Attorney-Client Privilege and AI

The attorney-client privilege is a foundational principle of legal practice, and its intersection with AI technology presents novel questions. When a lawyer inputs privileged information into an AI system, the data travels to servers operated by the AI vendor. If those servers retain the data, share it with third parties, or use it for model training, there is a risk that the privilege has been waived through voluntary disclosure to a third party.

Courts and bar associations are still developing guidance on this issue. The emerging consensus is that lawyers may use AI tools without waiving privilege, provided they take reasonable steps to protect confidentiality. These steps include: selecting vendors with appropriate security certifications, ensuring contractual provisions protect confidentiality, verifying that the vendor does not use client data for training, and understanding the vendor's data retention and handling practices.

The practical implication is that law firms must conduct due diligence on AI vendors before using their tools with client-confidential information. This due diligence should examine the vendor's security architecture, data handling policies, sub-processor agreements, and contractual commitments regarding confidentiality. Platforms that offer zero data retention, tenant isolation, and end-to-end encryption provide the strongest basis for maintaining privilege.