Singapore Ministry of Law's Guide to Using Generative AI: Verification, Confidentiality and Supervision in Legal Practice

On March 6, 2026, the Singapore Ministry of Law ("MinLaw") announced the publication of a guide on the use of generative AI in the legal sector. The published Guide for Using Generative AI in the Legal Sector was issued by MinLaw alone and finalized after a public consultation in September 2025. The guide itself expressly states that it is "non-binding"; it is not a rule that legally binds law firms or corporate legal departments, but a reference document to be revised as necessary. In this article, I set out the three principles shown in the guide (professional ethics, confidentiality and transparency) and the items to be checked in the adoption process, and then introduce them as a perspective from which Japanese law firms and corporate legal departments can review their own rules on the use of generative AI.

Positioning and Legal Nature of the Guide

The guide's audience is not limited to attorneys at law firms and in-house counsel. It also covers allied professionals such as paralegals, legal secretaries, legal technologists and legal project managers, alternative legal service providers, law students, and even businesses that develop and provide GenAI tools for the legal sector. The guide explains that it is based on the Model AI Governance Framework for GenAI published by the Infocomm Media Development Authority (IMDA) and the AI Verify Foundation, complements the Singapore Courts' guide for court users on the use of generative AI, and is aligned with the sector-specific approach called for by National AI Strategy 2.0. It also notes that the places in the guide where product names are mentioned do not mean that specific products are recommended or that the businesses concerned are endorsed.

As for its legal positioning, Singapore's Legal Profession Act 1966 and the conduct rules made under it (the Legal Profession (Professional Conduct) Rules 2015; the "PCR") set out attorneys' existing obligations, and the guide applies these existing obligations to the context of GenAI use and makes them concrete. Accordingly, the guide is not positioned as a document that creates new obligations. I think it is reasonable to understand it as a practical document that organizes how responsibility, competence, duties of confidentiality and other obligations under the Legal Profession Act apply in the context of GenAI use. For in-house counsel, the Code of Ethics of the Singapore Corporate Counsel Association (SCCA Code of Ethics) is referred to in the same way.

Professional Responsibility and Human Supervision

The guide places first the principle that responsibility for the quality and accuracy of work product ultimately rests with the attorney or legal professional, regardless of whether GenAI was used. Rule 5 of the PCR sets out duties of honesty, competence and diligence, and the guide's position is that, given the risks of hallucination (plausible but incorrect output) and bias, incorporating GenAI output into work product without verifying it may lead to a breach of these duties.

The risk-based approach shown in the guide is based on the idea of varying the required level of supervision according to the nature of the task. For reversible, low-impact tasks such as administrative work and note-taking, it considers supervision at the level of after-the-fact sample checks of AI output to be sufficient, whereas for tasks with significant legal effects or impact on third parties, such as court filings, submissions to regulators, commercial contracts and legal advice, it requires legal professionals to verify facts, citations and legal reasoning before the final decision. Tools with traceability features such as audit logs, citation of sources and confidence scores are positioned as making verification more efficient. The guide also states that more careful checking is needed when using GenAI in areas outside one's expertise.

Confidentiality and Items to Check in Tool Selection

Rule 6 of the PCR imposes on attorneys a duty of confidentiality regarding information obtained in the course of their work. The guide states that, as with the use of email or cloud services, this duty does not prohibit the use of GenAI itself and that taking appropriate safeguards is sufficient, and it lists as the main risks unauthorized use for model training, access by unauthorized third parties (including unauthorized persons within the same organization), and attacks such as prompt injection.

As practical measures, on the premise that the level of confidentiality increases in the order of free tools, commercial off-the-shelf (COTS) products for enterprises, and in-house developed systems, the guide lists prioritizing enterprise products for highly confidential information, checking the vendor's terms of use to understand whether input and output data are used for model training, and enabling opt-out settings for training use. Where a free tool must be used, it also shows alternative measures such as anonymizing by replacing party names and amounts with pseudonyms or symbols, asking questions in the form of hypothetical cases, and inputting only the relevant clause rather than the entire contract. It also states that where data may be stored on servers outside the country, it is necessary to check whether this conflicts with the client's requirements regarding data residency.

Disclosure to Clients

The duty of honesty under Rule 5 of the PCR also includes a duty to explain matters that may affect the client's interests. The guide states that disclosure to clients should be considered in three situations: where GenAI was used substantially in preparing work product, where the use of GenAI results in charging the client fees beyond traditional time-based billing, and where the data handling of a GenAI tool may conflict with the client's wishes regarding data residency or the like. Methods of disclosure listed include the engagement letter, the firm's website and explanations in communications with the client, and it is considered desirable to communicate the tools used, the work processes in which they are used and the verification methods, to make clear that the attorney is responsible for the work product regardless of whether GenAI is used, and to leave room for clients to opt out of GenAI use. For court filings, the Singapore Courts' guide separately requires lawyers to remain in a position to explain, if asked, whether GenAI was used and how it was verified.

Checklist for the Adoption Process and Vendor Selection

The guide sets out three stages of adoption: starting with the use of basic tools, adopting commercial off-the-shelf products for legal work, and developing proprietary GenAI systems, and shows five execution steps for each stage. The starting point is to develop internal policies, including appointing a person or committee in charge of AI use, the approved tools and permitted scope of data, data confidentiality classifications, due diligence criteria for procurement, procedures for disclosure to clients, and incident response procedures. The next steps are to identify demand, that is, where in the organization's work GenAI will be used, and to assess whether to proceed in light of data confidentiality, the risk level of the task and cost-effectiveness, leading to tool evaluation from the perspectives of data handling policy, fit with technical requirements, performance evaluation and the vendor's track record. Then come deployment and embedding, including pilot introduction and prompt refinement, monitoring of use, and training for users, and the cycle closes with verifying effectiveness against the original objectives and reviewing the policy.

What Japanese Law Firms and Corporate Legal Departments Should Review

Rules 5 and 6 of the PCR and the SCCA Code of Ethics on which the guide relies are all professional rules under Singapore law, and they are not themselves the Basic Rules on the Duties of Practicing Attorneys in Japan or obligations under the Act on the Protection of Personal Information. I think their significance for Japanese law firms and corporate legal departments lies not in importing Singapore's rules, but in using them as a yardstick for comparison to review how far the duties of confidentiality and explanation they already bear have been made concrete in the context of GenAI use. Our firm also covers the need for a human to make the final check of GenAI output in Why You Should Never Use Generative AI Answers As-Is and Always Have a Human Do the Final Check, and what the guide adds is the idea of varying the degree of checking according to the risk level of each task. On citations of article numbers and cases, it overlaps with the approach in Always Verify Article Numbers and Sources Yourself.

The items that a legal staff member or attorney who has read this can check the next day are as follows.

• Whether your generative AI use policy distinguishes the level of human checking by type of work (verification of facts, citations and legal reasoning by an attorney for filings and contracts; sample checks for internal memos and summaries of minutes)
• Whether, for the GenAI tools in use, you have checked in the vendor's terms of use whether input and output data are used for model training and whether client data may be stored on servers outside the country
• Whether you have set out how to disclose, in the engagement letter or explanations, cases where GenAI is used in a way that affects the client in terms of fees, or where its use may conflict with the client's wishes regarding data handling

The approach to the division of roles, that is, how far and in what situations generative AI is used in legal work, is also organized in What Is an AI Lawyer? How to Divide Work Between Attorneys and AI in Corporate Legal Practice in the Age of Generative AI, which is also worth checking. Because the guide is a document that is expected to be revised in the future, the content of the next revision and whether equivalent guidelines for legal practice will be published in Japan are matters that need continued monitoring.