When using AI risks waiving legal professional privilege

Not all generative AI tools are created equally, particularly for use in legal practice.

Many tools, particularly open-source platforms, do not operate within a controlled environment that lawyers are used to. They often assert broad rights over user input, allowing data to be stored, processed, or used for training. If that data includes confidential client information, it may sit on third-party servers, be exposed to security weaknesses or data breaches, or be used in ways inconsistent with maintaining privilege.

In those situations, the issue is not necessarily misuse; it is loss of control.

And in the context of privilege, loss of control can be enough.

Uploading privileged material into an open AI system where confidentiality does not attach may amount to disclosure to a third party, and privilege should be treated as waived.

Courts and regulators are starting to engage with this risk. While there is no settled position, the direction of travel is clear.

VIEW ALL

In Helmond & Mariya (No 2)^[1] and Mertz & Mertz (No 3)^[2], courts warned that entering documents into a generative AI tool carries a risk^[3] of waiving privilege, urging practitioners to exercise extreme caution.^[4]

The Federal Court recently noted that the risk of inadvertent disclosure may be lower when using closed systems.^[5]

Just last week, the Victorian Supreme Court issued updated guidance on the use of AI, expressly flagging privacy risks associated with public versus closed AI tools, including to advise that confidential client information should not enter public AI tools, and confirming that court users bear responsibility for the accuracy of AI-assisted filing.^[6]

Regulators have taken a similar approach. Legal bodies in Victoria, NSW, and Western Australia^[7] have cautioned against entering confidential or privileged client information into publicly available tools such as ChatGPT, emphasising the need to understand how those systems handle data and what rights providers retain.

International decisions reflect the same tension, although the position is still developing.

In United States v Heppner^[1], AI was treated as a “third party”, meaning documents generated using Claude were not protected by privilege – noting that its terms undermined confidentiality and that its use was not directed by legal counsel. In comparison, in Warner v Gilbarco, Inc.,^[2] the AI was treated as a “tool” used by a self-represented litigant to prepare materials in anticipation of litigation, allowing protection to remain. In Morgan v V2X^[3], the court accepted that AI-assisted work could remain protected, but only where there was sufficient transparency to assess whether confidentiality had been compromised.

In the United Kingdom, Munir v Secretary of State for the Home Department^[4] differentiated between types of AI, warning that uploading client material to open-source AI tools risks waiving confidentiality and privilege, while distinguishing closed systems as presenting a lower risk.

Taken together, these decisions do not draw a bright line, but they point to a consistent theme.

The question is not simply whether AI is being used. It is whether client confidentiality is preserved when it is.

For practitioners, that shifts the focus from capability to control.

Closed systems, such as paid, in-house or firm-hosted platforms, are often seen as safer, offering greater security and clearer contractual terms. But even then, a critical question remains: how closed is “closed”?

Understanding the relevant terms of use is essential. Who can access the data? How is it stored? Is it reused or shared? Is it used to train the model?

Using AI does not reduce professional obligations. In fact, the opposite, it requires added vigilance. Maintaining oversight, applying judgement, and being deliberate about how and when AI is used becomes more important, not less.

In cases where AI tools are intended to be used in connection with client information, that extends to obtaining informed client consent before use.

If there is doubt about whether a system can maintain confidentiality, the default position should be not to input the information at all. Because once that material leaves the environment in which privilege attaches, it is not recoverable.

The law in this area is still evolving. There is no single, definitive position on how generative AI interacts with legal professional privilege. Until there is greater judicial certainty, a cautious approach is not just sensible, it is essential.

For lawyers, the real question is not whether AI can assist in practice. It is whether its use preserves the protections that legal practice depends on.

Catie Moore is partner and Lauren Separovich is special counsel at Hall & Wilcox.

References:

^[1] [2025] FedCFamC1A 163 (Helmold).

^[2] [2025] FedCFamC1A 222 (Mertz).

^[3] Mertz at [15].

^[4] Helmold at [9].

^[5] Federal Court of Australia’s ‘Use of Generative Artificial Intelligence Practice Note (GPN-AI)’ dated 16 April 2026.

^[6] Supreme Court of Victoria’s ‘SC GEN 25 - The Use of Artificial Intelligence by Court Users’ and ‘Guidelines: The Use of Artificial Intelligence by Judicial Officers’ dated 14 May 2026.

^[7] Law Society of New South Wales, Legal Practice Board of Western Australia, Victorian Legal Services Board + Commissioner released a joint ‘Statement on the Use of Artificial Intelligence in Australian Legal Practice’ (6 December 2024).

^[8] 1:25-cr-00503(JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026).

^[9] No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026).

^[10] Civil Action No. 25–cv–01991–SKC–MDB. (D. Colo. March 30, 2026).

^[12] [2026] UKUT 81 (IAC).