1. The Commercial AI Question in Legal Practice

Law firms face strong incentives to adopt generative AI. Clients expect faster turnaround and more predictable fees. Litigation teams may need to analyze millions of documents in a short amount of time. Transactional lawyers routinely review extensive contracts and diligence materials. Used appropriately, AI can reduce the time required for many of these tasks.

But “AI tool” is not a single risk category. A free consumer chatbot, a business workspace, an enterprise subscription, a legal-specific product, and an API deployment may have materially different terms, retention settings, administrative controls, and security features. Even within one platform, behavior can vary by feature, endpoint, configuration, geography, and negotiated agreement. Lawyers cannot assume that a familiar brand is safe for confidential information. They must verify the relevant facts.

The American Bar Association’s Formal Opinion 512 provides a useful baseline:

“Before lawyers input information relating to the representation of a client into a GAI tool, they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm.”

The opinion further advises lawyers to read and understand the tool’s terms of use, privacy policy, and related contractual terms—or consult someone qualified to analyze them. This is a due-diligence obligation, not a rule that one subscription label or deployment model is automatically acceptable.

2. The Ethical Duties That Apply

ABA formal opinions and the ABA Model Rules are influential, but they are not themselves binding in every jurisdiction. Lawyers must consult the rules adopted in the jurisdictions governing their conduct, along with applicable court orders and client requirements.

Competence

ABA Model Rule 1.1 requires competent representation. Comment 8 states that maintaining competence includes keeping abreast of the benefits and risks associated with relevant technology.

Formal Opinion 512 explains that a lawyer need not become an AI engineer. The lawyer must, however, have a reasonable understanding of the capabilities and limitations of the particular system being used or obtain help from someone with the necessary expertise.

Competence also requires appropriate verification. Generative AI can produce incomplete, biased, outdated, or fabricated results. The level of review may vary with the task and the reliability of the system, but a lawyer cannot delegate professional judgment to the tool.

In Mata v. Avianca, Inc., 678 F. Supp. 3d 443 (S.D.N.Y. 2023), lawyers were sanctioned after filing nonexistent authorities generated by ChatGPT and failing to respond appropriately when the citations were questioned. Its central lesson is that AI does not displace counsel’s existing duties under Federal Rule of Civil Procedure 11 or duties of candor and competence.

Confidentiality

ABA Model Rule 1.6 protects all information relating to a representation, not only attorney-client communications. Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized or inadvertent disclosure or access.

What constitutes reasonable protection is fact-specific. Relevant considerations include:

  • the sensitivity of the information;
  • the likelihood of disclosure or unauthorized access;
  • the safeguards offered by the service;
  • the cost and difficulty of implementing additional safeguards; and
  • whether those safeguards would materially impair the representation.

Formal Opinion 512 identifies particular concerns when a self-learning system may use information from one matter in a way that could expose it to later users. The opinion states that informed consent is required before entering representation information into such a system when its design creates that disclosure risk. It also cautions that general boilerplate in an engagement letter may not be sufficient to constitute informed consent.

Emerging state guidance appears to be following the same general, risk-based approach:

  • Florida Ethics Opinion 24-1 recommends obtaining informed consent before using a third-party generative-AI program if doing so would disclose confidential information. It directs lawyers to investigate data retention, sharing, self-learning, security, contractual obligations, breach notification, and process-notice practices. The opinion expressly states that advisory ethics opinions are not binding.
  • The State Bar of California’s 2026 Practical Guidance, which replaced its 2023 guidance, says lawyers must make reasonable efforts to understand how a product collects, uses, stores, and discloses information. It advises against entering client confidences into a system presenting material confidentiality or security risks without informed consent.
  • The New York State Bar Association’s 2024 Task Force Report discusses confidentiality, training use, privilege, competence, and supervision. It is a task-force report rather than a binding ethics opinion.
  • Pennsylvania and Philadelphia Joint Formal Opinion 2024-200, dated May 22, 2024, emphasizes competence, independent verification, confidentiality, client communication, and continuing education.

Communication and informed consent

Even when confidentiality rules do not require consent, the duty to communicate may require a lawyer to discuss AI use with the client. Formal Opinion 512 identifies several relevant circumstances, including when:

  • the client asks whether AI is being used;
  • an engagement agreement or outside-counsel guideline requires disclosure;
  • AI use will influence a significant decision in the representation;
  • the use affects the basis or reasonableness of the fee; or
  • the nature of the service may conflict with the client’s reasonable expectations.

Routine, low-risk uses may not require a separate disclosure. The decision should be based on the role of the tool, the information involved, and the significance of the task. There is no blanket rule that every use must or need not be disclosed.

Supervision, candor, and fees

Managerial and supervisory lawyers should establish policies, access controls, training, and review procedures for lawyers and nonlawyers using AI. The firm also remains responsible for the conduct of outside providers involved in delivering legal services.

AI-generated citations, factual statements, and legal analysis must be verified before use. Lawyers should also check applicable standing orders, local rules, and client requirements for AI-specific disclosure or certification obligations.

Billing must reflect the actual arrangement and remain reasonable. A lawyer billing by the hour may charge for time actually spent prompting, reviewing, correcting, and applying AI-generated work, but may not bill for time the tool saved as though the lawyer performed the work on their own. General-purpose subscriptions will often be treated as overhead; matter-specific third-party costs may be chargeable if properly disclosed and reasonable. Formal Opinion 512 discusses these distinctions in detail.

3. Confidentiality Is Not the Same as Attorney-Client Privilege

The ethical duty of confidentiality is broader than the attorney-client privilege. Rule 1.6 generally covers information relating to a representation regardless of its source. Privilege is an evidentiary doctrine protecting qualifying confidential communications made for the purpose of obtaining or providing legal advice.

Disclosure of privileged material to a third party can create waiver risk, but the result is not automatic in every circumstance. Courts may consider:

  • whether confidentiality was reasonably expected and preserved;
  • the third party’s function in facilitating legal advice;
  • whether disclosure was necessary or merely convenient;
  • applicable contractual and technical protections;
  • the purpose and scope of the disclosure; and
  • the federal or state law governing privilege and waiver.

The Second Circuit’s decision in United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), extends attorney-client privilege only to third parties whose involvement is strictly necessary to translate or facilitate legal communications. This narrow exception offers no automatic shield for modern technology vendors. Exposing protected client information to a third-party AI provider—without enforcing rigorous confidentiality safeguards, data siloing, and opt-outs for model training—likely falls completely outside of Kovel’s protections, thereby risking a total waiver of privilege.

Furthermore, practitioners cannot rely on Federal Rule of Evidence 502 to rescue them from careless AI usage. Rule 502(b) is designed to mitigate the damage of inadvertent disclosures, but actively uploading or pasting client data into a commercial AI prompt is an intentional act. Because it is an intentional disclosure to an unsecured third party, opposing parties might effectively argue that the privilege is waived for that specific information—and may even attempt to trigger broader subject-matter waivers under Rule 502(a).

Ultimately, leveraging AI without a comprehensive understanding of how the provider ingests, stores, and uses the data invites severe and highly avoidable waiver disputes. To protect sensitive materials, firms must treat unsafeguarded AI platforms as unauthorized third-party disclosures and mandate strict reviews of all vendor contracts, security protocols, and data configurations before any client information is entered.

4. How to Evaluate a Commercial AI Service

The phrase “we do not train on your data” addresses one important issue, but it does not answer every confidentiality or security question. It is also inaccurate to assume that all commercial systems train on customer content, retain all prompts indefinitely, or permit unrestricted employee review.

Current OpenAI API documentation, for example, states that API data is not used to train or improve OpenAI models unless the customer affirmatively opts in. It also explains that default abuse-monitoring logs may contain customer content and may be retained for up to 30 days, while eligible customers can obtain Modified Abuse Monitoring or Zero Data Retention controls. The platform also supports Enterprise Key Management using externally managed keys. Individual endpoints and features can have different application-state retention rules. See OpenAI, Data Controls in the OpenAI Platform.

Those controls do not establish that a service is appropriate for a particular client or matter. They demonstrate why lawyers must evaluate the actual product and configuration instead of relying on assumptions about an entire vendor or subscription category.

A defensible assessment should address at least the following:

  1. Training and improvement: Is customer content used to train or improve a model? Is participation opt-in or opt-out?
  2. Retention: What is retained by default? Can retention be reduced? Do different features have different rules?
  3. Human access: Under what circumstances may employees or contractors review content? What safeguards and audit trails apply?
  4. Contractual protection: Does the agreement impose confidentiality, security, deletion, breach-notice, and legal-process-notice obligations?
  5. Subprocessors and location: Which subprocessors receive data, and where is it processed and stored?
  6. Access control: Does the service support single sign-on, multifactor authentication, role-based permissions, least privilege, and administrative logging?
  7. Encryption and key management: How is data encrypted in transit and at rest? Are customer-managed or externally managed keys available?
  8. Connectors and tools: Can plug-ins, web search, agents, or third-party connectors transmit information to other services with different policies?
  9. Deletion and backups: What does deletion cover, how quickly does it occur, and what backup or security-log exceptions remain?
  10. Governance: Do the firm’s policies, client instructions, incident-response procedures, and verification requirements cover the proposed use?

Legal-process risk should also be addressed accurately. Stored content held by a firm or provider may be subject to subpoenas, warrants, regulatory demands, or preservation duties, depending on the facts and governing law. Contracts may provide notice rights, but notice can be restricted by law. No ordinary cloud architecture makes information categorically immune from lawful process.

5. Private and Isolated Architectures as a Risk-Reduction Option

For highly sensitive matters, a law firm may conclude that a private or more isolated deployment offers advantages over a generally available service. Relevant safeguards can include:

Technical Safeguards in Private AI Architectures

  • Logically Isolated Networks: Dedicated Virtual Private Clouds (VPCs) with restrictive ingress and egress firewall policies.
  • Private Connectivity: Routing through private service endpoints that avoid traverse over the public internet.
  • Strong Identity & Access Controls: Role-based access control (RBAC), least-privilege principles, and comprehensive administrative audit logging.
  • Customer-Managed Encryption Keys (CMEK): Utilizing externally managed or customer-held keys to encrypt data at rest.
  • Configurable Retention & Tested Deletion: Explicit retention rules with verifiable, tested purge procedures.
  • Contractual Prohibitions on Secondary Use: Binding terms forbidding model training, profiling, or data sharing.
  • Controlled Logging & Telemetry: Strict suppression of client inputs in diagnostic and telemetry logs.
  • Matter-Level Segmentation: Enforcing internal ethical walls and granular matter isolation within the practice.
  • Documented Subprocessors: Full visibility into data flows and third-party dependencies.
  • Auditable Records: Immutable configuration and access records supporting compliance verification.

These controls can help a firm demonstrate reasonable efforts to protect client information. They can also support compliance with client outside-counsel guidelines and provide evidence concerning how information was handled.

They should not, however, be described as automatically preserving privilege or satisfying professional-responsibility rules. A Virtual Private Cloud ordinarily provides logical network isolation; it does not by itself prove that the underlying physical hardware is dedicated to one customer. Customer-managed keys improve control but do not necessarily mean the provider is technically incapable of performing an authorized decrypt operation. “Zero data retention” must be assessed across application state, logs, backups, telemetry, connected services, and downstream processors.

At Enclave Systems, our focus is helping organizations evaluate and implement private-AI architectures aligned with their risk profile and governance requirements. Depending on the validated design, this may include isolated cloud environments, private networking, customer-managed key services, restrictive access controls, retention controls, and auditable policies.

6. A Practical Compliance Checklist for Law-Firm Leadership

  1. Inventory current AI use: Identify approved and unapproved tools, user groups, data types, integrations, and use cases. A confidential internal survey, supported by appropriate technical review, is often more effective than assuming that a written prohibition reflects actual practice.
  2. Classify information and use cases: Separate public or hypothetical work from client-confidential, privileged, regulated, export-controlled, or highly sensitive information. Define which categories may be used with which systems and under what conditions.
  3. Establish an approval process: Require legal, security, privacy, records-management, and procurement review proportionate to the risk. Approval should attach to a defined product, plan, feature set, configuration, and contract—not merely to a vendor name.
  4. Adopt and train on a written AI policy: The policy should address approved uses, prohibited information, client consent, output verification, court rules, billing, intellectual property, records retention, incident reporting, and changes in vendor terms or features. Training should include lawyers, paralegals, administrative personnel, contractors, and relevant vendors.
  5. Confirm client and court requirements: Review engagement terms, protective orders, outside-counsel guidelines, data-processing restrictions, local rules, standing orders, and filing-certification requirements before using AI on a matter.
  6. Perform documented vendor and architecture diligence: Record the facts supporting approval: terms, retention, training use, human access, subprocessors, encryption, keys, identity controls, logs, deletion, incident response, business continuity, and legal-process notice.
  7. Apply data minimization: Use the least amount of client information necessary. Where practical, redact, anonymize, pseudonymize, summarize, or use synthetic facts—but do not assume that superficial removal of names is sufficient to prevent re-identification.
  8. Verify outputs and preserve professional judgment: Require appropriate review of citations, quotations, factual statements, calculations, legal analysis, and final documents. The lawyer remains responsible for the work.
  9. Reassess periodically: AI systems, terms, models, integrations, and retention behavior change. Approval should be reviewed when material features or contracts change and at defined intervals.
  10. Prepare for incidents and legal process: Establish procedures for suspected disclosure, inaccurate filings, preservation requests, subpoenas, vendor incidents, and client notification. Ensure the firm knows whom to contact and what evidence will be available.

7. Selected Authorities

Professional-responsibility guidance

Privilege, evidence, and court obligations

Product and security documentation

8. Conclusion

Lawyers can use generative AI for client work, but the technology does not reduce their professional responsibility. They must understand enough about a system to evaluate its risks, protect information relating to the representation, obtain informed consent when required, supervise users and providers, verify outputs, comply with client and court rules, and charge reasonable fees.

For some matters, a vetted enterprise or API service with appropriate contractual and technical controls may be reasonable. For others—particularly matters involving unusually sensitive information, restrictive client requirements, or heightened threat models—a private or more isolated deployment may provide valuable additional safeguards.

The defensible approach pairs documented matter-level governance with verifiable technical safeguards. While commercial marketing labels offer no shield against waiver disputes, an isolated, thoughtfully designed architecture can provide the concrete, auditable boundaries required to uphold ethical obligations and preserve client trust.