Attorney–Client Privilege and AI: Where Does Your Client's Data Go?

Confidentiality is the load-bearing wall of the legal profession. ABA Model Rule 1.6 requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." It is not a suggestion, and it does not pause because a new technology is convenient.

So when a lawyer pastes a draft settlement agreement into a web chatbot, or uploads a due-diligence bundle to a cloud AI tool, the honest question is: where, exactly, did that client information just go — and who can see it?

Privilege isn't a checkbox — it's a chain of custody

Attorney–client privilege protects communications between lawyer and client. But the protection can be compromised in ways that feel technical and end up being decisive:

• Third-party disclosure: share privileged material with a third party who isn't needed for the representation, and the privilege can be waived — even if you intended no such thing.
• Retention and training: if an AI vendor stores your uploads or trains its models on them, your client's information now lives in a database you don't control, with retention policies you didn't negotiate.
• Access: every extra server, employee, and subcontractor in the chain is another place the information can be seen, breached, or subpoenaed.

The ABA's Formal Opinion 512 (July 2024) was explicit about this: lawyers using generative AI must make reasonable efforts to prevent the disclosure of client information, understand the tool's data-retention and training policies, and appreciate the risk of sharing information with public models. Several state bars have gone further, requiring lawyers to verify whether inputs are used for training before uploading client data.

"Confidentiality in the AI era is not a feature in a marketing deck. It is a chain of custody — and the chain is only as strong as its weakest server."

The three questions every lawyer should ask

Before any lawyer or firm adopts an AI research or drafting tool, the vendor's answers to three questions should decide the matter:

1. Is my data used for training or fine-tuning? If the answer is anything other than an unambiguous "no," assume client data is being absorbed into a model that may reproduce it later.
2. Who can access my data, and for how long? Look for zero-retention or explicit deletion commitments, and ask what happens to your files when you stop paying or delete the account.
3. Where does processing actually happen? Does the tool send your documents to a cloud provider, or does it process them on the machine in front of you?

Notice that "privacy policy" language alone is not an answer. A page that says "we take data security seriously" tells you nothing about where the bytes are. The meaningful questions are architectural: where is the compute, and who can touch the data?

Cloud "private AI" vs. local processing

Cloud AI vendors have responded to this pressure with enterprise tiers: private instances, data-not-used-for-training pledges, zero-retention agreements. For large firms with the leverage to negotiate enterprise contracts, those can be workable. But the model is still the same — your documents leave your control and travel to a provider's infrastructure, protected by a contract rather than by physics.

Local processing is a different category entirely. When retrieval, embedding, search, and answer generation all run on the lawyer's own computer, client information never leaves the firm's hardware at all. There is no upload, no retention policy to trust, no vendor database to breach. The confidentiality protection isn't a contractual promise — it's the absence of the transmission.

This is why "local-first" has become the privacy architecture of choice for solo and small-firm practitioners who cannot command enterprise vendor contracts but have the same Rule 1.6 duty as an Am Law 100 partner.

What Lawyer Assistant does — and the honest caveat

Lawyer Assistant was designed around the local-first model: document ingestion, indexing, hybrid search, and cited answer generation all run on your own machine. In local mode, no question, document, or answer is transmitted anywhere — there is no account, no cloud, and no telemetry. The security model is documented in full, including how API keys are handled and how the Electron sandbox is configured.

The honest caveat: if you choose to connect an API provider instead of a local model, then your question plus the retrieved passages are sent to that provider — the app shows this clearly rather than silently. That is the trade-off being made explicit, which is exactly what a lawyer should demand: know when data is leaving, and choose it deliberately.

A confidentiality checklist for any AI tool

• Can I use it with my firm's most sensitive matters without sending data anywhere? If not, which matters are off-limits?
• What exactly is transmitted — just the question, or the documents too?
• Does the tool use my data for training? Will it promise in writing that it won't?
• What happens to my data when I delete my account or stop paying?
• Is the tool's security architecture documented and auditable, or am I expected to take it on faith?

If a tool can't answer those questions in plain terms, it isn't ready for client work — no matter how impressive the demo.