The AI Privilege Trap: Four scenarios where generative AI puts privileged communications at risk - and how to avoid them
Do you know what your staff are putting into AI tools? They may be waiving privilege
Generative AI Tools
The deployment of generative AI tools is in full swing. Across businesses, use cases for generative AI are proliferating, from drafting, to summarising, to researching – all in pursuit of productivity gains. As these AI tools are improved, and employees become more adept at prompting, it is not difficult to imagine a world where AI tools become as ubiquitous as email and the mobile phone.
However – businesses must be alive to the risks which can arise from generative AI tools. Some of these are inherent in autonomous tools generally, such as hallucinations and bias, and were considered in an earlier edition of our Yearbook. This article will focus on a particular legal risk which has gained prominence over the past few months – the interaction between generative AI tools and legal professional privilege. It will explore four common scenarios which may arise for businesses and suggest some mitigation strategies.
Basics of Privilege
Let's start with the basics – what is legal professional privilege? At a high level, it is the fundamental right of a person to withhold certain materials from production to third parties. Where a document is protected by privilege, a party does not need to hand it over to the other side, or to the court, during litigation or other adversarial proceedings.
In England and Wales, the scope of documentary disclosure can be broad and will generally cover documents relevant to the dispute, including those which are adverse to a party's own case. The definition of "document" is also broad and generally includes any record of information within the control of the party, from handwritten notes and emails, to WhatsApp messages and metadata. Consequently, privilege protection is a particularly important and useful tool for litigants.
For businesses handling sensitive or confidential information, privilege is a critical consideration when deciding where that information is stored or processed – though it is worth noting that regulatory, contractual, data protection and intellectual property implications may also arise.
There are two main types of privilege in this jurisdiction, namely legal advice privilege and litigation privilege.
Legal Advice Privilege at a high level protects confidential communications between a client and their lawyer made for the sole or dominant purpose of giving or obtaining of legal advice. The rationale is that parties should be free to be completely candid with their lawyers when seeking legal advice, without fear that those exchanges will subsequently have to be disclosed.
Litigation privilege arises in the context of adversarial proceedings (e.g. litigation, arbitration, and in some cases regulatory investigations) and is broader in scope than legal advice privilege. At a high level, this type of privilege applies to confidential documents or communications between a client, lawyer or third party created for the sole or dominant purpose of obtaining advice or information in connection with an adversarial dispute (which is either under way or in reasonable contemplation). The rationale behind it is that clients should be free to prepare for adversarial proceedings without having to disclose those preparations to the other side or to the court.
There are two important points to bear in mind when considering the application of privilege protection.
- A document will attract privilege if all the limbs of the test are met at the time of creation – a document which is not privileged cannot subsequently become privileged (for example, if sending a non-privileged document to a lawyer to request legal advice – the communication and response may be privileged, but the underlying document will not be).
- Privilege protection can be lost – either voluntarily by the holder of the privilege, or otherwise (for example, if a document is no longer confidential).
AI Tools and Privilege
Turning to the application of privilege to the use of generative AI tools. The first thing to say is that we have a new class of document for the purpose of disclosure – namely, prompts and AI outputs. Given the breadth of the definition of "document", both of these written records of information may be subject to disclosure orders if relevant to the dispute. Awareness of this new reality is important when considering how your employees engage with AI tools.
The law of privilege is complex and its application highly fact specific. Further, we are aware of only a few judicial comments on the interaction between AI and privilege at the time of writing. Until we have more clarity from the judiciary, there will be some uncertainty about how the law of privilege will map onto this new technology.
Scenario 1 – the open (or public) AI tool
Employees use publicly available AI tools, such as widely available chatbots, to assist with their work, including inputting privileged material.
As things currently stand, any interaction with an open (or public) AI tool is unlikely to attract privilege and there is a high risk that inputting already privileged documents will cause privilege to be lost.
An 'open' AI tool, such as a publicly available chatbot, is one that learns from prompts and outputs and stores them for various purposes. In particular, prompts or outputs may resurface in future interactions. For both branches of privilege, a loss of confidentiality means a loss of privilege.
One view, expressed in the recent Immigration Upper Tribunal judgment, is that inputting information into an open AI tool is to "place this information on the internet in the public domain".[1] This absolutist approach may come under pressure in future judgments – and in any event privilege analysis will be fact specific and depend on the AI tool used. But if this maximalist approach is maintained in the courts, then any privileged information inputted into an open AI tool will likely lose that privilege protection.
Mitigation: Enterprise versions of AI tools, where the contract with the supplier ensures that they will not access or store AI prompts or outputs or use them for model training (along with other safeguards to maintain confidentiality) will mitigate this risk. Additionally, it is very important that an organisation's AI use policies are clear on which AI tools can be used by staff and that appropriate training is in place to ensure compliance.
Scenario 2 – bypassing the lawyers
Non-legal employees use AI tools to undertake legal research or obtain legal advice, bypassing in-house lawyers entirely.
There is a high risk that legal advice privilege protection will not attach to these interactions.
Firstly, it will be difficult to argue that a "communication" has taken place with a "lawyer". An interaction with an AI system is not a communication, and AI systems are not lawyers (at least for now). For legal advice privilege, while there are limited circumstances in which documents other than communications can be protected, including where documents are created by a "client" for the sole or dominant purpose of seeking legal advice,[2] the lack of lawyer involvement in this scenario will likely be fatal.
Where the interaction with the AI tool is for the sole or dominant purpose of adversarial proceedings, then provided the other limbs of the legal test are met, there is an argument that those prompts and AI outputs are protected by litigation privilege. That said, it is a risk for AI interactions to take place without the limbs of legal test for privilege in mind – which is more likely with non-legal employees.
Mitigation: Businesses should ensure that staff are aware that interactions with an AI tool may be disclosable in a future dispute. Consider whether non-legal staff should be restricted from using AI tools for legal queries (regardless of whether in respect of adversarial proceedings) without consulting with a lawyer first.
Scenario 3 – AI tools used to summarise meetings
Discussions take place resulting in a mixture of privileged and non-privileged communications, all of which are transcribed and summarised by an AI tool.
Notes of meetings or discussions are only privileged to the extent that the underlying discussion is privileged. That analysis holds if the note or transcription is being undertaken by technology rather than a person. The danger is that an AI tool may not merely transcribe, but it may summarise and rearrange the communications.
In doing so, the AI tool may not distinguish between privileged and non-privileged discussions and may blend them when compiling its summary. In circumstances where the privileged and non-privileged discussions cannot be disentangled, privilege cannot be asserted over the whole meeting and privilege may be lost over the otherwise protected parts of the discussion.
Mitigation: Where privileged discussions are likely to take place in a meeting, consider whether AI transcription is necessary. If it is, holding separate meetings to delineate between privileged and non-privileged communications would be the gold standard. Alternatively, one might make clear in the discussion – for the benefit of the tape, as it were – which parts of the discussion are covered by privilege. Although, there is no guarantee that the AI system will understand and implement that.
Scenario 4 – in-house lawyers using AI tools
In-house lawyers use AI tools to assist with their legal work (e.g., research, drafting) without the outputs ever being "communicated".
Both legal advice privilege and litigation privilege can extend to documents which are not 'communicated', but only in limited circumstances. In the alternative, an in-house lawyer may be able to fall back on so-called 'working papers privilege'.
In general terms, this privilege applies to documents which lawyers create because of their work as a lawyer in relation to advising a client. Helpfully, these documents do not need to be communicated. However, there is caselaw which provides that this privilege only applies to papers which betray the tenor of legal advice ultimately given.[3] The full extent of working papers privilege remains uncertain.
Mitigation: In-house lawyers should think very carefully about whether privilege will apply before interacting with an AI system – perhaps a good rule whenever putting pen to paper.
Conclusion
Law and practice in relation to privilege has always been a complex area, which results from the powerful consequences afforded by privilege protection. The courts have yet to fully grapple with the myriad issues which will undoubtedly arise when privilege designations are challenged on the basis of using AI tools.
In the meantime, as businesses roll out AI systems, the need for a robust AI policy comes to the fore. If you have any questions around the applicability of privilege protections to AI use cases, or how to mitigate risks via robust supplier contract reviews and internal policy drafting, please get in contact.
Note: The information in this article is intended to be of a general nature and is not a substitute for detailed legal advice.
