A real estate lawyer’s office gets an email from a “client” asking to change the wire instructions for tomorrow’s closing. The email address looks right. The tone matches how the client normally writes. The funds go out — to an account that isn’t the client’s. This isn’t a rare, unlucky story. Business email compromise targeting real estate closings is consistently named as the highest-impact cybersecurity threat facing Canadian law firms, and it happens because firms treat IT as something to get around to, not something tied to their professional obligations.

Here’s what a lot of firms don’t realize: that gap isn’t just a business risk. It’s a regulatory one. Every law society in Canada has adopted a version of the same rule — lawyers must maintain “competence” in the technology they use, and take reasonable steps to protect client confidentiality electronically. Your IT setup isn’t just infrastructure. It’s part of how you meet your professional obligations.

This guide explains what that rule actually requires, clears up a common myth about “approved” software, and lays out what genuinely adequate legal IT looks like for a Canadian firm in 2026.

What does “technology competence” actually mean for a law firm?

The Federation of Law Societies’ Model Code — adopted in substance by law societies across Canada — requires lawyers to maintain competence in the technology relevant to their practice, and to take reasonable care to protect client confidentiality in electronic communications and records. In practice, this means you (or someone you rely on) need to genuinely understand how your firm’s technology works and where its risks are — not just use it.

This isn’t abstract. The rule traces to two specific obligations:

Competence (Rule 3.1) — you’re expected to understand the technology relevant to your practice well enough to use it responsibly. That doesn’t mean every lawyer becomes an IT expert. It means the firm has to actually know how its systems work, or have someone who does, rather than treating “the server” or “the cloud” as a black box nobody in the firm understands.

Confidentiality (Rule 3.3) — you must take reasonable steps to protect client information from unauthorized access, in electronic form as much as on paper. This covers everything from how matter files are stored to how remote access is secured to how email is protected.

Provincial law societies have each layered on their own guidance. The Law Society of Ontario has published specific direction on cybersecurity — password management, multi-factor authentication, encrypted communications, incident response. The Law Society of Alberta has issued guidance specifically on cloud computing and electronic client records, addressing data residency and vendor selection. The pattern is consistent nationally even where the specifics vary by province: “we didn’t think about it” is not a defensible position anymore.

And this obligation is expanding, not shrinking. Law societies have recently clarified that the same competence duty applies directly to AI-assisted legal work — understanding the tool’s limitations, verifying its output, and managing the confidentiality risk of what you feed into it. The direction of travel is toward more technology scrutiny on law firms, not less.

Myth: “Is this software approved by the Law Society?”

No Canadian law society issues an official approval or certification for specific software products — not PCLaw, not Clio, not any cloud provider. What they require instead is that whatever technology a firm uses meets their standards for security, confidentiality, backup, and audit capability. The responsibility for confirming that sits with the firm, not with a stamp of approval that doesn’t exist.

This is a genuinely common misunderstanding, and it matters because it changes where the responsibility sits. Firms sometimes assume that because a piece of software is widely used by other lawyers, it must be “cleared” somehow. It isn’t — there’s no such list.

What the law societies actually say is closer to: cloud computing and outsourced hosting are permitted, provided the firm has done its own due diligence on the provider’s security, confidentiality safeguards, backup practices, and — increasingly — where the data physically resides. The Law Society of Ontario’s own cloud computing guidance walks through exactly this: what cloud computing is, how to evaluate a provider, and how to manage the risks — not a checklist of approved vendors.

So the real question a firm should be asking isn’t “is this software Law Society-approved.” It’s: does this specific provider’s security, contractual terms, and data handling actually meet what our confidentiality and competence obligations require and can we explain that if we’re ever asked?

What does this mean in practice for a firm’s IT?

Translated into concrete terms, the technology competence and confidentiality obligations point toward a specific IT baseline: strong access controls with multi-factor authentication, encrypted and secure communications, a real backup and disaster recovery plan, controlled and logged access to matter files, and — for firms handling trust accounting — software and infrastructure that supports the audit trail regulators expect.

Here’s what that looks like as an actual checklist:

Multi-factor authentication on every login. A password alone is no longer a defensible standard, and it’s explicitly named in law society cybersecurity guidance. If a lawyer’s credentials are phished, MFA is frequently the only thing standing between that and full account access.

Encrypted communications and secure remote access. Given how much legal work now happens outside the office — before court, from home, during a closing — remote access needs to be genuinely secure, not just an open VPN or someone remoting into their unattended office desktop.

Controlled, logged access to matter files. Confidentiality means being able to say precisely who can access which files, and being able to demonstrate that when needed — not just “everyone on the shared drive has access to everything.”

A real, tested backup and disaster recovery plan. Not a folder that’s assumed to be backing up somewhere. Regulators and malpractice insurers alike increasingly expect firms to be able to describe their actual recovery process, not gesture at one.

Data residency and vendor due diligence. Where your data physically lives determines which country’s legal system can compel access to it. For a Canadian firm, this is a question worth having a clear answer to — not an afterthought discovered during a client’s due diligence request.

Trust accounting integrity. For firms running PCLaw, Tabs3, or similar practice management software with trust accounting, the audit trail and multi-user reliability of that system is itself a compliance matter, not just a convenience feature.

None of this requires every lawyer to become a security expert. It requires the firm to be able to answer, clearly, how each of these is handled — and to have chosen its technology and its IT provider with that answer in mind.

Why real estate and litigation files carry the sharpest risk?

Business email compromise targeting wire transfers — most often in real estate closings — is consistently identified as the highest-impact cybersecurity threat facing Canadian law firms. The mechanics are simple and the losses are frequently unrecoverable once funds have moved.

The pattern is well-documented: a fraudster monitors or spoofs a firm’s or client’s email, then sends convincing, well-timed instructions to redirect a closing’s funds to an account they control. By the time anyone notices, the money is often gone.

This isn’t primarily a “install better antivirus” problem. It’s a process and infrastructure problem — verified callback procedures for any change in wire instructions, email systems hardened against spoofing, staff trained to recognize the pattern, and IT infrastructure that doesn’t leave an easy opening. It’s also exactly the kind of risk a firm’s technology competence obligation is meant to cover: this is a known, well-publicized threat, and a firm that hasn’t taken reasonable steps against it is on weaker ground than one that has.

Where does hosting and infrastructure fit into all of this?

Where and how your firm’s applications and files are hosted is directly connected to meeting these obligations — not a separate IT decision made afterward. An aging office server with no real monitoring, an unreliable VPN standing in for secure remote access, and uncertainty about backups are all, in a real sense, compliance gaps as much as technical ones.

This is the through-line worth understanding: a firm running PCLaw or Time Matters off a server nobody’s monitoring, accessed through a VPN that half-works, with backups nobody’s actually tested — that firm doesn’t just have an inconvenient IT setup. It has a harder time demonstrating it met its confidentiality and competence obligations if something ever goes wrong and someone asks how the firm’s systems actually worked.

Moving that same software to a properly managed, monitored environment — with MFA enforced, access logged, backups tested, and data residency known and documented — doesn’t just fix the day-to-day friction of an old server. It puts the firm in a materially stronger position on the exact obligations this article has walked through. We’ve covered what that kind of managed environment looks like specifically for the applications Canadian firms run — PCLaw, Time Matters, Tabs3, Worldox, and others — in our guide to cloud hosting for law firms in Canada.

Frequently asked questions

Does the Law Society require law firms to use specific IT providers or software? No. Law societies don’t certify or approve specific vendors. They require firms to exercise due diligence in choosing technology that meets their security, confidentiality, and backup standards — the responsibility for that assessment sits with the firm.

Is cloud computing allowed for Canadian law firms? Yes. Every major law society’s guidance treats cloud computing as permissible, provided the firm has properly evaluated the provider’s security, confidentiality safeguards, and data handling practices. It’s a due-diligence requirement, not a prohibition.

What happens if a law firm doesn’t meet its technology competence obligation? Consequences can range from law society complaints and disciplinary action to weakened standing with a malpractice insurer, particularly following an incident. Being able to clearly describe how the firm’s systems protect client information is itself part of meeting the obligation.

Does this obligation apply to firms using AI tools? Yes — law societies have clarified that the same competence duty extends to AI-assisted legal work, including understanding a tool’s limitations, verifying its outputs, and managing confidentiality risks in what’s shared with it.

Do small firms and sole practitioners have the same obligations as large firms? Yes, the underlying competence and confidentiality obligations apply regardless of firm size. What differs in practice is how proportionate the firm’s controls need to be — but “we’re too small for this to apply” isn’t a recognized exception.

Where should Canadian law firm data actually be hosted? There’s no absolute legal requirement that data stay in Canada, but data residency is explicitly named in law society cloud guidance as something firms should understand and be able to explain about their provider. Many Canadian firms choose Canadian-hosted infrastructure specifically to keep that question straightforward.

The bottom line

For Canadian law firms, IT is no longer just an operational choice — it’s tied directly to a professional obligation every lawyer already has. The technology competence and confidentiality rules don’t require perfection, and they don’t come with an approved-vendor list to simply pick from. What they require is that a firm can genuinely explain how its systems protect client information, and that the answer holds up: real access controls, real backups, real monitoring, and a clear picture of where the data lives.

An aging server nobody’s watching and a VPN held together with hope isn’t just inconvenient. It’s the exact gap these rules are meant to close.

Cloudnet hosts the applications Canadian law firms already run — PCLaw, Time Matters, Tabs3, Worldox, and more — in Canadian data centres, with multi-factor authentication, managed backups, and infrastructure monitoring built in. If you want a clear-eyed assessment of where your firm’s current setup stands, request a free legal cloud assessment and we’ll walk through it honestly.