If you want privilege to survive AI use, control matters more than convenience
Whether AI-assisted material is privileged or protected work product depends on the jurisdiction and the purpose and handling of the communication. Counsel should assess the vendor relationship, confidentiality and matter-specific process before relying on protection.
Counsel should review the purpose of the AI use, information shared, process controls and vendor role, including whether the platform operates under counsel's direction.
Record counsel's instructions, the workflow and its controls for that review.
The safest view is that privilege needs a defined legal purpose and real supervision
When assessing the platform's role, counsel can review its legal task, documented instructions, access restrictions, confidentiality arrangements and lawyer oversight alongside the contract.
Record the following aspects of the use for counsel to assess:
- the platform was used for a specific legal purpose connected to advice or litigation preparation
- counsel directed how the tool was used and what information was provided
- access to matter data was limited and governed
- the vendor's terms and technical controls supported confidentiality
- the use of the tool was documented as part of the legal workflow
- outputs were reviewed and incorporated under lawyer supervision
Flag missing or uncertain records for counsel's assessment.
Assess legal workflow risk before deploying AI tools
Why direction and documentation carry so much weight
Keep records of the platform's role, third-party access and confidentiality arrangements so counsel can assess the workflow in a later dispute.
Document:
- what the platform was allowed to do
- which matters or document classes it could touch
- what categories of information were prohibited or redacted
- who approved use of the tool on a matter
- what human review steps applied before relying on outputs
- what retention, deletion, and access rules governed the data
Keep the records available to explain the system's role and controls.
What kind of control position is usually needed
Control has both technical and procedural sides. Technical settings matter, but so do workflow rules.
Review these technical and procedural controls:
- enterprise terms that address confidentiality and vendor access
- clear limits on model training, retention, and subprocessor use
- matter-specific access controls and authentication
- prompt guidance or templates for legal use cases
- approval requirements for higher-risk tasks
- audit logging and retained evidence of supervision
Record how the controls apply to the legal workflow and any gaps that remain.
Build governance for sensitive legal AI use cases
The red flags that undermine the argument
Review the following gaps with counsel when assessing privilege or work product.
Check for:
- lawyers and non-lawyers using the same tool without clear legal workflow separation
- matter information being entered into a platform with unclear retention or training terms
- no written rationale for why the tool was necessary to support legal advice
- no evidence of counsel direction over inputs, purpose, or outputs
- vendor documentation that conflicts with internal assumptions about confidentiality
- teams treating AI outputs as informal convenience material rather than supervised legal work product
Resolve uncertainties about these gaps with counsel before relying on protection.
How firms should think about work product separately
Ask counsel to assess work product separately from privilege for the jurisdiction and matter. Include the purpose of the AI use, any connection to anticipated litigation or legal analysis, and the workflow controls in that review.
Record the legal-preparation purpose, supervisor and confidentiality arrangements for counsel's assessment.
A practical operating standard for legal teams
Assess the specific tool, contract and workflow with counsel before relying on privilege or work product protection.
Include vendor review, matter rules, user restrictions, prompt guidance, human review and records of counsel's direction.
Turn legal AI policy into workable deployment controls
Conclusion
Provide counsel with records of the AI use's purpose, supervision, confidentiality controls and workflow when assessing the platform's role and any claimed protection.
Do not rely on the control checklist alone as confirmation of privilege or work product protection.
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.
