Claude for Legal: Security Checklist Before Connecting Firm Documents

In this checklist

1. How do I use Claude for Legal?
2. What is Claude for Legal?
3. Check 1. Confirm the plan and the retention setting
4. Check 2. Decide who gets which legal plugins
5. Check 3. Turn on only the connectors you mean to, with write actions held back
6. Check 4. iManage: what has to be true before the connector works
7. Check 5. Decide what evidence you will keep
8. Check 6. Pilot on a narrow set of matters
9. Check 7. Get the ethics sign-off in writing
10. The checklist
11. Quick answers
12. Where this leaves your firm

Lawyers use Claude for Legal through its MCP connectors and practice area plugins in Claude Cowork, and the plugins also install in Claude Code. Anthropic says Enterprise admins enable them in workspace settings. An Owner sets which plugins are available and enables each connector. Each lawyer then authenticates to the connected service individually.

Claude for Legal is a product for lawyers, but the technical controls that help protect client confidentiality are set by the people who run the tenant. Owners decide which connectors and plugins are switched on, which means the decision to connect a document system lands on IT before it lands on a partner.

So the order matters. Settle the plan and retention, decide who gets which plugins, enable connectors with write actions held back, confirm what the iManage side requires, decide your evidence, pilot narrowly, and get the ethics sign-off in writing. Then connect.

For the product comparison, see Claude vs Copilot for legal work, task by task, and for the buying decision, our Claude vs Copilot guide for law firms. This page is about what to set and verify first.

Claude for Legal is Anthropic’s set of MCP connectors to legal software and practice area plugins for legal work. Anthropic announced it on May 12, 2026, with more than 20 MCP connectors and 12 practice area plugins. Anthropic says the connectors and plugins are open source and available in Claude Cowork.

The announcement names iManage and NetDocuments among the document management connectors, along with contract tools such as Ironclad and DocuSign and eDiscovery tools such as Everlaw and Relativity. Anthropic has since said it has added more than 60 legal connectors.

Plugins and connectors are different layers. Connectors decide what Claude can reach. Plugins package skills and workflows, and they can also bundle connectors, subagents, slash commands and hooks. Anthropic’s help center says plugins your organization distributes appear in chat, in Claude Cowork and in Claude Code sessions where members sign in with the same Claude account. Hooks and sub-agents run in Cowork and Claude Code, not in chat.

That split shapes the checklist. Plugin settings control what lawyers can install. Connector settings control what Claude can touch.

Custom data retention is an Enterprise feature, and the default is indefinite retention. The minimum custom period is 30 days. Shortening a period schedules permanent deletion as soon as you save, so settle the number with your records owner first.

The full setup, including SSO and SCIM, is in the Claude Enterprise deployment runbook. Do that before you add legal plugins, because retention applies to what lawyers put into chats and projects from the first day.

Owners and Primary Owners on Team and Enterprise manage plugins under Organization settings, in Plugins & skills. Each plugin gets an availability value: Not available, Available to install, Installed by default or Required.

On Enterprise you can also set access by group, and here is the trap. If a person belongs to two groups with different settings, the most permissive setting wins. Anthropic says plainly that groups are meant to enable access and are not a security boundary. To block a plugin firmwide, set it to Not available at the organization level and confirm that no group carries its own override.

Two more details matter to IT. Plugins you install, and plugins your organization distributes to you, sync to Claude Code when you sign in with the same account. A plugin can include hooks and connectors, so a Required plugin reaches the terminal as well as the chat window. Plugin availability also does not switch on a plugin’s bundled connectors. An Owner adds those separately under Connectors, and members then connect with their own account.

Anthropic’s plugin documentation describes a Skills and plugins scanning switch in the Policy tab, which runs a security scan and shows the result in the inventory. Find out whether yours is on.

For emergencies, Anthropic documents that setting a plugin to Not available stops Claude from loading it, including for people who already installed it. Turning Skills off in the Policy tab switches plugins off for the whole organization. Write both steps into your incident runbook.

For Claude Code on the command line, Anthropic documents managed settings that control which plugins install and load, including a setting that stops claude.ai plugins from syncing into Claude Code. Those settings are separate from the admin page, so configure them if developers at the firm use Claude Code.

An Owner or Primary Owner enables each connector for the organization. Enabling does not grant access. Each lawyer still authenticates to the connected service with their own account.

Then use the tool permissions. Each tool or category can be set to Always allow, Needs approval or Blocked, and the choice applies to everyone. For a document system, start read only. Block or gate any tool that creates, moves, uploads or changes anything.

Other settings to confirm:

1. Connector requests are off by default on Enterprise. Leave them off until you have a review path.
2. Connectors work only in private projects. Anthropic’s connector article says so for Team and Enterprise.
3. Owners can restrict services on the firm’s verified domains from being connected to Claude accounts outside the organization.
4. US-only inference settings do not change where a third party connector service runs. Check each vendor’s hosting and data terms.

How a connector carries each lawyer’s own document permissions is a deeper topic. It is covered in how connectors carry each lawyer’s document permissions, and it matters more than any toggle on this page.

iManage’s help for Claude says to add the connector as a custom connector using your firm’s iManage subdomain, then sign in and authorize. It says that only read permissions are currently available, and that they are selected by default. It also says the tools a user gets depend on what the firm’s administrator has configured for the MCP client.

iManage states that existing security policies, permissions and audit trails are maintained and that users reach only content they have permission to see. Anthropic’s directory describes the connector as permission bound and auditable, and lists read tools such as search and download.

iManage’s own tool reference is longer. Its read tools cover search, folder browsing, document profiles and versions. Its write tools are move_document and upload_document, and by default a move updates the document’s profile and security to match the destination folder. Read together, the two sources agree: reads by default, writes only where the firm’s administrator and the authorization allow them.

Here is the practical step. Ask your iManage administrator which tools are enabled for Claude, then run a test account against the live connector. Involve the administrator before you promise a date.

NetDocuments is part of the same announcement. This page does not cover its setup. Read NetDocuments’ own documentation before you enable it, and apply the same read first approach.

Claude Enterprise provides audit logs and a Compliance API for usage data and activity logs. Decide who reads them and how long you keep them.

Microsoft Purview has a preview connector for Claude Enterprise that requires pay-as-you-go billing. Microsoft’s capability table, last updated August 4, 2026, lists DSPM, auditing, data classification, Insider Risk Management, Communication Compliance, eDiscovery and Data Lifecycle Management as supported, along with Compliance Manager. It lists sensitivity labels, encryption without labels, and data loss prevention as not supported.

So Purview DLP does not govern what a lawyer sends to Claude. If your outside counsel guidelines expect DLP on AI tools, you need another control and you should say so in your documentation.

This is Cocha’s recommendation, not a rule from any authority. Pilot with one practice group. Make plugins Available to install for that group only, keep the connector read only, and name a partner who reviews the output.

Define the pilot in writing: which matters, which connector, which plugins, who can authorize, who reviews, and what ends the pilot early. A narrow pilot also gives you the access logs to answer the next question, which is always what happened and who did it.

ABA Formal Opinion 512, issued July 29, 2024, applies existing Model Rules to generative AI. It is not binding, and it speaks to generative AI tools in general rather than to specific products. The rules it discusses include competence, confidentiality under Rules 1.6, 1.9(c) and 1.18(b), communication under Rule 1.4, and supervision under Rules 5.1 and 5.3.

On confidentiality, the opinion says a client’s informed consent is required before information relating to the representation goes into a self-learning generative AI tool. It adds that general boilerplate language in an engagement letter is not sufficient. It also says consent is not needed when no client information is input. The opinion also warns that a self-learning tool can expose information to other people in the same firm, including people walled off from the matter. Whether a particular tool counts as self-learning, and what that means for your clients, is a question for your counsel. Whether any of that answers the consent question for your clients is for your firm’s counsel.

On supervision, ABA Business Law Today’s summary says managerial lawyers must establish clear policies on permissible use, and supervising lawyers must make sure nonlawyers, including outside providers, are trained. IT cannot decide whether a given tool needs client consent. Anthropic’s privacy center says that by default it does not use inputs or outputs from its commercial products, such as Claude for Work, to train its models. That changes if someone sends feedback, such as a thumbs up or down, or otherwise opts in. What IT can supply is evidence: the plan, the retention setting, the connector permissions, the audit trail, the training record and the pilot scope.

Texas lawyers should also read Opinion 705 of the Professional Ethics Committee for the State Bar of Texas, issued in February 2025. It applies Rule 1.05 and says reasonable precautions may include understanding how the tool works, reviewing its terms of service, learning its data security protections, and training lawyers and staff. It says a lawyer who intends to use confidential information with a generative AI tool should consider informing clients about the risks and may need to secure client consent. For the full rule by rule IT controls view, see ABA Formal Opinion 512 IT controls.

Cocha isn’t giving legal advice here.

Do not connect the document system first and ask questions later. Plugin availability, connector tool permissions and retention are all admin settings you can fix this week, and each one is easier to set before lawyers rely on the tool.

If you want a second review of your plan, the AI Readiness Snapshot is the place to start. The broader policy framework sits under AI governance for law firms.

This isn’t legal advice.