Generative AI and Attorney-Client Privilege

Three protections are often blurred together. Attorney-client privilege is an evidentiary rule shielding confidential communications between lawyer and client made to obtain or give legal advice. Work product protects materials prepared in anticipation of litigation. The ethical duty of confidentiality under Rule 1.6 is broader, covering all information relating to the representation, and requires reasonable efforts to prevent unauthorized disclosure. Privilege is generally waived by voluntary disclosure to a third party outside the privileged relationship. Courts have long accepted, however, that lawyers can use service providers such as email hosts, cloud storage and eDiscovery vendors without waiver when confidentiality is reasonably maintained. AI tools are likely to be analyzed similarly, which makes the vendor's terms central. Case law applying waiver doctrine specifically to AI prompts is still thin, so lawyers should not assume a favorable outcome. Risk rises when terms let the provider use inputs to train models, keep them indefinitely, or allow human reviewers to read them, because each undercuts a claim that the communication stayed confidential. Consumer versions of popular chatbots have generally allowed training on conversations by default unless users opt out, while business and API offerings typically do not. Litigation can also affect retention: in 2025, the court in The New York Times's copyright suit against OpenAI ordered the company, for a period, to preserve user chat logs, including ones users had deleted. Work product is harder to waive; disclosure generally waives it only if it substantially increases the chance that an adversary obtains the material. Clients raise a separate issue. When they discuss their legal problems with a chatbot before or instead of talking to counsel, those conversations are not communications with a lawyer and may be discoverable. A common misconception is that turning off chat history makes a consumer tool safe. It may limit training use, but providers often still retain data for a period for abuse monitoring.