There’s nothing new about lawyers using tools to work faster. Legal research moved from bound volumes to Lexis and Westlaw, case files moved from cabinets to the cloud, and each shift arrived with someone predicting the end of careful practice. Generative artificial intelligence (AI) is the latest step in that progression, and for the most part, it earns its place. It finds information quickly, drafts usable content, analyzes contracts, and speeds document review.
What makes this step different, though, is where the information actually goes. When a lawyer runs a search on Westlaw, nothing about the matter leaves the relationship. When a lawyer pastes a board memo into a public chatbot, something might. For a legal department, the question is not whether privilege exists. If you provide legal advice, it does. The question is whether a tool your team uses can quietly give it away, and whether you understand the tool well enough to know.
U.S. Supreme Court Chief Justice John Roberts wrote in his 2023 year-end report that any use of AI requires caution and humility. For in-house counsel and the firms that support them, that caution comes down to three practical commitments: knowing which tools you are using and on what terms, understanding how those tools handle what you put into them, and keeping a lawyer in charge of the work.
Where the Risk Actually Lives
Attorney-client privilege protects confidential communications between a client and their lawyer for the purpose of obtaining legal advice. It’s composed of three elements: an attorney on one end, legal advice as the purpose, and confidentiality throughout. Lose one, and the protection goes with it.
For a legal department, the first two elements are rarely in doubt. The third is where AI creates exposure. Voluntary disclosure of a privileged communication to a third party outside the relationship waives the privilege, and an AI platform can be that third party depending on what its terms permit. If the vendor reserves the right to retain your inputs, train on them, or share them, a court may conclude that you had no reasonable expectation of confidentiality when you typed them in.
That is the failure mode to build policy around. It is not exotic. It is the same third-party disclosure rule that has governed emails to consultants and documents shared with vendors for decades, applied to a new category of vendor whose terms of service most users have never read.
For legal teams, these are the core AI privacy risks of public AI tools: disclosure, retention, model training, and the loss of control over sensitive information.
Public, Licensed, or Closed: Three Different Risk Profiles
Not every AI tool carries the same exposure. A free public chatbot, a licensed enterprise product, and a closed proprietary system deployed inside your own environment are three different contractual relationships, and the difference is where the privilege analysis begins.
When no one has reviewed or approved the tool, the organization has a shadow AI problem: AI use occurring outside the legal, security, and IT controls designed to protect confidential information.
Before anyone in the department uses a tool for matter-related work, settle these questions:
- Who owns the inputs and the outputs?
- Is prompt information used to train the model, and can you opt out?
- What do the terms of use and privacy policy say about retention and third-party access?
- Is there an audit trail, and does retention line up with your records policy?
- Can the vendor's employees see your data?
- What happens to it when the contract ends?
Enterprise tools with contractual confidentiality protections, no training on customer data, access controls, and an audit trail present a far stronger set of facts than a consumer product. No court has yet ruled squarely on privilege in that enterprise setting, but the doctrine points in a clear direction: the closer the tool looks to a confidential agent of the lawyer, the better the claim.
Get flexible support from top-tier lawyers experienced in AI governance.
Competence Now Includes the Technology
The duty of competence under Model Rule 1.1 has, since 2012, included keeping current on the benefits and risks of relevant technology. ABA Formal Opinion 512 applies that duty directly to generative AI, and it is candid that competence here is not a static undertaking. The tools keep changing, and so does what a reasonable lawyer needs to know about them.
That does not mean every lawyer needs to understand model architecture. It means understanding, at a working level, what happens to information you enter into a tool, what the tool does and does not do reliably, and where its output needs to be checked. Model Rule 1.6(c) reinforces the point: lawyers must make reasonable efforts to prevent unauthorized disclosure of client information, and you cannot make reasonable efforts to protect information from a system you do not understand.
In practice, that means [implementing legal AI with clear rules, review protocols, and human oversight
Researchers at Wharton draw a useful line between cognitive offloading, meaning using a tool to support your own reasoning, and cognitive surrender, meaning accepting the output without evaluating it. Privilege problems tend to follow the second one. So do sanctions.
Attorney-Client Privilege vs. Work Product Protection
These two often get treated as one safety net. They’re separate doctrines, and the difference matters when AI enters the workflow.
Attorney-client privilege protects communications, and it requires the attorney, the legal advice purpose, and confidentiality.
The work product doctrine protects materials prepared in anticipation of litigation. It reaches further in one respect, since it can cover documents created by a party or an agent working at counsel's direction rather than only by the lawyer. Opinion work product, meaning the mental impressions, conclusions, and legal theories of counsel, gets the strongest protection the rules offer.
For AI-assisted work, the practical variable is direction. Analysis a paralegal or business colleague generates with an AI tool at counsel's request, within a defined scope, has a far stronger work product claim than analysis someone produces on their own and forwards to legal afterward. Every AI session also creates a record. Each exchange produces an artifact that can end up on a privilege log or in a document request, so the process for directing and documenting that work deserves the same attention as the work itself.
Have You Talked to the Client?
ABA Formal Opinion 512 is direct on this. There are situations where Model Rule 1.4 requires a lawyer to raise AI use without being asked, and clients need to be informed in advance and give informed consent before a lawyer inputs information relating to the representation into a generative AI tool. For in-house counsel, that conversation is with the business. For outside counsel, it belongs in the engagement letter.
AI notetakers in meetings raise every one of these issues at once, along with consent, biometric data laws, and who can reach the recording afterward. The New York City Bar Association addressed this squarely in Formal Opinion 2025-6, on using AI to record, transcribe, and summarize conversations with clients.
The Case Everyone Will Ask You About
If your CEO or board has read about AI and privilege recently, they have probably read about United States v. Heppner. In February 2026, Judge Jed Rakoff of the Southern District of New York ruled that thirty-one documents created by a criminal defendant with a consumer chatbot were protected by neither attorney-client privilege nor the work product doctrine.
The decisive fact was the absence of a lawyer. The defendant worked through his defense alone with a chatbot, without his counsel's direction, and showed the documents to his attorneys only afterward. There was no privileged communication for the protection to attach to, and no attorney direction for work product to rest on.
That makes Heppner a case about privilege never attaching, which is not the scenario a legal department faces. What the case does offer is a reminder of how closely courts will read the facts of AI use, and how little sympathy they will have for an argument that a chatbot session should be treated like a conversation with counsel. It is a guardrail, not a holding about enterprise tools.
What This Means for Your Legal Department
None of this is an argument for avoiding these tools. ABA Formal Opinion 512 goes the other way, observing that as generative AI tools develop and become more widely available, lawyers may eventually have to use them to competently complete certain tasks. The obligation is to build an AI governance framework for the legal department around these tools: a vetted platform on terms you have read, a working understanding of how it handles your data, attorney direction over the work, and informed clients.
For help implementing an AI governance framework and usage policy, legal departments can benefit from consulting an artificial intelligence lawyer.
Frequently Asked Questions
Does using ChatGPT waive attorney-client privilege?
It can. Sharing confidential information with a public AI tool whose terms allow retention, training, or third-party access is disclosure to a third party, which is the classic route to waiver. The analysis depends on the specific tool's terms and how it was used.
Is information shared with a public AI tool still privileged?
Generally, no. Privilege requires confidentiality, and public platforms typically reserve the right to retain inputs, train on them, and share them with third parties. Those terms defeat the expectation the privilege depends on.
Can attorney-client privilege be preserved when using private or enterprise AI tools?
The doctrine leaves room for it. A licensed or closed proprietary system used at counsel's direction, with contractual confidentiality protections, no training on customer data, access controls, and an audit trail, presents a strong set of facts, though no court has ruled squarely on that scenario yet.
What does the duty of competence require for AI tools?
Model Rule 1.1 requires lawyers to keep current on the benefits and risks of relevant technology, and ABA Formal Opinion 512 applies that duty to generative AI. In practice, it means understanding what a tool does with your inputs, where it is reliable, and where its output needs review.
Does using AI waive work product protection?
It can. Work product protects materials prepared in anticipation of litigation, and attorney direction is a significant factor in whether the protection holds. Work generated by AI at counsel's direction has a stronger claim than work produced independently and forwarded later.
What is United States v. Heppner?
A February 2026 decision by Judge Jed Rakoff in the Southern District of New York holding that thirty-one documents a criminal defendant generated on his own with a consumer AI chatbot, without his lawyers' direction, were protected by neither attorney-client privilege nor the work product doctrine.
The court's primary ground was that no attorney was involved in the exchange, but it also found that entering information into a public tool under its terms of service waived any privilege that might otherwise have applied. The case is less about a lawyer's use of AI than about what happens when confidential information goes into a public platform with no counsel in the loop.