How Public AI Tools Waive Attorney-Client Privilege

How privilege is waived the moment data leaves the circle

Attorney-client privilege protects confidential communications made for legal advice. It survives only inside a closed circle of confidentiality. Voluntary disclosure to a third party outside that circle waives it, and a public AI vendor is a third party.

Attorney-client privilege is one of the oldest protections in common law, but it is also one of the most fragile. It shields confidential communications between a client and their attorney made for the purpose of obtaining legal advice. The protection depends entirely on confidentiality being preserved. The instant a privileged communication is voluntarily shared with a third party who sits outside the circle of confidence, the privilege is generally waived, and courts treat that waiver as difficult to undo.

A public or consumer AI platform is a third party. When a lawyer or client pastes case facts, draft strategy, or client documents into a general purpose model, that content is transmitted to and processed by the company operating the service. That company is not the client, not co-counsel, and not an agent retained under the direction of counsel. Under the plain logic of waiver doctrine, disclosing confidential material to it can break the reasonable expectation of confidentiality that privilege requires.

Two conditions have to hold at the moment of the communication for privilege to attach at all. First, there must be a genuine attorney-client relationship. Second, there must be a reasonable expectation that the communication stays confidential. Public AI use can fail both tests at once, which is why the exposure is not a hypothetical edge case but a structural problem with the tools themselves.

What recent courts have actually held

In 2026 federal courts began ruling on AI transcripts directly. One court held that documents a party created with a consumer AI tool were not privileged and not work product. Another preserved work-product protection where AI was used privately as a tool. The two turn on different standards.

For years the risk was argued in the abstract. That changed as courts started confronting AI transcripts in discovery. The clearest cautionary ruling treated documents that a party generated using a consumer AI assistant as falling outside both attorney-client privilege and the work-product doctrine, and the reasoning is worth understanding because it maps directly onto how these tools work.

1. No attorney-client relationship. A general purpose AI model is not a licensed attorney and owes no fiduciary duty. A person confiding in it is not confiding in counsel, so the foundational relationship privilege protects never exists.
2. No confidentiality. The terms of service for consumer AI tools commonly permit the provider to retain inputs, use them to train or improve models, and disclose them to third parties or the government in defined circumstances. That defeats the reasonable expectation of confidentiality.
3. No legal purpose the tool will stand behind. Consumer AI products routinely disclaim that they provide legal advice, which undercuts the argument that the exchange was a communication made to obtain legal advice.

A separate 2026 decision cut the other way on a narrower question. There, a self-represented litigant had used an AI tool privately to help prepare materials, and the court declined to find that this use waived work-product protection. The key distinction is the standard. Work-product protection is waived when material is disclosed to an adversary or in a way that substantially increases the chance an adversary sees it. Privilege is waived by disclosure to essentially any third party outside the circle. Using AI privately as a drafting tool did not hand anything to the opponent, so work product survived, even though the privilege analysis in the other case did not.

Why deleting the chat does not fix it

Turning off history or using a temporary chat does not guarantee the data is gone. Providers often retain inputs for a period for abuse monitoring, stored transcripts are discoverable by subpoena, and consumer-tier inputs may still be used to improve models.

A common misconception is that disabling chat history or using a temporary session removes the confidentiality problem. It generally does not. Many providers retain inputs for a defined window even when history is off, frequently cited around thirty days, in order to monitor for abuse and misuse. During that window the data exists on third-party systems and is subject to legal process.

Retention is only half the exposure. Consumer-tier products often reserve the right to use inputs to train or improve future models. Once confidential facts influence a model, they are not sitting in a file you can delete, they are diffused into a system you do not control. And there is no retroactive cure. Sharing an AI generated output with your attorney afterward does not convert it into a privileged document. Protection has to exist at the moment of the communication, not be applied in hindsight.

The ethics rules that now govern AI use

ABA Formal Opinion 512, issued in July 2024, is the first formal ethics guidance on generative AI. It confirms that duties of competence, confidentiality, communication, supervision, and candor all apply, and that lawyers must assess disclosure risk and obtain informed consent before inputting client data.

In July 2024 the American Bar Association issued Formal Opinion 512, its first formal ethics guidance addressing generative AI. It does not create new rules so much as confirm that the existing Model Rules of Professional Conduct apply fully to AI use, and it is unusually concrete about what that means in practice.

The confidentiality guidance is the sharpest. The opinion makes clear that a lawyer must evaluate the specific tool and its data handling before entering any information relating to a representation, and that boilerplate language buried in an engagement letter is not sufficient informed consent for using self-learning tools that may train on client data. Consent has to be genuinely informed, which means the client has to understand what the tool does with the data.

What defensible AI deployment looks like

Privilege can be preserved when AI runs inside a closed environment the firm controls, under enforceable no-training and zero-retention terms, with counsel directing the use. The governing framework is the Kovel doctrine, which extends privilege to agents working under an attorney direction.

None of this means law firms cannot use AI. It means the deployment has to be built so the data never leaves the protected circle. The safe-harbor pattern that emerges from the case law, the ethics guidance, and vendor practice has a consistent shape.

• Use enterprise or closed AI environments, not consumer products, with contractual guarantees of no training on your data and zero or strictly limited data retention.
• Push those guarantees down to sub-processors. The model provider behind the tool must be bound by the same no-training and deletion obligations, not just the vendor you contract with.
• Keep the use counsel-directed. Framing AI as an agent operating under the direction of the legal team is what brings it inside the circle under the Kovel doctrine, the long-standing rule that extends privilege to accountants, experts, and other agents assisting an attorney.
• Document that materials were prepared in anticipation of litigation and under the direction of counsel, which strengthens work-product protection independent of privilege.
• Never input sensitive client information into any tool that lacks enforceable confidentiality terms, and train every person who touches client data on that line.

The through line is control. Privilege is not waived by using software, it is waived by disclosing confidential material to a third party who is free to retain, train on, or reveal it. When the environment is closed, the terms are enforceable, and counsel directs the work, the confidential circle stays intact. When the tool is a public model with permissive terms, the circle is already broken the moment the client fact is typed. The safest posture is infrastructure the firm owns and controls outright, rather than confidential matters routed through a rented platform whose incentives and terms can change.