Managing Privilege and Confidentiality Risks with Public AI Tools
Artificial intelligence tools such as ChatGPT are increasingly being used to streamline document drafting, summarise information, and assist with legal research. While these tools can offer significant efficiencies, for litigants, businesses and legal teams, using public, third‑party AI can create real risks for legal professional privilege, confidentiality, disclosure and regulatory compliance.
Whether you are involved in litigation, managing sensitive commercial information or seeking legal advice, understanding those risks is becoming increasingly important. Although those risks are manageable, they require careful governance and informed use.
Legal Professional Privilege in Outline
In England and Wales, legal professional privilege (LPP) protects confidential communications made for specific purposes. Understanding what privilege protects is essential before considering how AI tools may affect it.
In broad terms:
- Legal advice privilege protects confidential communications between client and lawyer for the purpose of giving or obtaining legal advice.
- Litigation privilege protects confidential communications or documents created for the dominant purpose of conducting existing or reasonably contemplated adversarial litigation.
Courts have emphasised that confidentiality is central to legal professional privilege. If confidentiality is lost, in whole or in part, privilege may be compromised. Whether privilege has been waived will always depend on the particular facts of each case.
Why Public AI Tools Create New Risks
When information is entered or uploaded to a public generative AI platform, it may be shared with a third‑party provider whose systems, personnel or subprocessors could potentially access that information. Depending on the platform’s terms of use, user inputs may also be retained or used for service improvement or model training. Even where a provider offers opt‑out options, the surrounding circumstances may later be scrutinised in disclosure disputes.
Examples include:
- Pasting legal advice into ChatGPT for summarisation
- Uploading draft pleadings or witness statements for editing
- Asking AI to suggest litigation strategy based on confidential facts
These interactions can create arguments that confidentiality was not maintained, or that there has been a waiver of privilege.
Waiver, loss of confidentiality and inadvertent disclosure
It is important to distinguish concepts.
- Waiver: Privilege can be waived expressly or impliedly by conduct inconsistent with maintaining confidentiality. Sharing privileged material with a third party may amount to a waiver depending on the context, purpose and protections. Whether there is a waiver, and the scope of any waiver, is assessed case by case.
- Loss of confidentiality: Even if a court does not find a waiver, disclosure that destroys confidentiality may prevent privilege being asserted thereafter. The analysis turns on who received the information, on what terms, and how far it was disseminated.
- Inadvertent disclosure: If privileged material is disclosed by mistake, courts may in some circumstances permit its return and restrain use, particularly where steps were taken promptly on discovery. Outcomes depend on the facts and the stage of proceedings.
- Limited waiver: Privilege may, in some contexts, be waived for a limited purpose or to a limited class of recipient, without broader collateral waiver. The scope and effect are carefully policed and are highly fact‑specific.
Using ChatGPT or another public AI tool does not automatically mean privilege is lost. Equally, where the circumstances resemble voluntary disclosure to a third party without adequate safeguards, the greater the risk that privilege or confidentiality will be treated as compromised.
Factors the Court May Consider
Courts assessing privilege arguments in the AI context are likely to look at matters such as:
- The platform’s terms of use and data handling practices.
- Whether human access was possible.
- Whether prompts or uploaded content could be used for model training.
- The contractual and technical confidentiality safeguards in place.
- The sensitivity and purpose of the material disclosed.
- The user’s knowledge, role, and level of sophistication.
Even uncertainty over these issues can increase litigation risk, cost and complexity.
Potential Consequences
If confidentiality is compromised or privilege is found to have been waived, the consequences can be significant. They may include:
- Wider disclosure of sensitive documents.
- Inspection of privileged material by opponents.
- Increased interim skirmishes over privilege.
- Reputational harm.
- Potential regulatory scrutiny.
For regulated entities and professional firms, failures in information security, confidentiality or supervision may also engage professional and regulatory obligations.
Data Protection and Confidentiality Duties
Uploading personal data to public AI tools engages UK data protection law. Organisations must have a lawful basis, respect purpose limitation and data minimisation, ensure appropriate transparency and safeguards for international transfers, and implement suitable technical and organisational measures. Special category data raises heightened requirements. Separately, common law duties of confidence, contractual confidentiality obligations and sector‑specific confidentiality regimes may be engaged. This section is high‑level and does not constitute compliance advice.
Practical checklist: managing AI, privilege and confidentiality
- Avoid pasting privileged or confidential material into public AI tools.
- Use enterprise‑grade tools with written assurances that prompts and outputs are not used for training and are segregated, with audit and deletion rights.
- Check and document the platform’s terms, data locations, retention, subprocessors and access controls.
- Anonymise or aggregate where possible; remove direct identifiers and distinctive facts.
- Implement internal AI policies, training and approval gates for use cases touching legal or confidential data.
- Record decisions and safeguards where AI is used in matters with potential litigation.
- Seek early legal advice if any disclosure or waiver issue arises.
The Law Is Developing, But the Principle Endures
Courts are still adapting established privilege principles to emerging technologies, but the core remains the same: privilege depends on maintaining confidentiality. Until there is clearer authority in this area, cautious and well‑documented practice is the safest course.
Conclusion
Public generative AI can deliver efficiencies, but careless use in legal or contentious contexts can jeopardise privilege, confidentiality and compliance. Approach third‑party tools as you would any external recipient of sensitive information: limit disclosures, use secured enterprise solutions with contractual safeguards, and keep clear records of your decisions and protections.
Need Advice on Confidentiality or AI Governance?
If your business is using AI tools as part of its day-to-day operations, or you are concerned about protecting legally privileged or confidential information during a dispute, obtaining legal advice at an early stage can help reduce risk.
Our commercial litigation team advises businesses, professionals and organisations on complex disputes, confidentiality obligations and litigation strategy. If you would like to discuss your circumstances, please call 0207 586 1141 or email contact@muscattblackgraf.com, or alternatively, fill in our online contact form.
Disclaimer
This blog is provided for general information only and does not constitute legal or compliance advice. Specific advice should be sought about your particular circumstances. Laws and regulatory expectations may change, and outcomes in privilege disputes are fact‑sensitive.