Does Using AI Waive Attorney-Client Privilege?

There’s nothing new about lawyers using tools to work faster. Legal research moved from bound volumes to Lexis and Westlaw, case files moved from cabinets to the cloud, and each shift arrived with someone predicting the end of careful practice. Generative artificial intelligence (AI) is the latest step in that progression, and for the most part, it earns its place. It finds information quickly, drafts usable content, analyzes contracts, and speeds document review.

What makes this step different, though, is where the information actually goes. When a lawyer runs a search on Westlaw, nothing about the matter leaves the relationship. When a lawyer pastes a board memo into a public chatbot, something might. For a legal department, the question is not whether privilege exists. If you provide legal advice, it does. The question is whether a tool your team uses can quietly give it away, and whether you understand the tool well enough to know.

U.S. Supreme Court Chief Justice John Roberts wrote in his 2023 year-end report that any use of AI requires caution and humility. For in-house counsel and the firms that support them, that caution comes down to three practical commitments: knowing which tools you are using and on what terms, understanding how those tools handle what you put into them, and keeping a lawyer in charge of the work.

Where the Risk Actually Lives

Attorney-client privilege protects confidential communications between a client and their lawyer for the purpose of obtaining legal advice. It’s composed of three elements: an attorney on one end, legal advice as the purpose, and confidentiality throughout. Lose one, and the protection goes with it.

For a legal department, the first two elements are rarely in doubt. The third is where AI creates exposure. Voluntary disclosure of a privileged communication to a third party outside the relationship waives the privilege, and an AI platform can be that third party depending on what its terms permit. If the vendor reserves the right to retain your inputs, train on them, or share them, a court may conclude that you had no reasonable expectation of confidentiality when you typed them in.

That is the failure mode to build policy around. It is not exotic. It is the same third-party disclosure rule that has governed emails to consultants and documents shared with vendors for decades, applied to a new category of vendor whose terms of service most users have never read.

For legal teams, these are the core AI privacy risks of public AI tools: disclosure, retention, model training, and the loss of control over sensitive information.

Public, Licensed, or Closed: Three Different Risk Profiles

Not every AI tool carries the same exposure. A free public chatbot, a licensed enterprise product, and a closed proprietary system deployed inside your own environment are three different contractual relationships, and the difference is where the privilege analysis begins.

When no one has reviewed or approved the tool, the organization has a shadow AI problem: AI use occurring outside the legal, security, and IT controls designed to protect confidential information.

Before anyone in the department uses a tool for matter-related work, settle these questions:

• Who owns the inputs and the outputs?
• Is prompt information used to train the model, and can you opt out?
• What do the terms of use and privacy policy say about retention and third-party access?
• Is there an audit trail, and does retention line up with your records policy?
• Can the vendor's employees see your data?
• What happens to it when the contract ends?

Enterprise tools with contractual confidentiality protections, no training on customer data, access controls, and an audit trail present a far stronger set of facts than a consumer product. No court has yet ruled squarely on privilege in that enterprise setting, but the doctrine points in a clear direction: the closer the tool looks to a confidential agent of the lawyer, the better the claim.

Get flexible support from top-tier lawyers experienced in AI governance.

Competence Now Includes the Technology

The duty of competence under Model Rule 1.1 has, since 2012, included keeping current on the benefits and risks of relevant technology. ABA Formal Opinion 512 applies that duty directly to generative AI, and it is candid that competence here is not a static undertaking. The tools keep changing, and so does what a reasonable lawyer needs to know about them.

That does not mean every lawyer needs to understand model architecture. It means understanding, at a working level, what happens to information you enter into a tool, what the tool does and does not do reliably, and where its output needs to be checked. Model Rule 1.6(c) reinforces the point: lawyers must make reasonable efforts to prevent unauthorized disclosure of client information, and you cannot make reasonable efforts to protect information from a system you do not understand.

In practice, that means [implementing legal AI with clear rules, review protocols, and human oversight

Researchers at Wharton draw a useful line between cognitive offloading, meaning using a tool to support your own reasoning, and cognitive surrender, meaning accepting the output without evaluating it. Privilege problems tend to follow the second one. So do sanctions.

Attorney-Client Privilege vs. Work Product Protection

These two often get treated as one safety net. They’re separate doctrines, and the difference matters when AI enters the workflow.

Attorney-client privilege protects communications, and it requires the attorney, the legal advice purpose, and confidentiality.

The work product doctrine protects materials prepared in anticipation of litigation. It reaches further in one respect, since it can cover documents created by a party or an agent working at counsel's direction rather than only by the lawyer. Opinion work product, meaning the mental impressions, conclusions, and legal theories of counsel, gets the strongest protection the rules offer.

For AI-assisted work, the practical variable is direction. Analysis a paralegal or business colleague generates with an AI tool at counsel's request, within a defined scope, has a far stronger work product claim than analysis someone produces on their own and forwards to legal afterward. Every AI session also creates a record. Each exchange produces an artifact that can end up on a privilege log or in a document request, so the process for directing and documenting that work deserves the same attention as the work itself.

Have You Talked to the Client?

ABA Formal Opinion 512 is direct on this. There are situations where Model Rule 1.4 requires a lawyer to raise AI use without being asked, and clients need to be informed in advance and give informed consent before a lawyer inputs information relating to the representation into a generative AI tool. For in-house counsel, that conversation is with the business. For outside counsel, it belongs in the engagement letter.

AI notetakers in meetings raise every one of these issues at once, along with consent, biometric data laws, and who can reach the recording afterward. The New York City Bar Association addressed this squarely in Formal Opinion 2025-6, on using AI to record, transcribe, and summarize conversations with clients.

The Case Everyone Will Ask You About

If your CEO or board has read about AI and privilege recently, they have probably read about United States v. Heppner. In February 2026, Judge Jed Rakoff of the Southern District of New York ruled that thirty-one documents created by a criminal defendant with a consumer chatbot were protected by neither attorney-client privilege nor the work product doctrine.

The decisive fact was the absence of a lawyer. The defendant worked through his defense alone with a chatbot, without his counsel's direction, and showed the documents to his attorneys only afterward. There was no privileged communication for the protection to attach to, and no attorney direction for work product to rest on.

That makes Heppner a case about privilege never attaching, which is not the scenario a legal department faces. What the case does offer is a reminder of how closely courts will read the facts of AI use, and how little sympathy they will have for an argument that a chatbot session should be treated like a conversation with counsel. It is a guardrail, not a holding about enterprise tools.

What This Means for Your Legal Department

None of this is an argument for avoiding these tools. ABA Formal Opinion 512 goes the other way, observing that as generative AI tools develop and become more widely available, lawyers may eventually have to use them to competently complete certain tasks. The obligation is to build an AI governance framework for the legal department around these tools: a vetted platform on terms you have read, a working understanding of how it handles your data, attorney direction over the work, and informed clients.