2026-08-25 · 4 min read

AI for lawyers: enjoy the tools without risking privilege

Why AI in a law firm is no longer an 'if'

According to Clio's 2024 Legal Trends Report, the share of legal professionals using AI jumped from 19% to 79% in a single year. Drafting letters, summarizing case law, first-pass contracts, deposition prep — the tools save real hours. The risk isn't the use itself; it's what goes into the prompt.

What happened in Mata v. Avianca — a double lesson

In 2023, New York lawyers filed a brief relying on case law invented by ChatGPT — six precedents that don't exist. The court sanctioned them and the case became a worldwide cautionary tale. Lesson one: verify every output. Lesson two, discussed far less: into those same tools, lawyers also paste sensitive client facts — and that damage is silent and irreversible.

What must never leave the firm into a public AI tool

  1. Client and party identities — names, ID numbers, contact details of clients, witnesses and opposing parties.
  2. Identifying case facts — dates, amounts and combinations that give the matter away even without a name.
  3. Privileged documents — internal memos, opinions, client correspondence.
  4. Clients' business information — trade secrets received during the representation.
  5. Settlements and negotiations — settlement terms, negotiating positions, litigation strategy.

The safe-use protocol for a firm

  1. Pick business-tier tools (no training on your data) and keep an approved list.
  2. One simple firm-wide rule: client material enters a tool only after anonymization.
  3. Replace identities with consistent tokens — 'the plaintiff', PERSON_001, COMPANY_001 — so the document stays fully analyzable.
  4. Clean metadata: the Author field and tracked changes in Word files expose names even when the text is clean.
  5. Verify every legal output against real sources — the Avianca lesson.
  6. Update firm policy and train: most incidents are an innocent paste by a rushed associate.

The result: the firm gets AI's speed — drafting, summarizing, organizing — while the client's identifying material never leaves the machine. The complete list of what should never be pasted is here.

Frequently asked questions

May a lawyer use ChatGPT at all?

Yes — the prohibition isn't on the tool but on exposing client information. Using it on general text, or on a document that has been anonymized, doesn't breach the duty of confidentiality.

Does pasting a client document into AI waive privilege?

It is first and foremost a potential confidentiality breach, and voluntary sharing with a third party is the classic foundation of a waiver argument. The safe path: strip identifying details first.

What's the biggest AI risk in a law firm?

Two: relying on unverified outputs (invented case law, as in Mata v. Avianca), and client-data leakage through innocent pastes. Verification solves the first; anonymization solves the second.

Does a legal-specific AI tool solve confidentiality?

It improves the contractual terms, but the data still leaves the firm to an external vendor. Anonymizing before the paste protects independently of any vendor — and stays under your control.