AI and legal professional privilege — the waiver risk nobody costed

Legal professional privilege protects confidential communications made for the dominant purpose of obtaining or providing legal advice, or for use in litigation. It belongs to the client, not the lawyer, and the lawyer’s role is to protect it on the client’s behalf.

Privilege depends on confidentiality being maintained. Where privileged material is disclosed to a third party in a way inconsistent with maintaining that confidentiality, privilege may be waived.

An AI service is a third party.

The mechanics of the risk

The concerning sequence is ordinary and quick:

A solicitor is working through a large brief. To locate the relevant material efficiently, they paste sections into an AI tool and ask for a summary. The material includes communications with the client, counsel’s advice, and file notes recording instructions.

That material has now been transmitted outside the firm to a commercial service, typically overseas, under terms nobody in the firm has read for that tier. It may be retained. It may be reviewed by a human under abuse-monitoring provisions.

Nobody made a decision to waive privilege. Nobody considered privilege at all. The question simply never arose, because it did not feel like a disclosure — it felt like using a tool.

Waiver is assessed objectively

The point solicitors most often miss is that waiver does not turn on intention.

Courts assess waiver by reference to whether the conduct is inconsistent with maintaining the confidentiality the privilege protects. It is an objective inquiry. “We did not mean to” is not the test, and neither is “we did not realise the tool worked that way.”

Whether a particular disclosure to a particular AI service under particular terms would be held to waive privilege is an unsettled question, and it will turn on the specific facts — the terms of service, the retention, the tier, the extent of any confidentiality obligation on the provider.

That uncertainty is itself the problem. You do not want to be the test case, and you certainly do not want to be explaining to a client that their privilege is now a contested question because an associate was trying to finish before ten.

The confidentiality duty sits alongside it

Privilege is not the only obligation in play. A solicitor’s duty of confidentiality under the professional conduct rules operates independently. It applies to all client information, not only privileged communications, and it is not lost merely because privilege might not attach.

So a disclosure that would not waive privilege may still breach the conduct rules. Two separate obligations, two separate exposures, one paste.

Where firms are most exposed

From what practitioners describe, the highest-volume exposures are:

Discovery and document review. The single largest volume of confidential text leaving firms. The economics are obvious — reviewing a large bundle manually is expensive and slow, and AI summarisation is genuinely good at it. This is also where the material is most likely to include the other side’s confidential documents, produced under an implied undertaking as to their use.

Drafting advice. Client facts must be included for the draft to be usable. Proper anonymisation takes longer than writing it, so it does not happen.

Counsel’s advice. Summarised or plain-Englished for the client, transmitting the most clearly privileged document on the file.

Correspondence and negotiation. Counterparty positions and settlement figures pasted in to draft a reply, which is commercially sensitive quite apart from the privilege question.

The implied undertaking problem

Worth isolating, because it is frequently overlooked.

Documents produced in discovery are generally subject to an implied undertaking to the court restricting their use to the proceeding. Uploading the other side’s discovered documents to a commercial AI service is a use, and it is very unlikely to be one the undertaking permits.

Unlike a privilege waiver — which harms your own client — a breach of the implied undertaking is a matter between your firm and the court. That is a materially worse conversation.

The insurance question

This is the point at which the discussion usually becomes concrete for partners.

If a privilege waiver caused loss to a client, and the waiver arose because a staff member used an AI tool contrary to firm policy, how does your professional indemnity policy respond?

We are not insurance advisers and the answer depends entirely on your policy wording. What we can say is that it is a question worth asking your broker before you need the answer, not after. Some firms have discovered their position is less comfortable than assumed once cyber and PI policies are read together.

What actually helps

A policy is necessary and insufficient. Have one. Just understand that a solicitor working late on a personal device is not meaningfully constrained by it, and that its existence establishes the firm was on notice.

An enterprise arrangement is a real improvement. Better contractual terms, better retention commitments, administrative controls. If your firm does nothing else, do this — but recognise that it only protects the usage that actually goes through it, and the 9pm phone usage does not.

Removing the transmission removes the question. If the AI runs on hardware inside the firm, there is no third party, no overseas recipient, and no disclosure — so there is nothing for a waiver argument to attach to. Discovery bundles can be summarised freely because the bundle never leaves the office.

That is a genuine capital decision and it does not suit every firm. A three-partner practice with occasional AI use is not the same proposition as a firm of forty running document-heavy litigation. We would rather help you work out which one you are than sell you something you do not need.

The question to ask at the next partners’ meeting

Not “do we have an AI policy?”

Ask instead:

If a client asked us today to confirm that no privileged material from their matter has been transmitted to a third-party AI service — could we answer honestly?

Most firms cannot. That gap is the actual exposure, and it does not close on its own.