Key takeaways
- ABA Formal Opinion 512 requires informed client consent before inputting representation information into a self-learning AI tool.
- Boilerplate engagement letter language is not enough for that consent under Opinion 512.
- In United States v. Heppner (S.D.N.Y. 2026), a defendant's documents created with a public AI platform were held not privileged.
- Encrypted sensitivity labels and endpoint DLP can stop privileged content from being pasted or uploaded into unapproved AI sites.
- Managerial lawyers must set clear policies on permissible AI use and train lawyers and staff.
Why do privileged documents end up in AI tools?
Privileged documents end up in AI tools because attorneys and staff can paste them into a personal or free AI account in seconds, outside any firm control. Attorneys use AI to summarize depositions, tighten drafts and reorganize research, and the fastest route is often a browser tab. Once a privileged memo or client communication lands in a tool the firm does not control, attorney-client privilege and confidentiality are both at risk: the firm may lose control over who can see it, how long it is kept and whether a court will treat it as confidential.
The fix is a mix of policy and enforcement: label privileged material, block it from unapproved AI sites, keep the firm's own AI tools away from the most sensitive matters, and give attorneys an approved tool so they have no reason to work around the rules.
What do the ethics rules say about AI and client confidences?
They put the duty on the lawyer and on the firm's managers. ABA Formal Opinion 512, issued July 29, 2024, says self-learning AI tools "raise the risk that information relating to one client's representation may be disclosed improperly." It concludes that "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool," and that "merely adding general, boiler-plate provisions to engagement letters" is not enough. It also says all lawyers "should read and understand the Terms of Use, privacy policy, and related contractual terms" of the tools they use.
Opinion 512 is just as direct about firm management: "Managerial lawyers must establish clear policies regarding the law firm's permissible use of GAI," and supervisory duties include making sure subordinate lawyers and nonlawyers are trained.
In California, the duty starts with Business and Professions Code section 6068(e)(1), which requires an attorney to maintain inviolate the confidence, and at every peril to preserve the secrets, of the client. The State Bar's Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law says a lawyer "must not input any confidential information of the client into any generative AI solution" that lacks adequate confidentiality and security protections, should review how a product uses inputs, and should consult IT or cybersecurity professionals about the tool's security and retention.
Does using AI waive attorney-client privilege?
It can, and a 2026 federal ruling went against the user. In United States v. Heppner, No. 25 Cr. 503 (S.D.N.Y. Feb. 17, 2026), Judge Jed S. Rakoff held that documents a defendant generated with a public AI platform, on his own initiative, were protected by neither the attorney-client privilege nor the work product doctrine. The court pointed to the platform's privacy policy, which allowed retention of inputs and outputs and disclosure to third parties, as undercutting any reasonable expectation of confidentiality.
The court found the documents were never privileged in the first place, rather than finding a waiver. The case involved a client acting without direction from counsel, and courts may view firm-managed tools under confidentiality terms differently. It is still a clear warning: consumer AI terms and privileged material do not belong together.
What controls actually keep privileged content out of AI tools?
Sensitivity labels, browser DLP, Copilot restrictions, web filtering and an approved alternative. A written policy alone does not stop a paste at 11 p.m. before a filing deadline. For firms on Microsoft 365, these controls do most of the work.
Label privileged material
Create a sensitivity label for privileged and confidential matter content and apply it with encryption, starting with active litigation. Microsoft states that other AI apps "can't decrypt content that's encrypted by Microsoft Purview", so labeled content that is pasted or uploaded elsewhere cannot be processed.
Block paste and upload to unapproved AI sites
Microsoft Purview endpoint DLP can restrict pasting sensitive content into browsers using sensitive service domain groups, for example a group of public AI sites. It supports Edge, Chrome and Firefox on Windows and macOS and Safari on macOS, with actions of audit, block with override or block. Rules can trigger on the privileged label, on phrases such as "attorney-client privileged" or on client identifiers. Separate rules cover file uploads.
Keep Copilot away from the most sensitive matters
If the firm uses Microsoft 365 Copilot, a Purview DLP policy for the Copilot location can prevent Copilot from processing files and emails that carry specific sensitivity labels. Microsoft notes a blocked item may still appear in the citations of a response, so test it on a sample matter first.
Filter AI sites and alert on new ones
Web filtering should allow the firm's approved AI tool and block or warn on the rest. DNS filtering is part of the CIS Controls IG1 baseline, so many firms already have the tool in place. New-app alerts flag the next AI tool someone signs up for with a firm email address, before it becomes a habit.
Give attorneys an approved tool
Blocking without an alternative pushes people to personal phones. Provide one firm-managed AI tool under a business agreement that excludes training on firm data and sets retention and confidentiality terms the firm has actually read.
What should a firm AI policy say about privileged material?
Keep it short and specific so attorneys can follow it under deadline pressure.
- Which AI tools are approved, and for which tasks.
- That privileged and client-confidential material goes only into approved tools, and only with client informed consent where Opinion 512 calls for it.
- That personal AI accounts are never used for client work.
- Who to tell, and how quickly, if privileged material reaches an unapproved tool.
- That the responsible attorney reviews every AI output before it is used.
- How long prompts and outputs tied to a matter are kept, on the same schedule as the client file.
What should the firm do this quarter?
Start with visibility, then turn on enforcement in stages.
- Find out which AI tools attorneys and staff already use, from sign-in logs and web traffic.
- Publish a privileged sensitivity label and apply it to active matters first.
- Turn on endpoint DLP for AI sites in audit mode for two weeks, review the results, then move to block with override.
- Approve one AI tool and sign a business agreement.
- Review engagement letter language with counsel, keeping in mind that boilerplate alone is not informed consent under Opinion 512.
- Train attorneys and staff, and run a short drill on what to do after an accidental paste.
How s90 helps
s90 configures data loss prevention for law firms: sensitivity labels for privileged material, browser DLP for AI sites, Copilot restrictions and web filtering, with alerts when new AI tools appear. We document the setup so firm management can show how it meets its supervision duties. If you want to see where privileged content could leave the firm today, we can walk through it with you.
