Which legal AI tools can we trust with privileged and confidential data?

When it comes up

When lawyers want to use AI on live matters, when a business team asks to use an AI tool on legal documents, or when you choose a legal AI vendor.

Your options

Consumer AI tools (free or personal accounts)

Fits when: Only for public information and general learning with no client or company data.

Watch out: Terms may allow training, human review and disclosure; in Heppner this defeated privilege.

Enterprise general-purpose AI under negotiated terms

Fits when: Internal and confidential work where the contract excludes training, limits retention and access, and gives notice of disclosure demands.

Watch out: Check retention for abuse monitoring, sub-processors and admin settings; confirm the terms cover your actual product tier.

Specialist legal AI platforms

Fits when: Privileged and matter work, where the vendor offers legal-grade confidentiality, matter-level access controls and grounded research.

Watch out: Specialist does not mean safe by default; review the same terms and security evidence.

Self-hosted or private-cloud models

Fits when: Highly sensitive matters or regulated data where you need full control over data location and logs.

Watch out: Higher cost and effort; you own security, updates and quality testing.

How to decide

Classify the data for the use: public, internal, confidential, privileged, regulated personal data.
Read the terms of the tool tier you'll actually use: training, retention, human access, disclosure, sub-processors, location.
Apply hard stops: no privileged or confidential data where the vendor may train on it or where terms allow disclosure without notice.
Add controls for privileged work: counsel direction, labelling, access limited to the matter team, retention settings.
Publish the result as a data-to-tool matrix and review it when terms change.

Trade-offs

Stricter tools cost more and roll out slower; looser tools risk confidentiality and privilege. A clear matrix with at least one approved enterprise tool usually gives most of the value with acceptable risk.

Real examples

In United States v. Heppner (S.D.N.Y., February 2026), Judge Jed Rakoff held that about 31 documents a defendant created with the consumer version of Anthropic's Claude were not protected by privilege or work product, relying on the tool's terms allowing training and disclosure and on the absence of counsel's direction. Source: American Bar Association, Litigation Section — AI communications not privileged: what United States v. Heppner means for corporate clients ↗ · McGuireWoods — When AI isn't privileged, confirmed: SDNY's written opinion elaborates on confidentiality, work product and waiver (18 February 2026) ↗
Samsung restricted staff use of generative AI tools in May 2023 after engineers uploaded sensitive internal information, including source code, to ChatGPT. Source: Bloomberg — Samsung bans staff's AI use after spotting ChatGPT data leak (2 May 2023) ↗

What to check first

Does the tool tier you use exclude training on inputs and outputs, in the contract (not just a web page)?
How long are prompts and outputs retained, who can access them, and will you be told about legal or government demands?
Do NDAs, protective orders or data processing agreements allow sharing this data with the AI provider?
Can access be limited to the matter team, and are logs available for legal holds?

Learn and use

Sources

Last reviewed 2026-10-01.