Can lawyers use AI without violating attorney–client privilege?

Yes, if the tool's architecture protects confidentiality. ABA Model Rule 1.6 and Formal Opinion 512 require reasonable efforts to prevent disclosure, an understanding of the tool's data-retention and training policies, and awareness of the risk of sharing information with public models. Local processing — where ingestion, search, and answering run on the lawyer's own computer — keeps client information from leaving the firm's hardware at all.

Can pasting client documents into a public chatbot waive privilege?

It can. Sharing privileged material with a third party who isn't needed for the representation can waive the privilege, and if the vendor stores your uploads or trains models on them, your client's information lives in a database you don't control. Ask three questions before uploading: Is my data used for training? Who can access it and for how long? Where does processing actually happen?

What is the difference between cloud 'private AI' and local processing?

Cloud private AI still sends your documents to a provider's infrastructure, protected by a contract rather than by physics. Local processing runs retrieval, embedding, search, and answer generation on the lawyer's own computer, so client information never leaves the firm's hardware. The confidentiality protection isn't a contractual promise — it's the absence of the transmission.

What should a lawyer check before using any AI tool?

Can I use it with my most sensitive matters without sending data anywhere? What exactly is transmitted — just the question, or the documents too? Does the tool use my data for training, and will it promise in writing that it won't? What happens to my data when I delete the account or stop paying? Is the security architecture documented and auditable?

Do enterprise AI agreements protect attorney-client privilege?

They reduce but don't eliminate risk. Enterprise contracts typically promise no training on customer data and may include confidentiality provisions, but data still leaves your control and resides on vendor servers. Vendor security breaches, government subpoenas, or vendor bankruptcy could expose client information. For highly sensitive matters (M&A, sensitive litigation, government investigations), consider whether contractual protections are sufficient or whether local-only processing is required under your duty of confidentiality.

Can courts compel disclosure of prompts sent to AI tools?

Potentially yes, if prompts contain factual information rather than legal analysis. Courts distinguish between facts (discoverable) and attorney mental impressions (work product protected). A prompt like 'summarize the Smith deposition' might be protected, but 'does the 2023 supply agreement require 30-day notice for termination' reveals factual investigation. If prompts are stored on third-party servers, they may be subpoenaed from the vendor. Local-only tools where prompts never leave your device avoid this exposure entirely.

What happens if an AI vendor gets breached?

Your client's information may be exposed, and you may have a duty to notify under data breach laws and Model Rule 1.4 (communication). Depending on jurisdiction, you could face malpractice claims for failing to adequately protect confidential information. Some malpractice insurers are starting to ask about AI tool usage and data handling practices. The risk is higher if you uploaded privileged communications, trade secrets, or personally identifiable information without informed client consent as required by ABA Opinion 512.

Attorney–Client Privilege and AI: Where Does Your Client's Data Go?

Confidentiality is the load-bearing wall of the legal profession. ABA Model Rule 1.6 requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." It is not a suggestion, and it does not pause because a new technology is convenient.

So when a lawyer pastes a draft settlement agreement into a web chatbot, or uploads a due-diligence bundle to a cloud AI tool, the honest question is: where, exactly, did that client information just go — and who can see it?

Privilege isn't a checkbox — it's a chain of custody

Attorney–client privilege protects communications between lawyer and client. But the protection can be compromised in ways that feel technical and end up being decisive:

Third-party disclosure: share privileged material with a third party who isn't needed for the representation, and the privilege can be waived — even if you intended no such thing.
Retention and training: if an AI vendor stores your uploads or trains its models on them, your client's information now lives in a database you don't control, with retention policies you didn't negotiate.
Access: every extra server, employee, and subcontractor in the chain is another place the information can be seen, breached, or subpoenaed.

The ABA's Formal Opinion 512 (July 2024) was explicit about this: lawyers using generative AI must make reasonable efforts to prevent the disclosure of client information, understand the tool's data-retention and training policies, and appreciate the risk of sharing information with public models. Several state bars have gone further, requiring lawyers to verify whether inputs are used for training before uploading client data.

"Confidentiality in the AI era is not a feature in a marketing deck. It is a chain of custody — and the chain is only as strong as its weakest server."

The three questions every lawyer should ask

Before any lawyer or firm adopts an AI research or drafting tool, the vendor's answers to three questions should decide the matter:

Is my data used for training or fine-tuning? If the answer is anything other than an unambiguous "no," assume client data is being absorbed into a model that may reproduce it later.
Who can access my data, and for how long? Look for zero-retention or explicit deletion commitments, and ask what happens to your files when you stop paying or delete the account.
Where does processing actually happen? Does the tool send your documents to a cloud provider, or does it process them on the machine in front of you?

Notice that "privacy policy" language alone is not an answer. A page that says "we take data security seriously" tells you nothing about where the bytes are. The meaningful questions are architectural: where is the compute, and who can touch the data?

Cloud "private AI" vs. local processing

Cloud AI vendors have responded to this pressure with enterprise tiers: private instances, data-not-used-for-training pledges, zero-retention agreements. For large firms with the leverage to negotiate enterprise contracts, those can be workable. But the model is still the same — your documents leave your control and travel to a provider's infrastructure, protected by a contract rather than by physics.

Local processing is a different category entirely. When retrieval, embedding, search, and answer generation all run on the lawyer's own computer, client information never leaves the firm's hardware at all. There is no upload, no retention policy to trust, no vendor database to breach. The confidentiality protection isn't a contractual promise — it's the absence of the transmission.

This is why "local-first" has become the privacy architecture of choice for solo and small-firm practitioners who cannot command enterprise vendor contracts but have the same Rule 1.6 duty as an Am Law 100 partner.

What Lawyer Assistant does — and the honest caveat

Lawyer Assistant was designed around the local-first model: document ingestion, indexing, hybrid search, and cited answer generation all run on your own machine. In local mode, no question, document, or answer is transmitted anywhere — there is no cloud and no telemetry. The security model is documented in full, including how API keys are handled and how the Electron sandbox is configured.

The honest caveat: if you choose to connect an API provider instead of a local model, then your question plus the retrieved passages are sent to that provider — the app shows this clearly rather than silently. That is the trade-off being made explicit, which is exactly what a lawyer should demand: know when data is leaving, and choose it deliberately.

A confidentiality checklist for any AI tool

Can I use it with my firm's most sensitive matters without sending data anywhere? If not, which matters are off-limits?
What exactly is transmitted — just the question, or the documents too?
Does the tool use my data for training? Will it promise in writing that it won't?
What happens to my data when I delete my account or stop paying?
Is the tool's security architecture documented and auditable, or am I expected to take it on faith?

If a tool can't answer those questions in plain terms, it isn't ready for client work — no matter how impressive the demo.