Legal AI in Singapore: A Checklist for Law Firms

Current as at 17 October 2026. This checklist is designed for partners, knowledge lawyers, IT leaders and risk owners evaluating legal AI in Singapore. It concerns tools used by lawyers and legal teams in professional workflows, not autonomous legal services.

Legal AI Singapore: A Firm-Governance Decision

A legal AI procurement decision is not only a product comparison. The proposed tool may receive matter documents, prompts containing client context, research questions, draft submissions, or other information that is commercially sensitive, confidential or personal. Yet firms can reach the purchasing stage before they have agreed which work is in scope, what data may be used, who reviews outputs, or how issues will be escalated.

Those decisions should be made before broad deployment. A product can be useful in a narrow, supervised workflow and unsuitable for another workflow involving a different category of matter material. The relevant question is therefore not whether a tool is “safe” in the abstract. It is whether the firm can govern a defined use case with appropriate professional review, information controls, technical safeguards and contractual protections.

Singapore’s judiciary has identified training, internal governance and business practices as areas law firms may need to re-examine as they incorporate AI into their processes. Justice Valerie Thean’s 2025 Litigation Conference speech is a useful reminder that adoption decisions extend beyond a software feature list.

For court-facing workflows, the Singapore Courts’ Guide on the Use of Generative Artificial Intelligence Tools by Court Users is a published reference for preparing court documents with generative AI tools. A firm policy should also address confidentiality, professional review and data-protection obligations.

For legal work more broadly, the Ministry of Law published its Guide for Using Generative AI in the Legal Sector on 6 March 2026. The guide is not binding and is meant for the whole legal services sector, including in-house legal teams. It rests on three principles: professional ethics (legal professionals remain responsible for all work products), confidentiality of client data, and transparency with clients about how generative AI is used. It is a sensible baseline for any firm assessing a tool.

Use the following checklist to separate two matters that vendors and buyers sometimes combine: product capabilities (what the system does) and firm governance controls (how the firm permits, supervises and evidences its use).

1. Map the work and information before comparing products

Start with workflows, not model names. Identify the specific tasks the firm intends to support, such as first-pass research, drafting from approved precedents, document review, chronology building, summarisation, or internal knowledge retrieval.

For each task, record:

• the intended users and their level of supervision;
• the source systems, matter workspaces and client processes the tool would touch;
• the inputs likely to be entered, uploaded or connected;
• the output’s intended use, including whether it could inform advice, correspondence, negotiations or court documents; and
• the review point at which a lawyer accepts, revises or rejects the output.

Classify information into practical categories: public material; internal operational information; confidential firm information; confidential client or counterparty material; and personal data. Do not assume that a redacted document is harmless: context, metadata, combinations of facts and client identifiers may still create risk. The classification should determine which use cases can enter a pilot and which must wait for further controls.

2. Test confidentiality and professional-responsibility controls

For each proposed legal AI tool, ask the vendor to explain what happens to prompts, uploaded documents, outputs, feedback, usage records and support tickets. Obtain answers that distinguish ordinary processing from access for support, security investigation, troubleshooting, quality assurance and service improvement.

Questions to put to the vendor

• Who can access each data category: the firm, the vendor, hosting providers, support personnel and subprocessors?
• Can customer content be used to train, tune or improve any service? Is that setting opt-in, opt-out or unavailable?
• What retention periods apply to content, logs, backups and deleted accounts?
• What tenant, workspace, identity and permissions controls are available?
• What evidence can the vendor provide about access logging, security controls, incident handling and deletion?

Singapore lawyers remain responsible for protecting client confidences and reviewing work produced with a tool. Assess whether the proposed access and disclosure arrangements are compatible with those responsibilities. A contractual commitment or a private deployment option may be relevant evidence, but neither automatically resolves professional-responsibility questions.

The firm should translate the assessment into written operating rules. Examples include an approved-data boundary, a prohibition on entering certain matter categories, a rule that users must not treat outputs as final work product without review, and a defined reporting route for suspected confidentiality, accuracy or security incidents. For a broader operating framework, see How Lawyers Can Use AI Safely: A 5-Step Checklist.

3. Assess PDPA roles, safeguards and data transfers

A firm should identify what personal data will be processed, why it is processed, which entities process it, and how long each participant retains it. This analysis should cover personal data in the source document and personal data that may appear in prompts, generated summaries, user accounts, diagnostic logs or support records.

Assess the firm’s obligations under Singapore’s Personal Data Protection Act 2012 (PDPA), including, where applicable, section 18 (limitation of purpose), section 24 (protection of personal data) and section 26 (transfer of personal data outside Singapore). The firm should establish the relevant processing purposes, the parties’ roles and whether proposed overseas data flows require additional measures.

Make the PDPA assessment specific to the workflow and the parties’ roles. Establish whether the vendor processes personal data solely to provide the contracted service or also for its own purposes, and assess each proposed use separately.

Practical diligence questions include:

• Is the firm acting on its own instructions, on a client’s instructions, or both for the relevant processing?
• Which vendor entities and subprocessors receive or can access personal data?
• What technical and organisational safeguards apply to the relevant processing?
• Do the proposed data flows include overseas storage, remote support, backups, telemetry or security monitoring?
• What contractual terms support the required protections, audit information and incident notifications?

This is not a box-ticking exercise. A privacy notice, a standard data-processing addendum, or an assertion that data is encrypted does not by itself answer whether the intended workflow is appropriately governed.

4. Establish where data is processed and what the contract promises

“Data residency” is only one point in a wider data-flow analysis. A service may store primary customer content in one location while support, security operations, telemetry, backups, disaster recovery, model operations or subprocessors involve other locations or forms of access.

Request a documented data-flow description that identifies:

• where content, metadata and logs are stored and processed;
• locations from which personnel may access data;
• each subprocessor and the service it provides;
• backup, deletion and disaster-recovery arrangements;
• how the vendor notifies customers of material service or subprocessor changes; and
• the controls available if the firm ends the service.

Then review the contract, not just the security questionnaire. The agreement should be assessed for commitments on confidentiality, permitted processing, security incident notification, deletion or return of data, audit evidence, subprocessor changes, service continuity, liability allocation and exit assistance. A Singapore hosting option alone is not a complete confidentiality, professional-duty or data-protection assessment.

5. Verify citations and legal outputs against primary sources

Fluent legal prose is not verified legal research. Ask whether research outputs identify traceable authorities, link or point to source material, preserve the relevant quotation and context, and distinguish between an answer generated from source material and one inferred from general patterns.

The Singapore Courts’ guide states that court users may use generative AI tools to prepare court documents provided the guide is complied with. It also states that lawyers retain a professional obligation to ensure that materials put before the courts are independently verified, accurate, true and appropriate. Read the Guide on the Use of Generative Artificial Intelligence Tools by Court Users.

The same operating principle applies before an output reaches a filing stage. A lawyer should independently check every authority, quotation, pin cite, proposition, factual statement and procedural assertion against authoritative materials. In [2025] SGHCR 33, the court described independently verifying AI-generated material as part of the fundamental duty concerning materials placed before the court, and stated that citing a fictitious AI-generated authority is wholly impermissible.

Build verification into the workflow rather than relying on a general reminder. Require a source-check field in research notes, a reviewer sign-off for filing-related work, and an escalation path where an authority cannot be found or a proposition cannot be supported. Our guide to legal research with AI and citation checking offers a practical starting point.

6. Check court requirements and expectations on generative AI

Before approving a workflow connected with litigation, filings or court documents, check current official Singapore court rules, practice directions, notices, guidance and any applicable directions for the forum and matter type. Do not infer a universal disclosure obligation from one document, one jurisdiction or a vendor policy.

The Singapore Courts’ guide referred to above permits generative AI use to prepare court documents subject to its requirements. It does not displace applicable legislation, court rules, codes of conduct or practice directions. Assess any notification or disclosure requirement for the particular court and proceeding rather than assuming a single rule applies to every filing.

7. Measure Singapore-law coverage and workflow fit

Do not assume that a tool marketed as legal AI has the Singapore-law materials needed for the firm’s work. Ask what Singapore legislation, subsidiary legislation, judgments and other materials the product can search or use; how coverage is updated; what dates or databases apply; and how users can inspect the underlying source trail. Test claimed coverage against the firm’s required materials and authoritative sources.

Test representative, non-sensitive tasks with experienced lawyers. Include tasks that require identifying current law, handling amendments, distinguishing authorities, extracting a narrow proposition and locating the source passage. Evaluate whether the workflow preserves context and whether its limitations are visible to the reviewer. The aim is not to declare a general winner; it is to determine whether the tool fits the firm’s defined use case.

8. Run a bounded pilot with review criteria

A pilot should be an evidence-gathering exercise, not an informal rollout. Define its duration, user group, approved workflows, data boundary and accountable owner. Use de-identified or otherwise approved material where possible, subject to the firm’s own assessment.

Set before the pilot	Assess during the pilot
Approved use cases and prohibited data	Usefulness and fit with legal workflows
Human-review and escalation process	Source-checking burden and traceability
Security, privacy and contract questions	Error types, limitations and user workarounds
Success criteria and decision owner	Training needs, adoption friction and support quality

Keep pilot observations in context. Results from a small group using selected tasks are not general performance results. Singapore judiciary materials on assessing technological and digital innovations emphasise methodological rigour in evaluation; that discipline is valuable when a firm is deciding whether to expand a deployment. See the Singapore Judicial College’s assessment framework.

9. Compare pricing and total cost of ownership

Compare commercial proposals on a like-for-like basis. Licensing or usage charges are only part of the cost. Include security and privacy review, procurement, implementation, identity and system integration, training, support, governance, ongoing evaluation, storage, premium model access, overages and exit costs.

Ask how pricing changes with user numbers, matter volume, document size, storage, API use, advanced features and premium models. Confirm renewal terms, price-change mechanisms, minimum commitments, data export and deletion arrangements, service levels and termination rights. There is no responsible universal benchmark for savings or return on investment: the firm should assess its own workflows and evidence.

A procurement scorecard partners can use

Before moving from evaluation to deployment, the decision owner should be able to answer “yes” to the following:

1. Is there an approved use case, defined user group and documented data boundary?
2. Has the firm mapped its policy against applicable professional requirements and, for court-facing workflows, the Singapore Courts’ guide on generative AI tools?
3. Have confidentiality obligations and professional-responsibility controls been assessed for that use case?
4. Has the firm assessed its applicable PDPA obligations, including safeguards and any overseas-transfer requirements?
5. Does the firm have a documented data flow and a contract review covering access, retention, subprocessors, backups, incidents and exit?
6. Is there a mandatory process for independently verifying legal authorities and propositions?
7. Have relevant court rules, practice directions, notices and guidance been checked for the intended litigation workflow?
8. Has Singapore-law coverage and source traceability been tested on representative tasks?
9. Does the pilot have an owner, human-review process, escalation route and predefined criteria?
10. Has the firm assessed total cost of ownership, contractual commitments and an exit plan?

Document the decision, the evidence relied upon and the conditions for continued use. Revisit the assessment when the product changes, new integrations are enabled, the data boundary expands, applicable guidance changes or the firm introduces a new workflow.

Lexi is AI-native legal technology for law firms, litigators and in-house teams. In a product walkthrough, ask Lexi to show what source links or source trails its research outputs provide for a Singapore-law task. Request available data-handling documentation on access, retention and subprocessors, and assess the answers against the scorecard. Any product evaluation should test the tool against the firm’s governance model; no tool on its own ensures compliance.

Legal information disclaimer: This article provides general information, not legal advice. Professional, regulatory and data-protection obligations depend on the facts, the applicable current rules and the relevant forum.

Next step: Discuss your firm’s Singapore requirements with Lexi and request a product walkthrough.