload is shown to other customers, pooled with their data, or published. The term has no standard definition, so a closed system claim is only as good as the vendor's written terms.

A vendor selling closed AI for law firms can mean at least three different things by the phrase. Before you compare two products, find out which meaning each one has in mind.

What is a closed AI system?

A closed AI system is one where what goes in stays with the customer who put it in. Your uploads and the output made from them are not visible to other customers, are not mixed into a shared pool, and do not change what the tool gives anyone else.

No bar rule or technical standard defines the phrase. It can mean three things, from weakest to strongest:

1. Separation between customers. Each firm's documents sit in their own space. Other customers cannot see them and they are not combined.
2. No learning from inputs. The provider does not use what you upload to train or adjust a model, so nothing from your file can surface in another user's results.
3. No outside party at all. The software runs entirely on equipment the firm controls, and no document leaves the building.

A product can meet the first and miss the second. It can meet the first two and still be a hosted service run by another company, which is far from the third. Bar guidance recognizes the range. The State Bar of California's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law describes tools "ranging from free and readily available to custom-built, proprietary formats" and says a lawyer's obligations depend partly on which kind is in use.

Schema Law uses the term on its own site and defines it in the first sense. The homepage calls the product "A closed system" and explains: "Documents stay inside the account that uploaded them. Nothing is pooled across firms, published, or made visible to other customers." Read that definition as written. It covers what other firms and the public can see, and no more.

How is a closed system different from a public chatbot?

A public chatbot is open to anyone, and its consumer terms may let the provider keep your inputs and learn from them. A closed system limits who can see an upload to the customer that made it and keeps one customer's material from shaping another's results. The difference is in the terms, not in how clever the tool is.

The D.C. Bar's Ethics Opinion 388 on generative AI in client matters asks two questions that mark the line: whether what you provide will be visible to the provider or to other outsiders, and whether your use will change what later users get in a way that could reveal it. The section on what the confidentiality rules require of a lawyer quotes both.

The opinion calls a yes to the first question "at least a red flag" and says a yes to the second "might be more challenging to resolve". It also quotes one provider's consumer privacy policy, which said the company may use what users submit "[t]o improve our Services and conduct research".

The left column is a pattern and not a verdict on any one product. Business plans of chatbot products often carry different terms from the free version, and the post on whether it is safe to upload legal documents to ChatGPT goes through that difference. Both the D.C. and California documents are about generative AI and each speaks for its own jurisdiction, so check what your bar has said.

Ask the vendor which clause of the terms of service matches the closed claim they are selling. Generative artificial intelligence can still learn from inputs inside a product that walls off other customers. Client confidentiality is the interest you are checking, so save the clause and the date beside the product name. If the answer lives only on a sales slide, keep looking until you have a document you can file.

What a closed system does not promise

A closed system claim does not, by itself, promise accurate output, a provider that cannot read your files, short retention, strong encryption or preserved privilege. Each of those is a separate question with a separate answer. Do not treat "closed" as a general seal of safety.

• Accuracy. A sealed system can still misread a page. Check output against the original every time.
• The provider's own access. In its weakest sense "closed" is about other customers. Whether the vendor's staff, or companies working for the vendor, can open a document is a different question.
• Training. Separation between customers does not rule out learning from inputs unless the vendor says so. The post on OCR that does not train on your data explains how to verify that claim.
• Retention. A closed system can keep your files indefinitely. See the post on whether OCR software stores your documents.
• Encryption. Closed describes who is allowed to see data. Encryption describes what a thief or eavesdropper can read. The post on encrypted OCR separates the two.
• Access inside your firm. A system closed to outsiders may still show every matter to every colleague with a login.
• Privilege. Whether using a vendor affects privilege is a legal question for your jurisdiction, covered in the post on attorney-client privilege and AI tools.

Schema Law's published commitments show the separation in practice. "Documents stay inside your own account" is the closed-system statement. Training, encryption and deletion each get their own line: "Your documents are never used to train an AI model", "Encrypted in transit and at rest" and "Delete any document, at any time". The security section of the homepage lists them together. Anything the site does not state, such as who at the company can open a document, is something to ask about and not to assume.

Questions that test a closed-system claim

Test a closed-system claim by asking for specifics in writing and comparing the answers with the published terms. The California guidance says general marketing assurances are not enough. A vendor that means what it says can answer eight plain questions without a sales call.

1. Which of the three meanings do you intend? Separation between customers, no learning from inputs, or no outside party at all.
2. How is one customer's data kept apart from another's? Ask for a description a non-engineer can follow.
3. Are uploads or outputs ever used to train, tune or evaluate a model, yours or anyone else's? Ask about defaults and about any exceptions.
4. Does any other company receive the document or its text during processing? If so, under what restrictions?
5. Which of your people can open a customer's document, in what circumstances, and is that recorded?
6. Is anything shared across customers, such as usage statistics or sample pages used for quality checks?
7. Where is this written? Ask which clause of the terms or contract contains each promise, and whether it can change without your consent.
8. What happens to our documents if we cancel, or if your company is sold?

Good answers name a clause, a role or a time period, and they match the privacy policy and terms on the day you read them. Save a dated copy of everything you receive.

Put the same eight questions to Schema Law. Its closed-system definition and its commitments are the company's own statements on its website and pricing page. They are not a substitute for your firm's review, and the Enterprise plan lists "Security questionnaire and contract review" for firms that run a formal one.

Record the answers where the rest of the firm can use them. The guide to a law firm AI policy for document uploads shows how to turn a vendor review into a register entry. This post is not legal advice, and the standard your review has to meet is set by the ethics rules of your own jurisdiction.