Confidentiality belongs before prompting, not after

Most AI courses arrive at professional responsibility eventually, and the instructors who teach them are not making a careless choice when they schedule it later in the semester. I made the same call the first time I ran this course, and the reasoning felt sound. Students are eager to work with the tools, and there is real pedagogical value in letting them experiment before introducing constraints on that experimentation. The instinct toward scaffolding is not wrong in most instructional contexts, and the energy students bring to early tool exploration is worth something. Where this sequencing runs into difficulty is the assumption that confidentiality can be layered onto prompting practice after the fact without changing what students have already learned. By the time the ethics conversation arrives, students have often built workflows they trust, and questioning those workflows requires them to revisit decisions that already felt resolved. The reframe that carries the rest of this note is that teaching students to sanitize a fact pattern is not a detour from teaching them to prompt. It is prompting instruction. The two tasks are structurally identical, and keeping them together is not a constraint on the pedagogy; it is the pedagogy.

The course places client-data sanitization in week two, before any substantial prompting practice has accumulated, and the reasoning is partly about habit formation. The first time a student constructs a prompt that contains real or realistic fact-pattern information, they should already have a framework for what belongs in that prompt and what does not. Week two is early enough that no habits have hardened yet, no workflows have calcified, no student has developed confidence in a process they would then have to retroactively question. But the deeper rationale is not just about timing. The goal is for students to encounter prompting and sanitization as a single skill rather than as two separate skills where one happened to come first. When the anonymization audit is the context in which students first sit down and really think about how to construct a prompt, the professional obligation has become the technical instruction.

This section is directed specifically at instructors adapting a syllabus that already has confidentiality scheduled later in the semester. When sanitization arrives after prompting practice has accumulated, you are not introducing a new concept into a neutral space. You are asking students to retroactively question workflows they have already built and, in some cases, come to trust. The specific habits that become harder to form once that window closes are worth naming individually. The first is the instinct to treat the prompt itself as a client document, something that requires the same care as a filing or a letter. The second is the discipline of deciding what information is legally load-bearing versus what is merely identifying, a distinction that requires real analytical effort. The third is the judgment to recognize when a fact is both things at once, which is the professionally hard case, and the one that matters most. A student who has never practiced that triage in a low-stakes environment will not suddenly develop the instinct when the stakes are real.

The conceptual core of this note is that sanitization and research question formation are the same task. A prompt is a research question, and writing a good research question requires exactly what sanitization requires: looking at a fact pattern and determining what is relevant and useful to include, what is confidential and not useful to include, and what is confidential and genuinely necessary to the legal question. That third category is the hardest, and it is where the most important professional work happens. A student who can identify a fact as both identifying and legally load-bearing has done serious analytical work. They have not just cleaned up a document; they have made a judgment about what the law needs to know to do its job. The anonymization audit is designed to surface that judgment explicitly rather than letting it happen implicitly or, worse, not happen at all.

Once students have worked through the logic of what information is confidential and necessary, the next question follows naturally: which tool can actually handle this information responsibly. The answer to that question needs to emerge from the analysis students just completed. Compliance reminders and IT policy announcements are a different kind of instruction, and they tend to be forgotten the moment they are inconvenient. If a fact is confidential and necessary, a lawyer needs a tool that is built to handle it appropriately. Firm-sanctioned tools, purpose-trained legal platforms, and enterprise agreements exist for exactly this category of information. The week two placement means students come to understand tool selection as something that follows from professional judgment about a specific fact pattern rather than as an arbitrary restriction imposed by their employer. That is a meaningfully different relationship to the decision, and it tends to hold up better in practice when the stakes are real and the right tool is inconvenient.

Some students, and some colleagues adapting this material, will push back on week two as too early. The objection usually takes the form of: students do not have real clients yet, so confidentiality training is abstract at this stage, and abstract instruction does not produce durable habits. It is a reasonable objection and deserves a direct answer. The point is precisely that students do not have real clients yet. The habit should form before the stakes are real, because forming a habit under pressure, after a real error has already been made or nearly made, is considerably harder than forming it in a low-stakes classroom exercise. The more important counter, though, is that week two sanitization is not actually an ethics module in disguise. Students are not being asked to engage with a rule set that feels foreign to where they are in the curriculum. They are being asked to do legal analysis, specifically to read a fact pattern and determine what information is doing what kind of work. The confidentiality frame makes explicit something that good legal analysis has always required. Reading it as abstract misunderstands what the exercise is asking students to do.