The growing adoption of artificial intelligence by businesses and their advisers is giving rise to a new and increasingly important set of questions about legal professional privilege (i.e., the right to withhold certain protected materials, such as legal advice and documents prepared for litigation, from disclosure).
The risks are highly contextual. Privilege is generally likely to be preserved where lawyers use enterprise AI tools to assist with legal work, but unlikely to apply where non-lawyers use consumer-facing AI tools to seek legal guidance. Indeed, an existing privilege may be lost if advice is uploaded into such systems.
AI may also complicate more fundamental questions about how to apply the existing tests for privilege, including when a communication is made for the purpose of obtaining legal advice, who or what is participating in that process, and whether confidentiality has been maintained. AI tools raise novel challenges given that they are not legal advisers and cannot confer privilege, yet are often used to analyse or generate both legal and non-legal content. They also generate detailed, timestamped records of exchanges that would otherwise rarely exist in writing, creating material new risks for businesses to consider.
Understanding the impact of AI on privilege therefore requires attention not simply to the technology itself, but to how it is being used, by whom, and what happens to the information that is provided to it. This article sets out the key risks and practical steps to manage them.
Legal privilege – key principles
Legal professional privilege is the right to withhold certain materials from disclosure to a court, regulator or other third party. It takes various forms but in particular includes:
Legal advice privilege (governed by section 54 of the Evidence Act 2006) which protects communications that are intended to be confidential between a person and a legal adviser, made for the purpose of requesting, obtaining or giving professional legal services. It exists to encourage candour between clients and their lawyers – protecting the ability to seek and receive frank legal advice without fear that those communications will later be used against the client.
Litigation privilege (section 56 of the Evidence Act) protects communications or information made, received, compiled or prepared for the dominant purpose of preparing for a proceeding or an apprehended proceeding. “Dominant purpose” in that context means the predominant or main purpose, not merely one of two equal purposes.
Privilege is a powerful protection but is also fragile. It will be treated as waived where a significant part of a document is disclosed in circumstances “inconsistent with a claim of confidentiality”. Where that occurs, the consequences in litigation or regulatory investigations can be severe, as the opponent or regulator gains access to previously protected legal strategy or advice.
AI alone cannot create privilege
For legal advice privilege to attach, a lawyer must be genuinely and substantively engaged in the communication for the purposes of that lawyer giving legal services. An AI tool, however sophisticated, is not a “legal adviser” within the meaning of the Evidence Act, which is limited to lawyers with a current practising certificate, registered patent attorneys, and equivalent overseas practitioners. This means that a conversation with an AI chatbot about your legal position, no matter how detailed or legally oriented, will not attract privilege simply because it concerns a legal topic.
The point was starkly illustrated in a recent US case (USA v Heppner) where the defendant discussed his investigation, potential legal exposure, and defence strategies using the Claude AI tool. The court rejected the defendant’s claim to privilege over the resulting exchanges, principally on the basis that Claude is not a lawyer and the defendant’s counsel had not directed or supervised the use. The decision is a helpful caution for non-lawyers who may wish to use AI to seek “legal advice” without the involvement of a lawyer. The pitfalls of such an approach are obvious if a user enters information in the false expectation that it may not be used against them.
How AI use can waive privilege
Even where privilege properly applies, it can be waived if a significant part of the privileged information is disclosed in circumstances inconsistent with a claim of confidentiality. The distinction between consumer-grade and enterprise-grade AI tools is relevant to this issue. Consumer and public AI tools typically include terms of use that permit the provider to use inputs for model training, and any confidentiality protections are often qualified. Entering privileged material into such a tool arguably constitutes voluntary disclosure to a third party (the AI provider) in circumstances that are fundamentally inconsistent with maintaining confidence. Enterprise-grade AI tools, by contrast, typically restrict the provider’s use of data to service provision only, exclude customer content from training by default, and impose strong confidentiality obligations.
On the basis of this distinction, guidance from the NZ Courts and the New Zealand Law Society specifically warns against entering privileged or confidential information into publicly accessible tools. Similarly, courts overseas have begun to engage with this reasoning directly. In USA v Heppner, discussed above, the court held not only that the defendant’s chatbot exchanges were not privileged, but that any privilege would have been waived in any event by the act of entering the information into the AI tool. The court noted that “the written privacy policy to which users of Claude consent provides that Anthropic collects data on both users’ inputs and Claude’s outputs, that it uses such data to train Claude, and that Anthropic reserves the right to disclose such data to a host of third parties, including governmental regulatory authorities.” In light of those terms, the court concluded that whether or not privilege existed it was waived when shared with the AI tool, “just as if he had shared it with any other third party.”
AI transcription of meetings and calls
AI-generated transcripts of meetings and calls offer real practical benefits. They can provide a record of discussions and free participants to focus on the substance of a conversation rather than note-taking. However, these benefits need to be balanced against privilege risks that are easily overlooked. A transcript of a non-privileged discussion is not privileged and nor can a recording of a non-privileged conversation later become privileged simply because it is sent to a lawyer. Even if a lawyer is present on a call, the transcript will only attract legal advice privilege if the discussion is itself privileged. A conversation, or part of it, is only privileged to the extent that the lawyer is in fact acting in a legal capacity for the purposes of receiving instructions or giving advice (rather than attending in a merely commercial or administrative capacity). That is a relevant consideration for many in-house counsel who can play multiple roles within the business.
In addition, even where the underlying discussion is privileged, AI-generated transcripts should be shared carefully to avoid waiver. If a transcript is too widely shared, privilege can be waived through loss of confidentiality. To manage these risks while still capturing the benefits of transcription, participants should accurately state at the outset of any call (or at the appropriate juncture during a call) that legal advice is being given or received and that the discussion is intended to be privileged. Where transcription is used, restrict access appropriately to internal recipients who genuinely need to see the privileged content. In addition, for particularly sensitive legal discussions, consider turning off AI transcription altogether and having the lawyer prepare manual attendance notes instead.
The risks arising from AI transcription highlight a broader challenge for in-house teams in particular: keeping legal and non-legal content clearly delineated. This is especially difficult in AI tools, where blending legal and commercial or factual queries in a single session makes it significantly harder to establish that the purpose of a communication was the provision or receipt of legal advice. Where a communication has a dual character – part legal analysis, part commercial strategy – the discussion may be privileged in part only.
When lawyers use AI: privilege and “working papers”
A different analysis applies where lawyers themselves use AI tools as part of their legal work. Where a lawyer uses an AI tool to research legal issues, test arguments, or draft advice in connection with a matter, the resulting exchanges are likely to be seen as forming part of the lawyer’s “working papers” which have traditionally been held to attract protection even though not strictly part of the “communication” with the client. Again, it will be critical to be able to demonstrate that the lawyer was genuinely engaged in legal work, not simply assigning an administrative task that a non-lawyer could equally perform without legal input.
The same confidentiality requirements will continue to apply. If a lawyer uses a consumer-grade AI tool with terms permitting the provider to access, train on, or disclose user inputs, there remains a risk that the analysis could lose protection because of the circumstances in which it was created. For this reason, lawyers should use only enterprise-grade AI tools with robust confidentiality protections for any work that touches on privileged or confidential matters.
AI interactions are discoverable
All AI prompts, outputs and chat histories are “documents” for discovery purposes (defined broadly under the High Court Rules) and could potentially be sought by opposing parties or regulators in litigation or investigations. This includes not just final outputs but the entire prompt history and iterative exchanges - every question, tentative analysis, and abandoned line of reasoning is potentially discoverable.
This was illustrated in a recent US case (Fortis Advisors LLC v Krafton Inc), where a CEO’s ChatGPT conversations were admitted as evidence of his intent. He had asked ChatGPT about earnout obligations, and the AI advised they would be “difficult to cancel.” The CEO then established a project to renegotiate earnouts and asked ChatGPT to prepare a response strategy. Those conversations were used to demonstrate that employees were invalidly terminated to avoid earnout payments. The case illustrates that AI chat logs can be more damaging than emails because they often capture unfiltered, real-time thinking in a way that traditional correspondence does not. In that context, non-lawyers should avoid running premature or incomplete analysis of potential compliance issues through AI tools and should instead direct questions to the in-house legal team where they can be managed within a privilege framework.
Practical steps to protect privilege
The productivity gains of AI are real and significant. However, for businesses and their lawyers, the key message is that privilege rules developed over centuries do not bend to accommodate new technology. An AI tool is not a lawyer and a chatbot conversation is not a privileged communication. At the same time, the risks are manageable with relatively straightforward discipline. The following practical steps will help your business capture the benefits of AI while keeping your privileged and confidential information protected.
Key takeaways – preserving privilege when using AI
|
Disclaimer: This publication is necessarily brief and general in nature. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.
