What Attorney–Client Privilege Actually Is
Attorney–client privilege protects confidential communications between a client and their lawyer made for the purpose of obtaining or providing legal advice. It's one of the oldest protections in the law, and it exists so clients can be candid without fear that their words will come back against them.
Three elements must all be present, and the party asserting privilege bears the burden of proving them:
- It was a communication between the client and their attorney (or the attorney's agents).
- It was intended to be confidential — and in fact was kept confidential. The moment a third party who isn't necessary to the legal advice sees it, this element is in trouble.
- It was made for legal advice — the purpose of the exchange was to get or give legal counsel, not something else.
A close cousin is the work product doctrine, which protects materials prepared by or at the direction of counsel in anticipation of litigation. Its purpose is to keep the other side from seeing how your lawyer thinks about the case.
How AI Tools Put Privilege at Risk
AI doesn't change the rules of privilege — it changes how easily the elements are broken. Four failure modes matter:
📤 Third-party disclosure
The moment privileged information reaches an AI provider's servers, a third party holds it. Courts have long treated disclosure to outsiders as defeating confidentiality — AI is just a new outsider.
📚 Training data
Platforms that train models on user inputs can reproduce or use your data in ways you can't control or retract. That's the opposite of "kept confidential."
📜 Provider terms
Privacy policies that reserve the right to disclose data to third parties — including regulators — put users on notice that there's no reasonable expectation of confidentiality. Courts cited exactly this in US v. Heppner.
🤖 No fiduciary duty
A chatbot is not an attorney. It owes no duty of loyalty or confidentiality, which is why courts are skeptical that conversations with it can be "communications with counsel."
The leading example is United States v. Heppner (S.D.N.Y., February 2026), where Judge Rakoff held that a defendant's documents generated with a consumer AI chatbot were not privileged — the chatbot wasn't an attorney, the platform's terms allowed data collection and disclosure, and the use wasn't directed by counsel. It's fact-specific, but it's the clearest demonstration yet of how the traditional elements fail in AI configurations.
Work Product and AI: Direction Matters
The work product doctrine protects materials prepared by or at the direction of counsel in anticipation of litigation. That's the phrase to remember: "at the direction of counsel." In Heppner, the work product claim failed because the defendant used the AI on his own initiative — the documents didn't reflect counsel's strategy, so there was nothing of the lawyer's mental process to protect.
The useful flip side: courts have signaled that AI used at counsel's direction, as part of a defined workflow, can be treated like a lawyer's agent — with the protection following the traditional analysis. The lesson isn't "don't use AI." It's "use it deliberately, inside the representation, under your control."
The 10-Question Confidentiality Checklist
Before any AI tool touches client information, run this checklist:
| # | Question | Why it matters |
|---|---|---|
| 1 | Where does the data go when I use this tool? | If it leaves your control, confidentiality is at risk |
| 2 | Are my inputs and outputs used for training? | Training use means your data lives on after you |
| 3 | Can the provider disclose data to third parties? | Disclosure clauses defeat "reasonable expectation of confidentiality" |
| 4 | How long is data retained? | Retention extends exposure beyond the matter |
| 5 | Who exactly is the provider, and under whose law? | Jurisdiction affects subpoena and disclosure exposure |
| 6 | Can this tool run locally, on hardware I control? | Local deployment removes the third party entirely |
| 7 | Is use directed by counsel, or self-directed? | Counsel direction supports both privilege and work product |
| 8 | Does the client need to consent? | Rule 1.6 and some state bars require informed consent |
| 9 | Can I verify the output against sources? | Unverifiable output is an ethics and quality risk |
| 10 | Is this tool in my firm's approved list? | If there's no policy, there's no defense |
When Local AI Changes the Answer
The confidentiality element of privilege asks one question: did the information stay confidential? Local AI answers it by architecture. When the model runs on your own hardware — documents indexed on your disk, inference on your CPU or GPU, nothing sent anywhere — there is no third party receiving the data, no training pipeline, and no disclosure clause to trip over. The confidentiality analysis starts from a completely different place than it does with a cloud chatbot.
That doesn't make local AI magic. You still have to use it at counsel's direction, verify the output, and follow the ethics rules. But the single biggest privilege risk — the third party — simply isn't there.
💡 Built example. Lawyer Assistant is a free, open-source legal AI that runs entirely on-device — hybrid search, answers with citations, and compliance scans — with no account, cloud, or telemetry. Read how the pipeline works in Lawyer Assistant: A Privacy-First Legal AI Built on a Local RAG Pipeline, and see the ruling that made all of this urgent in AI Just Waived Attorney–Client Privilege in Court. For the broader case on keeping data off the cloud, see Data Privacy vs. Cloud AI.
Frequently Asked Questions (FAQ)
What is attorney-client privilege?
Attorney-client privilege protects confidential communications between a client and their lawyer made for the purpose of obtaining or providing legal advice. The party asserting privilege must show the communication was confidential, between client and attorney, and made for legal advice.
Can AI tools waive attorney-client privilege?
Yes, in the right circumstances. Courts look at whether the information stayed confidential. If you share privileged information with a third-party AI platform that collects inputs for training or may disclose them, a court can find there was no reasonable expectation of confidentiality — as in US v. Heppner (S.D.N.Y. 2026).
What is the work product doctrine?
Work product protection covers materials prepared by or at the direction of counsel in anticipation of litigation. Materials a client generates on their own, outside counsel's direction, generally do not qualify — a key holding in US v. Heppner.
Does local AI protect attorney-client privilege?
It addresses the confidentiality element directly: when the model runs on your own hardware and nothing is sent to a third party, there is no third-party disclosure to defeat confidentiality. Lawyers must still verify output and comply with the ethics rules.
What should I check before using an AI tool on client matters?
Where data goes and how it's stored; whether inputs and outputs are used for training; whether the provider can disclose data to third parties; how long data is retained; who the provider is; and whether local/on-premise deployment is possible.
⚖️ Need this built for your firm?
I design and deploy privacy-first local AI systems — private RAG, cited answers, on-premise LLMs for legal and regulated work. Contact me for a scoping conversation, no obligation. Or start with the free, open-source Lawyer Assistant — private legal AI on your own machine.