Attorney Client Privilege and AI Tools: The Risks

Using AI tools can put attorney-client privilege at risk when the tool's terms let the provider keep, reuse or disclose what you send. Privilege depends on confidentiality, so the terms decide much of the outcome. One federal court has already found a client's exchanges with a consumer AI platform unprotected. A vetted tool under confidentiality terms is a different case.

Read this as a map of the sources and nothing more. It is not legal advice. Privilege law comes from courts and statutes that differ by jurisdiction, ethics rules differ by state, and the case law on AI is months old. Research your own jurisdiction before you rely on any of it.

Does sending a document to an AI tool waive privilege?

Sending a document to an AI tool can waive privilege, and a federal court in New York has said so on one set of facts. The answer turns on who sent it, whether a lawyer directed the use, and whether the provider's terms left any reasonable expectation that the material would stay confidential. No rule covers every tool.

The decision is United States v. Heppner, a memorandum filed February 17, 2026 in the Southern District of New York. A criminal defendant, acting on his own after receiving a grand jury subpoena, used a publicly available generative AI platform to prepare reports on his defense. Agents later seized about thirty-one of those documents. He claimed privilege and work product protection. Judge Rakoff rejected both claims, describing the question as apparently one of first impression nationwide.

The court gave three reasons on privilege:

1. The exchanges were not with a lawyer. The AI platform is not an attorney, and the court said that alone disposed of the claim.
2. They were not confidential. The court pointed to the platform's written privacy policy, which, as the court read it, said the provider collects inputs and outputs, uses them for training, and may disclose data to third parties. On that basis the defendant "could have had no 'reasonable expectation of confidentiality in his communications'" with the tool.
3. They were not made to obtain legal advice. The court called this a closer question. Counsel had not directed him to use the tool, so what mattered was whether he sought legal advice from the tool itself, and the court noted that the tool disclaims giving any.

Three further points in the opinion matter to lawyers.

Privileged inputs. In a footnote, the court said that even if information the defendant typed in was privileged because he learned it from his lawyers, "he waived the privilege by sharing that information" with the tool and its provider, "just as if he had shared it with any other third party."

Sending it to counsel afterwards did not help. The court called it "black-letter law that non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel."

What the court left open. It wrote that had counsel directed the use, the tool "might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." That sentence is not a holding. It marks the place where a lawyer's supervised use of a vetted tool could come out differently.

Keep the limits in view. This is one district court, on a client's unsupervised use of a consumer product. It did not decide what happens when a law firm sends a privileged document to a service that is bound to keep it confidential. It does show which facts a court examined: who was communicating, at whose direction, and what the provider's terms said.

For lawyers there is a client-counseling point here. A client may paste a lawyer's email into a chatbot to have it explained. After this ruling, a warning in your engagement materials about doing that is worth considering. The post on uploading legal documents to ChatGPT sets out what one widely used chatbot's own pages say happens to an upload.

What do the confidentiality rules require of a lawyer?

The confidentiality rules require two things: do not reveal information relating to the representation without consent or authorization, and make reasonable efforts to stop anyone else getting at it. The duty is wider than privilege. It reaches material no privilege would protect, and it applies to every tool you send a client file to.

The ABA's model text is Model Rule 1.6. Paragraph (a) says a lawyer "shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b)." Paragraph (c) says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Each state adopts its own version, so read yours.

"Reasonable efforts" is a standard you apply to facts, and no checklist satisfies it automatically. ABA Formal Opinion 512, on generative AI, says lawyers must weigh "the likelihood of disclosure and unauthorized access, the sensitivity of the information, the difficulty of implementing safeguards, and the extent to which safeguards negatively impact the lawyer's ability to represent the client."

Opinion 512 then reaches a specific conclusion about one kind of tool. Because many self-learning generative AI tools are designed so that their output could disclose one client's information to others, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool." A footnote adds that the conclusion rests on the technology as of July 2024 and may change.

The D.C. Bar's Ethics Opinion 388 reduces the inquiry to two questions:

• "Will information I provide to the GAI be visible to the GAI provider or other strangers to the attorney-client relationship?"
• "Will my interactions with the GAI affect answers that later users of the GAI will get in a way that could reveal information I provided to the GAI?"

A yes to the first is, in the opinion's words, "at least a red flag" that better terms might resolve. A yes to the second is harder to fix. The post on training on your data explains how to find out which answer a vendor gives.

Supervision is part of the duty. Opinion 512 says managerial lawyers "must establish clear policies regarding the law firm's permissible use of GAI." A template is in the post on law firm AI policy rules for document uploads.

Work product and third-party processors

Work product protection covers material prepared in anticipation of litigation by or for a party or its representative. It is a separate doctrine from privilege, with its own tests. With AI tools the prompt is one place it is put at risk, because what you type can set out your theory of the case.

In federal civil cases the rule is Federal Rule of Civil Procedure 26(b)(3). It says a party ordinarily "may not discover documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative." Even when a court orders production on a showing of substantial need, it "must protect against disclosure of the mental impressions, conclusions, opinions, or legal theories of a party's attorney or other representative."

Heppner addressed work product too, and the claim failed for a reason unrelated to the technology. The documents were made by the client on his own initiative. The court held they were not prepared by or at the behest of counsel and did not reflect counsel's strategy when created. The court also expressly disagreed with an earlier decision from the same district that had read the doctrine more broadly. Courts differ on this, so check the law where your case sits.

For a lawyer the exposure is different. D.C. Opinion 388 observes that in a back-and-forth with a generative tool, "the lawyer effectively may be disclosing her mental impressions", and that some programs may save prompts and outputs. A conversion tool raises less of this, because you give it a document and no argument. The document itself may still be work product, though: a draft brief, an annotated deposition outline, a memo to file.

Before you type a case theory into a chat, read the terms of service on how long prompts are kept. Generative artificial intelligence can store that theory next to the upload. The duty of competence includes telling a conversion job apart from a chat that restates strategy. Where the work-product doctrine may be in play, keep the vendor's confidentiality wording with the upload log. Client confidentiality covers both the document and the prompt.

Whether sending work product to a processor waives protection is a legal question this post does not answer. The tests are not the same as for privilege and they vary by court. You can control the facts those tests look at: whether the recipient is bound to keep the material confidential, and whether anyone adverse could obtain it.

How courts and bar opinions treat cloud vendors

Bar opinions have long allowed lawyers to send client information to outside technology providers when they take reasonable care in choosing and supervising them. The Heppner court, for its part, noted that using cloud software does not make anything privileged. Taken together, a vendor is permitted, and privilege still depends on the vendor's terms.

The fullest ABA statement is Formal Opinion 477R, from 2017. It concludes that a lawyer "generally may transmit information relating to the representation of a client over the internet" where the lawyer "has undertaken reasonable efforts to prevent inadvertent or unauthorized access", and that special precautions may be required by client agreement, by law, or by the nature of the information.

On vendors, 477R points to Model Rule 5.3 and lists factors to weigh, among them "vendor's security policies and protocols" and "the use of confidentiality agreements." It notes that a comment to Rule 5.3 treats "using an Internet-based service to store client information" as a form of outsourcing that the lawyer must reasonably supervise. It adds that the lawyer "must periodically reassess these factors." Opinion 512 says these concepts "also apply to GAI providers and tools."

From the bench, Heppner answered the argument that an AI tool is just software, like a cloud word processor: "the use of such applications is not intrinsically privileged in any case." So the cloud comparison is of limited use. What counted in that analysis was the provider's terms.

One federal rule softens mistakes in a narrow setting. Federal Rule of Evidence 502(b) says a disclosure "made in a federal proceeding or to a federal office or agency" does not waive privilege if it was inadvertent, the holder "took reasonable steps to prevent disclosure", and the holder promptly took reasonable steps to fix it. By its terms that covers disclosures in those settings. It is not written for an upload to a vendor. State law may differ again.

Contract terms that protect privilege

No contract term guarantees privilege, but some terms supply the facts a court or disciplinary body would look for: an enforceable duty of confidentiality, limits on use and access, and notice when something goes wrong. Get them in a document that binds the vendor. A marketing page does not.

Opinion 512 gathers a list from earlier cloud and outsourcing opinions. The table restates it as terms to look for.

Three practical points.

Free and consumer plans often cannot be negotiated. D.C. Opinion 388 notes that paying business users may be able to get better terms than users of a free service.

Online terms can change. Save the edition you accepted, with the date, and look again on a schedule. 477R's reminder to reassess applies.

Ask who else is in the chain. A vendor's promise is only as wide as the companies it passes your documents to. The post on which questions to ask an OCR vendor has the full list.

Privileged documents and OCR specifically

OCR on privileged documents raises the confidentiality questions above plus two of its own. The tool receives the whole document, where a chatbot gets a prompt, and the text it produces becomes what your privilege searches run on. Both call for care in choosing the tool and in checking its output.

The whole file goes up. An OCR job on a client's email binder sends every page. Sort before you upload. If a set mixes ordinary business records with attorney-client communications, decide whether the privileged part needs converting at all, and whether it belongs in a tool your firm has approved for that tier of material.

Privilege screens depend on the text. Reviewers find privileged documents in a production set by searching for lawyers' names, firm domains and phrases such as "privileged and confidential". Those searches run on OCR text when the documents are scans. A misread name is a missed hit, and a missed hit can become an inadvertent production. Spot-check the converted text for the names on your screen list. The post on why OCR output is full of errors explains which characters go wrong and how to proofread against the page.

Exports are new copies. A Word or text export of a privileged memo is itself privileged material. Store it in the matter file with the same marking as the original, and clear it from download folders. 477R recommends marking privileged communications as "privileged and confidential" so that anyone who receives one by mistake is put on notice.

Work product in the margins. Scans of your own annotated documents carry your handwriting. If the notes are work product, the scan and its conversion are too.

What the vendor has promised. Schema Law's site states, for every plan, that "Documents stay inside your own account" and that "Your documents are never used to train an AI model". The full list is under security on the homepage. Those are the company's statements, and this post does not verify them. Ask Schema Law for the terms behind them, as you would any vendor, and compare the answers with the table of contract terms above. Its Enterprise plan lists "Security questionnaire and contract review" for firms that run a formal process.

Whatever tool you choose, write down why. A dated note of what you asked, what the vendor answered and which documents you decided to keep off the service shows the reasonable efforts your rules expect.