Lawyers can use AI without breaching client confidentiality — but not with the tools most are reaching for, and not in the way most are using them. The problem isn’t that AI is untrustworthy. It’s that the usual way of using it quietly sends privileged material somewhere you no longer control. The fix is architectural, not a matter of being careful.
A lawyer has a document-heavy matter, a tight deadline, and an AI assistant that could summarize the discovery set in an afternoon instead of a week. The temptation is obvious. So is the hesitation: the moment privileged material goes into a general-purpose AI tool, where does it go, who can read it, and has privilege just been waived?
That hesitation is correct. But the answer isn’t “don’t use AI.” It’s “understand exactly what happens to the confidential material, and use a tool whose architecture — not whose promises — keeps it where it belongs.”
Let’s take the real question apart.
What happens when you paste privileged content into ChatGPT?
Three things, and each one matters for confidentiality.
The content leaves your control and reaches the provider’s servers, where it is processed and, depending on the product and settings, may be retained or used to improve the service. The provider’s terms — not your professional obligations — govern what happens next. And the transmission itself may, under emerging case law, be treated as a disclosure to a third party, which is the precise event that can waive attorney-client privilege.
That last point is where these questions are beginning to reach the courts. As they do, what looks likely to matter is the workflow conditions: was the use directed by counsel, was confidentiality maintained, were contractual safeguards in place, and was disclosure to an adversary likely. The question, as it takes shape, is likely to be less “was AI used” than “under what conditions was it used.”
Which means the confidentiality question is really a question about control: can you demonstrate that the privileged material stayed within a controlled boundary, or did it pass into a system where you can no longer say where it went?
Why isn’t “we won’t look at your data” enough?
Because it’s a promise, and a promise is only as good as the entity making it.
The standard reassurance from AI vendors is exactly that: we won’t train on your data, we won’t retain it, we won’t look. For a lawyer, that’s a weak foundation, for a reason lawyers understand better than most — entities change. Terms get updated. Companies get acquired. A policy that says “we won’t” today can say “we now do” after a change of ownership, in an email you skim and forget.
Privilege is not something you want resting on a counterparty’s current intentions. The stronger position is architectural: use a tool where the confidential material simply cannot leave your control, so that keeping it confidential is a property of how the system is built rather than a commitment someone made and could revise.
The distinction runs through every AI tool you will evaluate, and it’s worth naming plainly. There are two kinds of control. One kind asks: a policy that says the AI won’t do something, an instruction telling it to handle privileged content carefully, a setting you trust to hold. It works most of the time, and it fails the way asking fails — when the thing being asked doesn’t comply, whether through a policy change, a clever input, or a quiet product update. The other kind prevents: the AI has no path to the material in the first place, so there is nothing to comply with and nothing to fail. A sign that says “keep out” is the first kind. A locked door is the second.
For privileged material, you want the locked door. A promise not to look depends on the promiser’s continued cooperation. An architecture with no path to the data holds whether or not anyone cooperates — and it holds against the clever-input attacks that reliably talk instruction-based controls out of doing their job. That is the same argument, in a different setting, as privacy enforced in code, not policy.
What does a confidentiality-safe AI workflow look like?
Three properties separate a workflow you could defend to a court from one you couldn’t.
The confidential material is accessed under your authorization, not the tool’s discretion. You — the authorized attorney — decide what the AI may see, and that decision is enforced by the system, not left to the AI’s judgment or a setting you hope holds. Privilege-candidate material the AI shouldn’t touch is not merely flagged as off-limits; it is unreachable. Deciding this per item, rather than for the tool as a whole, is what three access tiers are for.
What the AI produces from confidential material is contained. When the AI drafts a summary from privileged documents, that work product doesn’t silently flow out to email, to a different matter, to a general model memory, or to any channel you didn’t authorize. The routes out are closed unless you open them. This is the property most consumer AI tools lack entirely: they’ll happily take privileged content in and let its substance flow back out through whatever channel the next instruction names.
You can show what the AI did. Not a promise that it behaved — a record. What it accessed, what it used, what it produced, what it did not touch. When a court asks about the workflow conditions, “here is the record of exactly what happened” is a far stronger answer than “we trusted the tool.”
None of these is exotic. They’re the same principles that govern how a firm handles privileged material among humans: access on authorization, contained work product, a record of who touched what. The gap is that most general-purpose AI tools implement none of them — they were built for convenience, not for confidentiality-bound work.
So can lawyers use AI without breaching confidentiality?
Yes — with a tool whose architecture enforces the three properties above, rather than one that asks you to trust a promise and be careful.
Being careful helps but doesn’t solve the underlying problem. You can redact before pasting, switch on a “private mode,” and trust the no-training toggle — and the material still leaves your control, with confidentiality still resting on the provider’s current policy. The architectural approach changes what’s possible rather than what’s promised: the confidential material stays within a boundary you control, and you can demonstrate that it did.
For high-stakes privileged work, the second is the standard worth holding out for.
This is the principle behind Pickerbird: a personal AI where you decide — item by item — what the assistant can access, where that boundary is enforced by the app rather than the AI’s judgment, and where you can see what it actually did. It’s early-stage and consumer-grade rather than a courtroom e-discovery platform, but it’s built on exactly the control-first architecture this question calls for, applied to personal and professional information people can’t afford to hand to a system they don’t control.
Join the waitlist to be among the first to try Pickerbird.
FAQ
Can lawyers ethically use AI for client work?
Yes, provided client confidentiality and privilege are preserved. Professional responsibility rules require competence with the technology and protection of client information. The determining factor is whether the workflow keeps privileged material within a controlled boundary — not whether AI was used at all.
Does using AI on client documents waive privilege?
It can, if the use amounts to disclosure to a third party under conditions a court finds inconsistent with maintaining confidentiality. As these questions begin to reach the courts, the workflow conditions look likely to matter: whether use was directed by counsel, whether confidentiality was maintained, and whether disclosure to an adversary was likely. A workflow that keeps material within counsel's control and produces a record of what occurred is far more defensible.
Is it safe to put privileged information into ChatGPT?
General-purpose consumer AI tools send content to the provider's servers, where handling is governed by the provider's terms rather than your professional obligations, and the transmission may be treated as third-party disclosure. For privileged material, a tool whose architecture keeps the content within your control is a stronger position than relying on a provider's policy.
What makes an AI tool confidentiality-safe for legal work?
Three properties: access to confidential material is enforced by the system under the attorney's authorization rather than left to the AI's judgment; work product derived from confidential material is contained and can't flow out through unauthorized channels; and there is a verifiable record of what the AI accessed and produced. Together these let you demonstrate the workflow conditions courts evaluate.
What's the difference between an AI tool that promises privacy and one that enforces it?
A promise ("we won't train on or retain your data") depends on the provider's current policy, which can change with ownership or terms. Enforcement is different in kind: the tool has no path to the data, so confidentiality holds whether or not anyone cooperates, and holds against the crafted inputs that can talk instruction-based safeguards out of doing their job. A sign that says "keep out" is a promise; a locked door is enforcement. For privileged material, the locked door is the stronger foundation.