Generative AI and legal professional privilege

Sam Altman, OpenAI’s CEO, has recently called for the establishment of “AI Privilege”, suggesting that communicating with Generative AI (GAI) should be like talking to a lawyer (or a doctor). In other words, what is shared is subject to a very high level of confidentiality (and cannot be required to be disclosed to a court or anyone else except in very limited circumstances).

Altman may have a point. One of the perceived benefits of GAI (subject to risks that it “hallucinates” – see the recent problems that caused in the Ayinde and Al-Haroun cases) is that it could provide people who otherwise could not afford to consult a lawyer with access to legal knowledge and advice. This might be at least as good as that provided by a lawyer. So why not protect those communications in the same way as lawyer/client communications are protected?

Realistically, the chances of the courts or Parliament creating a new "AI privilege" seem very slim. The courts have consistently refused to extend legal professional privilege to others (such as accountants). Indeed, over the past couple of decades, the English courts have curtailed the scope of legal professional privilege as it applies to communications between clients and their lawyers. And lawyers are likely to fight hard against any legislation that seeks to erode their hegemony over legal professional privilege. However, Altman’s comments highlight real problems for clients and lawyers who use GAI – unless they are careful the privilege they so carefully seek to protect could be lost.

The two most common forms of privilege

Before considering a few examples that illustrate the issues, it is worth a reminder about the two main grounds of legal professional privilege.

First, there is legal advice privilege (LAP). This applies to confidential written or oral communications between a lawyer and a client for the dominant purpose of giving or receiving legal advice.

Then there is litigation privilege (LitP). This applies to confidential written or oral communications between a client or lawyer on the one hand and third parties on the other which occur once litigation is in contemplation or has commenced and which communications occur for the dominant purpose of that litigation.

Applying those concepts to a few examples of GAI uses by clients or lawyers demonstrates where this could be problematic for creating and maintaining privilege.

Example 1: The client seeks advice from a GAI tool

LAP could not apply here because there is no lawyer involved in the communication.

Additionally, if the GAI is an “open model” (meaning that the interactions between users and the GAI tool are not confidential, with the prompts and responses being added to the overall GAI model) then the communications cannot be protected by LAP as they are not underpinned by the necessary confidentiality.

On the other hand, part of the privilege test for applying LitP could be satisfied on the basis that the client is communicating with a third party (the provider of the GAI tool). However, where an “open model” is being used this argument for privilege fails on the basis that the communications are not underpinned by the necessary confidentiality. LitP could though arguably be maintained where the GAI is a “closed model” (meaning that interactions between users and the GAI tool are kept confidential with the prompts and responses not being added to the GAI model).  

In a twist to the above scenario, what if the GAI tool (like a chat-bot) is provided by a law firm based on the knowledge and precedents used by its own lawyers? LAP might not be said to apply because there is no lawyer as such involved in the communication. The user is interacting with software. However, assuming that the GAI is a closed model (as to which see below) it seems arguable that LAP might be extended to this situation. After all, the client is consulting a law firm (assuming the user is a client of the firm). For decades, law firms have offered tools that provide for standardised documents like contracts or non-disclosure agreements to be constructed automatically by clients filling out a questionnaire or other similar document. As far as the writers are aware, no-one has ever suggested that the documents generated through this process cannot be subject to LAP.

Example 2: The client uses a GAI tool to transcribe conversations with their lawyer

The answer to whether LAP or LitP applies to the transcripts of conversations between clients and lawyers rests largely on whether the GAI tool is an open or closed model. As we have discussed, both forms of legal privilege are underpinned by confidentiality. In prior case law, the English court has consistently held that having a third party in the room when a privileged discussion is taking place between a lawyer and a client does not destroy the privileged nature of the conversation provided that the third party is subject to confidentiality obligations (whether express or implied). In this example, effectively the GAI tool being used equates to the “third party”, so that if the model used is closed then privilege is likely to be maintained whereas if it is open then it is highly likely it will not be. It is also worth noting that even with a closed model, privilege could be lost if AI-generated transcripts are stored or processed in a way that is accessible beyond the narrowly defined “client” group established by case law. Internal access wider than those instructing lawyers may amount to waiver.

The lesson therefore is clear that clients (and their lawyers) need to very careful about using GAI tools to record and transcribe their conversations. It may be convenient to use them and save time and costs in preparing notes, but the risk is that the conversations taking place will not be privileged because they are not underpinned by confidentiality.   

Example 3: The client shares the advice received from their lawyer with a GAI tool

Clients might feel tempted to obtain a second opinion on the advice received from their lawyers by “checking” it with a GAI tool. Here, the client risks waiving privilege in the legal advice it has received. As in the previous example, it again turns on whether the GAI tool used is open (privilege is likely lost because confidentiality is waived) or closed.

A further possibility is that a larger more sophisticated client might add the legal advice to its own GAI tool for future use should a similar situation arise in the future. Perhaps that might be deposited in a GAI tool that is shared within a group of companies. Here an issue arises because of the definition of “the client” for the purposes of LAP. Consistent with case law, “the client” is unlikely to be the company itself, but instead a few individuals at the company who provided the instructions to the lawyers and are specifically interested in receiving the advice from them (perhaps an in-house lawyer and a few senior managers and/or members of the Board of Directors). In sharing the advice even in a closed GAI tool, the client is technically making it available to third parties such as other employees, managers or directors. In doing so it risks waiving privilege. The answer here is to make sure that it is very clear that what is contained in the GAI tool is and remains confidential, meaning that making it available to “third parties” does not waive privilege as against the rest of the world.    

Conclusion

While Sam Altman’s call for reform is unlikely to be heeded, it has helpfully highlighted issues regarding the use of GAI in the context of legal professional privilege. GAI provides valuable support to lawyers and their clients, but its use needs to be carefully thought through to ensure that privilege is not sacrificed on the altar of utility.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, August 2025