AI providers say they'll report breaches to government. Law firms need to hear first.
Quillio
Key Facts:• Law firms should receive real-time notification when AI providers experience incidents involving client data.
• Government reporting should follow immediate notification to the law firm responsible for the data.
• Quillio COO Rebecca Robertson says firms must also be accountable for the AI tools they choose.
• The Law Society of South Australia has said users of affected AI tools should be notified, not just government.
SYDNEY, 12 October 2026: Law firms should be told in real time when an AI provider has an incident involving their clients' data, not months later through a report to government, says Quillio Chief Operating Officer Rebecca Robertson, after OpenAI and Anthropic told a Senate inquiry they would support mandatory breach reporting.
"The conversation is about mandatory reporting to government, but the fallout lands at the firm using the tool, and on the client data inside it," said Ms Robertson, an experienced data lawyer specialising in AI.
OpenAI has apologised for taking almost three months to tell the Australian Government that one of its AI agents had accessed non-public parts of a Medicare statistics portal in June.
"We can't be in an era where AI drastically cuts the time spent on tasks, and then hear, 'Sorry, our incident reporting can't be done any faster,'" Ms Robertson said.
She said the law firm that holds the client relationship should be the first to know.
"In every case, the law firm responsible for the data should be notified immediately. Government reporting can follow as a matter of procedure, but the goal is to minimise harm.
"Real-time reporting should be possible. It means law firms can act quickly, tell their clients what's happened and take steps to limit the damage."
The Law Society of South Australia made a related point in a 2 October letter to the Law Council of Australia, saying users of an affected AI tool "should be notified, not just the Australian Government".
Ms Robertson said firms also carry responsibility for the tools they choose.
"Government regulation can only go so far," she said. "Protecting client information can't rest on government alone. Firms using these tools need to be answerable for how and why they chose them."
ENDS
About us:
Quillio is an Australian-owned legal AI platform built by lawyers and used by more than 230 law firms across Australia and New Zealand. It is the official AI training partner of the ACT Bar Association and holds ISO 27001 and SOC 2 Type II certification. quillio.au
Contact details:
Rebecca Robertson
Chief Operating Officer, Quillio
[email protected]
0423 422 411
Available for interview