Key Takeaways
- A lawyer's duty of confidentiality covers all information relating to a client's representation, so client names, identifying details and traceable scenarios should not go into public AI tools.
- Putting privileged material into a third-party AI system risks a claim that the privilege was waived. In 2026 a federal court held that a defendant's own conversations with a consumer AI tool were not privileged, and that pasting his lawyers' advice into it waived privilege over that advice.
- As with cloud storage, AI tools can be used more safely when the vendor contractually limits how the data is used and who can access it. The business versions of the major AI tools now exclude customer data from training by default.
Generative AI can draft, summarize and analyze in seconds. But what happens to the client information a lawyer types in?
In this TalksOnLaw Brief, Joel Cohen talks with Tanina Rostain, professor at Georgetown University Law Center, about the confidentiality and privilege risks of using AI tools on client matters, and the safeguards that can make them usable.
Information Flows Both Ways
When a lawyer enters information into the public version of a model, Professor Rostain explains, the lawyer is giving that information to the provider. Because the duty of confidentiality covers all information relating to a client's representation, lawyers have to be careful about the level of detail they put into the system. She points to early ethics guidance from California, which advises telling clients about AI use, and from Florida, which calls for informed consent, both reflecting concern that consumer systems may use inputs to keep training their models.
The Privilege Problem
The larger risk, she says, may be waiver of attorney-client privilege or work-product protection. If privileged communications or work product are handed to an AI system, an opponent might subpoena the lawyer or the AI company and argue the privilege was waived by disclosure to a third party, much as lawyers once worried about email. Until legislation or case law settles the question, she says, that remains a risk.
Treat It Like Any Vendor
Legal technology companies have responded by promising to handle data more protectively than the public models. Professor Rostain compares AI to cloud storage and case management systems: there was once a debate about whether storing files in the cloud violated the duty of confidentiality, and the bar concluded it was just a different kind of storage, as long as the vendor made representations about security and access. The same principle, she expects, will govern AI. What matters is that vendors spell out the protections they provide for the data lawyers put into their systems.
What to Know Now
This conversation was recorded in July 2024, just before the ABA's first formal opinion on generative AI and well before courts began ruling on these questions. The law has since filled in behind Professor Rostain's analysis. ABA Formal Opinion 512 (July 29, 2024) applies the existing duties of competence, confidentiality, communication and supervision to generative AI: before entering information relating to a representation into a tool that learns from its inputs, a lawyer must evaluate the risk of disclosure and, depending on the tool, obtain informed client consent. Boilerplate in an engagement letter is not enough. New York City, North Carolina, Texas, Oregon and other bars have issued opinions along the same lines, and California replaced its 2023 guidance in May 2026 with a version that addresses retention, training and agentic AI.
Courts have now addressed privilege directly. In United States v. Heppner (S.D.N.Y. Feb. 17, 2026), Judge Jed Rakoff held that documents a criminal defendant created on his own with the consumer version of an AI tool were protected by neither attorney-client privilege nor the work-product doctrine: the AI is not a lawyer, its privacy policy disclosed that inputs could be collected and shared, and no lawyer had directed its use. The court also held that by pasting his lawyers' privileged advice into the tool, the defendant waived privilege over that advice. The decision left open whether counsel-directed use of an AI tool might be treated differently, as the use of an agent of the lawyer. One week earlier, in Warner v. Gilbarco (E.D. Mich. Feb. 10, 2026), a magistrate judge refused to find that a pro se litigant waived work-product protection by drafting with ChatGPT, reasoning that generative AI programs "are tools, not persons." The two decisions turn on the same distinction Professor Rostain anticipated: who directed the use, and what the provider's terms allow.
The risk that consumer-tier conversations are not private is no longer theoretical. In the copyright litigation brought by The New York Times against OpenAI, a federal magistrate judge in May 2025 ordered OpenAI to preserve ChatGPT output logs that would otherwise have been deleted, and in January 2026 the court affirmed an order to produce 20 million de-identified consumer chat logs. The preservation order carved out Enterprise and zero-data-retention customers, which shows how much the choice of tier matters. On the vendor side, the business and enterprise versions of ChatGPT, Claude and Gemini now state that customer inputs are not used to train their models by default, which is the kind of contractual protection Professor Rostain said lawyers should look for. "No training" is not "no retention," though, and every provider reserves the right to disclose data when legally compelled, so lawyers should still read the terms before they type.
