AI tools, confidentiality and legal privilege: consumer AI vs enterprise AI services

AI is now a routine feature of the modern business environment. From drafting documents and analysing data to streamlining workflows, AI tools offer significant opportunities for businesses to improve efficiency and productivity. However, alongside these benefits come a number of legal and regulatory risks that must be carefully managed.

One of the most widely discussed legal concerns surrounding the use of AI is the phenomenon of “hallucinations”, whereby AI systems generate inaccurate or entirely fabricated information. Courts have already begun to consider the implications of such errors, and the body of case law in this area continues to grow. However, a potentially significant risk that has received far less judicial attention is the impact that AI may have on legal professional privilege. This article builds on our previous piece, AI tools, confidentiality and legal privilege: what clients need to know, by examining how the use of different AI tools can affect the confidentiality required to maintain privilege.

Legal professional privilege is a legal right that protects certain confidential communications between a client and their lawyer from being disclosed to other parties, including an opponent in litigation, a regulator, or a court. Confidentiality is fundamental to that protection: if it is lost, privilege may also be lost or waived.

As such, an important question arises: how can confidentiality be maintained when using AI?

What are the courts saying? The Tribunal’s observations in UK v Secretary of State for the Home Department

As this is a continuously developing area, there has been limited judicial comment so far in the UK as to how the use of AI affects legal privilege. 

That said, the judgment in UK v Secretary of State for the Home Department provides a useful insight as to how courts may interpret this issue in the future. In that case, the Upper Tribunal (Immigration and Asylum Chamber) considered (amongst other issues) the use by legal representatives of AI tools and the risks of hallucinated legal authorities. The facts of the case are not particularly important here, and mirror many of the recent cases surrounding AI hallucinations in the legal sector. However, while not central to the Court’s decision, the judgment included important comments on the impact of AI on legal professional privilege.

The following is an extract from the judgment:

“We also observe that to put client letters and decision letters from the Home Office into an open source AI tool, such as ChatGPT, is to place this information on the internet in the public domain, and thus to breach client confidentiality and waive legal privilege, and thus any regulated legal professional or firm that does so would, in addition to needing to bring this to the attention of their regulator, be advised to consult with the Information Commissioner’s Office. Closed source AI tools which do not place information in the public domain, such as Microsoft Copilot, are available for tasks such as summarising without these risks.”

The Tribunal’s Analysis: Focusing on the wrong distinction?

While the Tribunal rightly highlights the importance of understanding how AI systems handle confidential information, the distinction it draws between open-source and closed-source models risks obscuring the real issue. In particular, the Tribunal appears to equate “open-source” AI tools with placing information “on the internet in the public domain” and to suggest that “closed-source” tools such as Microsoft Copilot can be used “without these risks”. However, the concepts of open-source and closed-source relate to the availability of a model’s underlying code and architecture, not to how user data is processed, stored, retained or used.

An “open-source” model is one where the underlying model architecture or source code is made publicly available. The term does not describe how user data is processed or stored. By contrast, many widely used systems, including both ChatGPT and Microsoft Copilot, are proprietary, closed-source models, but all this means is that the underlying model architecture and source code are not publicly available. It says nothing about how the service handles confidential information, which is the issue that matters when assessing risks to confidentiality and privilege.

Whether those services can be used safely for confidential or legally privileged information depends not on whether the model is open-source or closed-source, but on how the service handles user data, the contractual protections in place, and whether information is used for training, retained, or made accessible beyond the user’s organisation.

For lawyers and clients using AI tools, the critical question is whether the provider’s contractual, technical and organisational safeguards are sufficient to preserve confidentiality.

The important distinction: consumer vs enterprise AI services

The real question, therefore, is how a specific system handles, stores and uses the confidential information it receives. This will depend on a range of factors, including the contractual terms governing the service, the provider’s technical architecture, data segregation controls, retention policies, and wider regulatory and compliance framework. 

Types of AI services can broadly be separated into two categories: consumer-level and enterprise-level offerings.

Consumer-level AI services are the tools that the general public can access. They are widely available and typically offered via free or low-cost subscriptions that enable day-to-day use (e.g. ChatGPT, Claude, Gemini, Copilot). In most cases, user inputs may be retained and, depending on settings and the specific product tier, may be used to ‘train’ models. For that reason, they should not be used to process privileged or confidential legal material.

Enterprise-level (or business-tier) services, on the other hand, are specifically designed for organisational use and typically include contractual commitments that the provider will not use customer data to train underlying models, together with enhanced data protection, access controls, and audit capabilities. These include Copilot for Microsoft 365, ChatGPT Enterprise, Claude for Work, and Gemini Enterprise. 

Just because a tool is the “paid version”, does not mean it is safe. For example, subscriptions such as ChatGPT Plus or Claude Pro may offer enhanced functionality at a cost, but do not generally provide the same contractual and data-handling protections as enterprise-grade offerings and, as such, are still considered consumer-level services.

Understanding the distinction between consumer-level and enterprise-level services, therefore, is crucial in determining whether confidentiality, and as a result privilege, will be maintained.

A useful comparison is email. Every day, lawyers send confidential and privileged material through email systems provided by third parties such as Microsoft and Google. The fact that those providers transmit and store the information does not, of itself, destroy confidentiality or waive privilege.

Enterprise-level AI services are intended to operate in a similar way. The provider processes information on behalf of the customer, subject to contractual safeguards, confidentiality obligations, restrictions on the provider’s use of customer data, and Data Processing Agreements.

The intention is that the provider acts as a service provider, not as an independent recipient of the information.

This is why the confidentiality analysis is more nuanced than the Tribunal’s comments might suggest. Even though Copilot is a “closed-source” model, this does not mean it can safely be used for confidential or privileged information.

Rather, only the enterprise-level service “Copilot for Microsoft 365”, operating within an appropriate contractual and technical framework, is capable of preserving confidentiality and privilege.

Other considerations

Although there is currently limited judicial guidance from UK courts on this issue, recent case law from the United States points in a similar direction.

In United States v Heppner, the Court held that documents generated by a criminal defendant using a consumer-level AI chatbot, Claude in this case, were not protected by attorney-client privilege. The Court focused on Claude’s privacy policy, which they held did not give rise to a “reasonable expectation of confidentiality”, as the AI provider retained user data. The Court also made the interesting observation that, while the defendant’s interactions with Claude did not amount to communications with counsel for the purposes of privilege, the position may have been different had the tool been used at the direction of the defendant’s lawyer. In those circumstances, it suggested the tool may have operated “akin to a highly trained professional” acting as an agent of the lawyer within the scope of privilege.

While the US concept of attorney-client privilege does not map directly onto the UK framework, the decision nevertheless provides a useful indication of how courts may approach the question. It reinforces the central importance of confidentiality: where appropriate protections are not in place, privilege is unlikely to be maintained. Clients should therefore exercise caution when inputting confidential information into AI tools and, where there is any uncertainty, refrain from doing so.

A similar note of caution has been sounded judicially in England and Wales. Sir Colin Birss, Chancellor of the High Court, in a speech to the City of London Law Society, observed:

“Now confidentiality has always been a pre-requisite for the attraction of the privilege, so even if one did extend the concept of the privilege to include advice from AI, on the current approach, it would not seem to attach to the interactions with these public AI systems because they do not appear to be confidential.”

Overall, AI tools should not be treated as interchangeable when handling confidential or privileged information. Before inputting sensitive information into any AI system, businesses should understand which version of the tool is being used, review the applicable contractual terms and privacy settings, and ensure that appropriate policies and governance measures are in place.

As with all aspects of AI, this remains a rapidly evolving area, and further judicial and regulatory developments are likely to follow. 

This insight was co-authored by Luca Hoffman.