AI – The Quiet Erosion of Privilege?

What is Privilege?

While this article is not a discussion on the scope and application of legal privilege itself, it is helpful to give a high-level overview before considering how AI may impact such a cornerstone of the legal system.

Legal professional privilege (LPP), as it applies within the Cayman Islands legal system, draws heavily from the jurisprudence of England & Wales.  LPP falls into two broad categories:

(i) Legal Advice privilege; and

(ii) Litigation privilege.

The United States legal system has relatable doctrines of privilege although importance nuances between the concepts in each of the jurisdictions exist. In the US there is both:

(i) Attorney-client privilege, which is structurally similar to legal advice privilege insofar as both apply confidentiality to communications between an attorney and a client which are made for the dominant purpose of giving legal advice²; and

(ii) Attorney work product doctrine, which essentially serves the same objective as litigation privilege.  Both concepts apply to protect confidential materials that are prepared in anticipation of litigation so that lawyers are able to prepare their case without the concern that working papers and strategic notes of advice will be made available to the other side.

A relevant distinction between the work product doctrine and litigation privilege is the scope of materials which may be caught by either principle. Litigation privilege is capable of applying to documents that are prepared by third parties and communicated with the client and the attorney, providing that the documents were prepared for the dominant purpose of litigation that was reasonably in prospect. In contrast, the attorney work product doctrine is generally limited to documents that are actually created by or for the attorney, although the doctrine may be extended to expert and consultant reports.

The Third-Party Disclosure Trap

The heart of privilege is the character of confidentiality. It follows that when confidential information pertaining to a case is shared with a third-party, privilege which may have accrued to that information will generally be waived.

The persistence of privilege in respect of data generated using a public AI model has not yet been considered by the English or Cayman Courts, but was the focus of two decisions in the US Courts earlier this year.

Within a week of one another the Eastern District of Michigan and the Southern District of New York (SDNY) were called upon to consider if privilege could be asserted over documents that were prepared by A.I. chatbots in connection with legal proceedings. The cases had different outcomes.

In Warner v Gilbarco, Inc, the Michigan court denied a motion to compel production of documents that a litigant had prepared using a public AI model.  The court did so on the basis that the attorney work product doctrine applied to those materials. In contrast, in United States v Heppner, the SDNY reached the opposite view, and ordered the disclosure of documents which the defendant, who was legally represented, had generated using an AI chatbot.

In Warner, the Court found that the self-represented plaintiff acted as their own legal counsel and was entitled to attorney work product over the documents that had been prepared for trial using an AI model. The defendant argued that attorney work product could not be claimed for the reason that the plaintiff had waived its right to this form of privilege by sharing information with a third party, namely an AI platform. The Court here drew a nuanced distinction between attorney-client privilege and the attorney work product doctrine. The first form of privilege being waived by disclosure to a third party, and the latter only being waived where disclosure was to an adversary, or in a manner which made it likely for an adversary to receive those materials.

In contrast, the defendant in Heppner was unable to rely on attorney-client privilege. Observing that this form of privilege would generally apply to communications:

(i) Between a client and their attorney;

(ii) Made in confidence; or

(iii) For the purpose of obtaining or providing legal advice.

The documents that Mr Heppner had produced using Claude in connection with his fraud prosecution were found not to meet at least two, it not all three of the criterion for the following reasons:

(a) The communications were not the product of communication between a client and their attorney. In the Court’s view the essence of privilege was “a trusting human relationship, such as, in the attorney-client context, a relationship with a licensed professional who owes fiduciary duties and is subject to discipline” ;

(b) The documents and communications with the AI platform were not confidential because the privacy policy of Claude permitted the collection of data from user inputs and outputs and reserved the right to disclose that data to third parties, including the United States government;

(c) Controversially, the Court did not consider that the purpose of the communications with Claude were for the purpose of obtaining legal advice because the terms of service expressly disclaimed the provision of legal advice. However, the Court did go on to state that had Mr Heppner’s legal counsel directed that he use Claude, the AI platform “might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege”. This leaves open how far the terms of service of an AI platform can impact the signature of confidentiality; and

(d) The fact that the defendant later shared his Clause communications with his attorney did not bring them within the sphere of privilege.

Significantly, many consumer-grade AI models retain user inputs to train future iterations of their software. This means a client’s proprietary trade secrets or litigation strategy could theoretically resurface in a response generated for a competitor. Because the information is exposed to an outside corporate entity for purposes unrelated to immediate legal translation or expert consultation, courts may increasingly view this as a failure to maintain strict confidentiality, resulting in a total waiver of privilege.

The "Reasonable Care" Standard in the Algorithmic Age

Under modern rules of professional conduct in both in the US and England & Wales, attorneys have a duty of technological competence. They must take “reasonable care” to prevent the unauthorized disclosure of client information. However, defining “reasonable” becomes incredibly difficult when dealing with the proprietary, “black box” nature of advanced AI models.

If a law firm utilises an AI tool without fully understanding its data retention policies, terms of service, or cybersecurity protocols, they are failing the reasonable care standard. If a data breach occurs at the AI vendor level, or if the vendor’s employees review user prompts for quality assurance, the veil of secrecy is pierced. Regulators and courts are beginning to signal that ignorance of an AI tool’s backend mechanics is no longer an acceptable defence for leaked client data.

Closed-Loop Systems and Justification of Privilege

To mitigate these risks, many law firms are pivoting toward proprietary, closed-loop AI systems. These enterprise-grade tools promise that data never leaves the firm’s secure ecosystem and is never used for external training. While this largely solves the third-party disclosure dilemma, it introduces a separate hurdle regarding the attorney work-product doctrine.

The work-product doctrine protects materials prepared by an attorney in anticipation of litigation, shielding their mental impressions and strategy from the opposing side. If an AI independently generates a litigation strategy, organizes document reviews, or flags specific risks within a closed network, does that output constitute the attorney’s mental impressions? If the algorithm operates autonomously, opposing counsel could argue that the AI’s output is merely data processing, not human legal intellect, making it discoverable during a lawsuit.

Conclusion

I defer to the words of the Honourable Justice Rakoff in Heppner:

“Generative artificial intelligence presents a new frontier in the ongoing dialogue between technology and the law. Time will tell whether, as in the case of other technological advances, generative artificial intelligence will fulfil its promise to revolutionalise the way we process information.  But AI’s novelty does not mean that its use is not subject to longstanding legal principles, such as those governing attorney-client privilege and the work-product doctrine”. 

Artificial intelligence is an undeniable asset to modern law, but it cannot come at the cost of ethical duties. Until judicial precedents explicitly define the boundaries of digital confidentiality, the burden remains on the attorney to ensure that the quest for efficiency does not inadvertently silence the shield of privilege.

Citations

¹  Three Rivers District Council v Governor and Company of the Bank of England  [2004] UKHL 4 Lord Roger of Earlsferry.

² A nuance between the two systems is who, in the context of a corporation, is properly regarded as the client for the purpose of asserting privilege over communications.  In the US the Upjohn Test extends the privilege to any employee of a corporate client where as the English and Cayman Court have in Three Rivers applied a narrower test which restricts the privilege to communications with specific employees who are authorise to receive legal advice.

³ The issue has not yet been considered before the Cayman Court. Additionally, to the extent that the use of AI has been considered by the High Court of England & Wales, it has been in the context of the veracity and integrity of information placed by instructing solicitors before the Court. This gives rise to important ethical and regulatory matters which do not concern the question of privilege.