The read
AI is increasingly being used across the legal profession but could it risk undermining legal confidentiality? Lewis McKeown in our commercial team shares his thoughts.
The legal profession is rapidly embracing AI through use of closed, secure, paid-for platforms, be it for general administrative tasks or research.
However, a recent line of cases suggests that there is a key AI risk to confidentiality and legal privilege for client advice and information, which comes not from the lawyers' use of specialist AI, but from clients uploading advice to free systems such as ChatGPT to generate questions on their lawyers' advice and to assist with their internal report on the advice provided.
A 2026 UK Upper Tribunal decision (UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC)) has brought useful judicial attention to a question many firms have been considering: what happens to legal privilege and confidentiality if clients upload material into free to use AI systems like ChatGPT?
Inevitably, the Tribunal indicated that uploading confidential material to an open AI platform may result in loss of confidentiality, with potential consequences for legal privilege. While the precise scope of any waiver will depend on the facts, the decision underlines the real risk that using free AI tools can undermine legal privilege itself.
For lawyers utilising AI to assist with their practice, the use of closed, enterprise-grade AI tools where uploaded data is controlled, secure and not reused externally or to train AI models has been the clear and only way forward from the outset. However, that is only part of the picture.
The more difficult, and potentially more significant risk arises where clients themselves use widely available AI tools on their own confidential information to analyse the legal advice they have received or to draft their own contracts.
It is increasingly common for individuals and businesses to paste contracts, correspondence, or legal advice into AI platforms to "sense-check" their position, create new contracts or to bypass "legal spend" altogether. In doing so, they will very likely inadvertently compromise the confidentiality of their sensitive commercial information and potentially waive legal privilege bringing significant disadvantage, particularly in the context of disputes.
Recent US authority points in a similar direction. In United States v Heppner (25 Cr 503), a federal court suggested that materials shared with a public AI platform may fall outside attorney-client privilege altogether, on the basis that the exchanges lack the necessary element of confidentiality.
While the legal analysis differs somewhat from the UK approach, framed more in terms of privilege not attaching rather than a waiver of privilege, the underlying concern is consistent. Courts are, inevitably, finding the use of open AI systems impossible to reconcile with preservation of confidentiality in legal and other communications.
This creates a practical challenge for legal advisors. Even where firms implement robust internal controls, restricting staff to secure systems, training on responsible AI use and embedding governance frameworks into their firms, those safeguards do not and cannot extend to protect against a client's own actions in using AI. With confidentiality and legal privilege put at risk through the client's independent use of AI platforms like ChatGPT.
The risk is far from theoretical. A client might upload a draft witness statement, legal advice, or counsel's opinion into an AI tool without ever reading the tool's terms and conditions or appreciating the potential implications for disclosure. Once confidentiality and privilege is compromised, it is impossible to recover, potentially resulting in significant implications for businesses from a commercial and disputes perspectives.
This is why businesses should address how AI is used by its employees and contractors as a matter of urgency. Using ChatGPT or other freely available AI systems carries enormous risks for loss of confidentiality and legal privilege. It is essential to restrict use to secure, confidential, closed enterprise AI systems and if those are not available, staff and contractors should be clear they are not to use AI for any confidential material at all.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.