Can a law firm use AI without breaking privilege?
Privilege is about custody, not mathematics. Where the real confidentiality line runs for law firms using AI, and the four properties that make a system defensible.
Every law firm now runs the same internal debate. Associates are already pasting things into chat assistants, clients are asking what the firm's AI position is, and somewhere a partner has read that privilege and confidentiality make all of it impossible. All three of those facts deserve to be taken seriously, and the third one deserves to be taken precisely rather than fearfully.
The precise version: privilege is not a force field around the firm. It is a set of duties about who may see client information and under whose control it sits. Software does not break privilege. Uncontrolled disclosure breaks privilege, and some software is built in a way that makes uncontrolled disclosure the default. The task is telling the two kinds apart.
Where the real line runs
When an associate pastes a clause into a free consumer assistant, the client's information leaves the firm's control, lands on infrastructure governed by someone else's terms, and may be retained or used in ways nobody at the firm can see or stop. Whether or not a court would ever call that a breach of privilege in a given case, it is an uncontrolled disclosure of confidential material, and no firm can defend it as a practice. The instinct that says we cannot have this is correct.
But notice what the instinct is actually about. It is not about the mathematics of a language model. It is about custody: whose systems, whose terms, whose logs, whose control. A system that runs under the firm's own engagement, holds the firm's data in an environment contractually and technically dedicated to that firm, shares nothing across clients of the supplier, and records every access, sits on the same side of the custody line as the firm's document management system. Firms did not abandon email or DMS because confidentiality matters; they demanded versions of them built for custody. The same move is available here.
What that means in practice
Four properties separate defensible systems from indefensible ones, and they are checkable in a contract and a demonstration rather than a slide.
Dedication. The firm's matter data is used for the firm's work and nothing else. It trains no shared model, improves no other customer's product, and is never pooled. If the supplier's economics depend on learning across clients, the answer is no.
Scope. The system reaches only the sources the firm names, matter by matter where needed. Ethical walls inside the firm must be walls inside the system too.
The record. Every retrieval, every draft, every suggestion is logged with its reasoning and reviewable. When a client, a regulator or an opponent one day asks how a document came to be, the firm can answer from the record instead of from memory.
The person. Nothing leaves the building on a system's authority. Advice, filings and client communication carry a lawyer's judgement and a lawyer's name, with the system in the position of a very fast, very well-read assistant whose work is always reviewed.
The question firms should actually be debating
Framed this way, the confidentiality question has a workable answer, and the interesting question moves. It becomes economic: what happens to a leverage model when the routine layer of research, first drafts and matter memory costs a fraction of what it used to? What happens to knowledge management when the firm's entire history of matters becomes present at the moment of drafting instead of buried in archives? Firms that spend this decade litigating whether AI may exist will meet competitors that spent it deciding what to do with the capacity.
Where we stand
We build what the market calls AI as one Brain per firm: the firm's own memory, under the firm's own rules, with scoped access, a full log, shadow running before live, and a person in approval wherever the firm wants one. Nothing pooled between firms, and the exit written into the engagement. How that looks for legal work in particular is on the page for COUNSEL, the Legal Brain.
The questions partners actually ask
Does using AI break legal professional privilege?
Privilege is broken by uncontrolled disclosure, not by software as such. A consumer assistant that retains prompts on its own terms is uncontrolled disclosure; a system dedicated to the firm, under the firm's engagement, with custody, scoping and logging, sits on the firm's side of the line like its document management system does.
Can client data be used to train models?
Only if the firm allows it, and the firm should not. The dedication question, whether the supplier learns across clients from your matter data, is the single fastest filter in the market.
Do associates using ChatGPT create risk today?
Yes, and policy alone rarely stops it, because the pressure to be fast is real. The durable answer is giving fee earners a sanctioned system that is genuinely better for the work, inside the firm's custody, so the unsanctioned route loses its appeal.
Who is responsible when an AI-assisted document is wrong?
The lawyer who signed it, exactly as before. That is why systems must present work for review with reasoning attached, rather than acting on their own authority.