Course Description
The coming of the AI era for the legal profession presents a plethora of new traps and tribulations for lawyers concerned about protecting client confidentiality. Which, of course, should be every lawyer. The fact that the cases in this area are few, and change seemingly by the week, and involve technology that changes seemingly by the hour, only make this an even bigger challenge. Because as the ABA Formal Opinion 512 made clear just a few years ago, the fundamental ethical rules for the legal profession are not going to change because of the advent of AI, and as well, AI in the legal profession is here to stay.
Principles
- Professional Responsibility and the Evolving Legal Framework for AI
- Applying existing ethical duties, including competence and confidentiality, alongside ABA Formal Opinion 512, state bar guidance, court rules, and emerging legislation such as California SB 574.
- Protecting Attorney-Client Privilege and Work Product in AI-Assisted Practice
- Understanding emerging court decisions on privilege waiver, work product protection, disclosure to AI providers, and the unresolved legal questions surrounding consumer-grade and enterprise AI tools.
- AI Vendor Due Diligence, Data Security, and Confidentiality Safeguards
- Evaluating AI platforms, terms of service, data retention, model training, privacy settings, and contractual protections to determine whether a system is appropriate for handling confidential client information.
- Lawyer Accountability, AI Verification, and Risk Management
- Maintaining independent professional judgment, verifying AI-generated content and legal authorities, documenting appropriate use, and recognizing that lawyers remain accountable for AI-assisted work product.
- AI Governance, Client Policies, and Litigation Discovery Protections
- Developing practical AI-use policies, documenting client and counsel expectations, establishing incident-response procedures, and addressing preservation, discoverability, ESI protocols, protective orders, and FRE 502(d) protections.
Syllabus
- How current ethical guidance, court rules and – now with the passage of California SB-574 – existing law govern lawyer conduct in the dawn of the Legal AI era
- The applicable ABA Model Ethical Rules:
- Rule 1.1 Competency
- “A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.”
- Comment 8: “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.”
- VERY IMPORTANT NOTE: per top ethics lawyers (paraphrasing): “Comments are only there to help. Nobody gets busted for violating a comment.”
- Rule 1.6: Confidentiality
- (a) “A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent . . .”
- Rule 1.6(c) “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”
- Comment 18: Paragraph (c) requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer’s supervision. See Rules 1.1, 5.1 and 5.3. The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure. Factors to be considered in determining the reasonableness of the lawyer’s efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).
- Taking this chronologically, starting with 2023 and the case that launched a thousand LinkedIn posts: Mata v. Avianca
- How the lawyer went wrong with AI
- Obviously, the made up “hallucination” cases was the main problem
- Secondary problem that didn’t get much if any attention was that the lawyer used a public, non-confidential SaaS system
- Why was this such a surprise?
- ChatGPT was the very new and VERY shiny thing!
- We simply couldn’t imagine as a profession that this kind of technology would exist one day (not even Richard Susskind the patron saint of legal technology mentioned it in all of his books)
- Most lawyers didn’t understand the technology or the implications (and most still don’t)
- Why we still cannot seem to solve so many of the problems
- “Hallucinations” continue to proliferate
- Confidentiality issues also continue, and still don’t get the same level of attention
- 2023-24: the flurry of non-binding by important guidance in response to Avianca
- 9 states issued guidance from late 2023 through 2024 (in chronological order):
- State Bar of California Recommendations from Committee on Professional Responsibility and Conduct on Regulation of Use of Generative AI by Licensees
- Florida Bar Ethics Opinion 24-1
- Kentucky Bar Association Ethics Opinion KBA E-457
- Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence
- New Jersey State Bar Task Force on Artificial Intelligence (AI) and the Law: Report, Requests, Recommendations, and Findings
- Pennsylvania Bar Association Committee On Legal Ethics And Professional Responsibility and Philadelphia Bar Association Professional Guidance Committee, Joint Formal Opinion
- West Virginia Office of Disciplinary Counsel, Legal Ethics Opinion 24-01
- District of Columbia Bar Ethics Opinion 388
- Virginia State Bar Ethics and Conduct website update
- The guidance varies in detail:
- From a few pages: California
- To novella-length: New York – 92 pages with a whole backstory on the history of AI
- The guidance also varies in terms of the level of “scariness,”
- From non-plussed (Kentucky, Virginia)
- To “Be afraid. Be very afraid” (DC and Pennsylvania)
- The ABA issued Formal Opinion 512 in late 2024 as a syncretic opinion of the various bar guidance, but with some key additional points
- The three key ABA 512 themes (and dispensing with the fear-mongering):
- Accountability: you are always accountable for all of your work product, to anyone, no matter how it is generated
- The current rules are sufficient for now to govern lawyers’ use of AI
- AI is here and here to stay; it is not going away
- Competency – examples:
- ABA Op. 512: “lawyers may not abdicate their responsibilities by relying solely on a GAI tool to perform tasks that call for the exercise of professional judgment. . . the lawyer is fully responsible for the work on behalf of the client.”
- State guidance is consistent – example: WV: “One of the biggest risks associated with a lawyer’s use of generative AI is overestimating the capabilities of the software or accepting the AI’s work product on its face as credible.”
- Confidentiality – examples:
- ABA Op. 512: Lawyers must understand potential for both external and internal leaks
- CA: Consult on security and retention, but also learn to properly use the AI tools
- DC: If in doubt, don’t take that risk
- FL: Must obtain client consent if there is a potential issue.
- KY: Provides a balanced approach that considers context with healthy skepticism
- NY: A highly detailed list of potential external threats
- The beginning of binding formal opinions: NC 2024 Formal Ethics Opinion 1:
- Lawyers can use AI if they use it competently
- Like ABA 512, “the Buck Stops Here” with lawyer responsibility
- Must be assured that AI is sufficiently secure and complies with confidentiality obligations before uploading any documents or information
- But makes no formal opinion on whether this violates attorney-client privilege
- 2025-2026: Turning from guidance to rules
- Additional sets of non-binding guidance:
- Ohio Board of Professional Conduct Ethics Guide: Artificial Intelligence for Lawyers and Judicial Officers (2026)
- OR Formal Opinion 2025-205
- TX Professional Ethics Committee Opinion 705 (2025)
- WA State Bar Advisory Opinion 2025-5
- Far more importantly, actual binding rules – but only on hallucinations
- FL Supreme Court Amendments to the Florida Rule of General Practice and Judicial Administration 2.515(d)(2)
- NY Part 161 of the Rules of the Chief Administrator (June 1, 2026)
- 2026: The beginning of the final step in the process, with codification by CA SB-574
- Signed in September, 2026
- “(3) An attorney who uses generative artificial intelligence to assist in the practice of law shall do all of the following:
- (A) Not enter confidential, personal identifying, and other nonpublic information into a generative artificial intelligence system for which access to confidential, personal identifying, or other nonpublic information the attorney inputs into the system is not restricted to the attorney and persons authorized by the attorney under obligations to protect the confidentiality of the information.
- (B) Take reasonable steps to do both of the following:
- (i) Verify the accuracy of generative artificial intelligence outputs, including, but not limited to, the accuracy of all case and statutory citations.
- (ii) Correct any erroneous or hallucinated output in any material used by the attorney.
- (C) Disclose the use of generative artificial intelligence to the court for all documents submitted to the court and consider whether to disclose the use of generative artificial intelligence if it is used to create content provided to the public.”
- (2) “Personal identifying information” includes all the following:
- (A) Driver’s license numbers.
- (B) Dates of birth.
- (C) Social security numbers.
- (D) National Crime Information and Criminal Identification and Information numbers.
- (E) Addresses and phone numbers of parties, victims, witnesses, and court personnel.
- (F) Medical or psychiatric information.
- (G) Financial information.
- (H) Account numbers.
- (I) Any other content sealed by court order or deemed confidential by court rule or statute.
- What does (A) change in terms of confidentiality obligations?
- As to Rule 1.6: nothing – same duty as before, but now a matter of law
- As to “personal information,” that Rule 1.6 wouldn’t normally apply to, we now have an additional “no go” list
- But maybe an additional trap because the first versions of this bill covered “public AI” (i.e., “consumer grade”) and that was removed, so now applies to ALL AI, even those built specifically for lawyers
- What the court opinions that have come down on the issue of AI and attorney-client privilege/work product protection say
- Important warning!
- There are and estimated 1,200+ federal judges/magistrates/etc. and 30,000+ state court trial-level judges
- This webinar will be based upon the rulings of fewer than 10 of them
- None of these cases are actual “Precedent,” just maybe “precedent”
- There is a also a lot more that has not been said than has
- The cases – so far:
- US. v. Heppner, 1:25-cr-00503 (S.D. N.Y., 02/17/2026)
- The case that started it all and that lawyers have obsessed over
- Many claim this is “The Heppner Era”
- It is not
- Heppner is wrong
- Renowned Judge Rakoff found that client waived attorney-client and work product protection when he “communicated” with online AI Claude (consumer grade)
- AI was not a lawyer so it could not create attorney-client privilege
- Even if that did not break privilege, it disclosed documents to others because Anthropic has a policy that allows them to disclose information to courts/law enforcement if ordered/subpoenaed
- Also could not be work product because was not directed by an attorney
- Unfortunately, Rakoff got it wrong – but he is an example of a judge who does NOT understand technology that we will need to prepare for
- AI ≠ a person and so cannot be an “interlocutory party” (See Sedona Conference Guidance on this)
- Thus the disclosure could only be as to those who had access to Claude
- Rule 1.6(c) only requires reasonable protection, not perfect (see Comment 18)
- Court/law enforcement clause is Market, and NO SaaS system will waive that because it means that they’d have to defend you and maybe even go to jail for you – and it was settled law 15+ years ago that this did not violate Rule 1.6(c)
- Thus, Heppner failed to rule upon the key point of whether the consumer grade privacy terms violated attorney-client/work product requirements
- But Heppner is still the most important case
- It is the worst case scenario of the judge who is not up-to-date on technology or legal ethics
- Lawyers are treating it as the standard/Precedent
- Even if it is not even precedent for the later cases on this issue
- Warner v. Gilbarco, 2:24-cv-12333 (E.D. Mich., 2/10/2026)
-
- Denied motion to overrule pro se plaintiff’s privilege/work product designation for documents created using ChatGPT
- “ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background.”
- Even if use of ChatGPT was a waiver, it would have had to be a waiver “to an adversary or in a way likely to get in an adversary’s hand.”
- The magistrate was highly dubious about defendant’s goals: “no cited case orders the production of what Defendants seek here: a litigant’s internal mental impressions reformatted through software.” And “Defendants’ preoccupation with Plaintiff’s use of AI needs to abate.”
- Morgan v. V2X, 25–cv–01991 (D. Co., 3/30/2026)
-
- Magistrate Judge Maritza Dominguez Braswell is one of the three founding members of the Judicial Counsel on AI and on the speaker circuit for this
- Parties were battling over revisions to a protective order, because defendant believed that plaintiff had violated it by uploading documents to online AI
- It does not matter that AI is not a lawyer, because it is not a person/third party
- “Even though AI use technically “discloses” information to a third party, it is highly unlikely the information will fall into the hands of an adversary absent some legal process to compel it.”
- Expectations matter as well: “it is entirely reasonable for a person to expect some privacy and confidentiality when interacting with these tools, even though they understand a third party is behind the tool collecting and storing their information.”
- Magistrate drafted own version of order that barred any non-enterprise (no training, no retention of data) AI
- This creates an unfairness and A2J problem: “The Court recognizes that practically speaking, and in light of the current state of AI, this provision will (at least for now) bar the parties from using most, if not all, mainstream low-to-no-cost AI to process Confidential Information. This type of restriction disadvantages pro se litigants. Enterprise-tier AI accounts that satisfy these requirements may be available only through organizational procurement processes, or at costs that a pro se litigant is unlikely to bear.”
- Shealy v. Seaside Investments, 684CV00799 (Superior Court Mass. June 18, 2026)
- Motion to compel unredacted documents
- Plaintiff had asked his girlfriend to use ChatGPT for him – claims she was just “like a Xerox” assisting with “providing a paperwork flow.”
- While these documents could have been protected under work product, the girlfriend was not his lawyer: “Plaintiffs do not cite any case in which a court has held that a party’s romantic partner is his or her “representative” such that documents prepared by that individual are protected by the work product doctrine. That is no surprise.”
- But judge also considers whether ChatGPT could have been plaintiff’s “representative”
- Follows Morgan and Warner
- But those were pro se plaintiffs, and “Plaintiffs are represented by sophisticated, capable counsel. Plaintiffs’ counsel had nothing to do with Shealy’s decision to ask his romantic partner to upload documents to ChatGPT and generate information and documents.”
- Thus more similar to Heppner, and so “I conclude, as a matter of first impression, that neither the queries of AI programs for legal assistance by a party’s romantic partner nor the AI output are protected from disclosure under the work product doctrine unless performed at the direction of counsel.”
- But the judge does not mistake AI for a person: “Nor does the output from ChatGPT constitute opinion work product. AI is a tool not a person. Nothing about what ChatGPT produces discloses the “mental impressions, conclusions, opinions, or legal theories of an attorney or other representative of a party concerning the litigation.”
- Fry v. Viktorovna, 26-cv-3469 (E.D. Pa., 08/27/2026)
- Motion to seal documents
- Judge found that “wholesale sealing order not warranted.”
- Had ordered pro se plaintiff to disclose any use of AI in connection with his motion.
- Plaintiff indicated that he uploaded the redacted documents into non-enterprise versions of Claude and Claude Cowork.
- “full sealing of any document is nor appropriate. Documents and information uploaded to Claude are processed on Anthropic’ s servers, and Anthropic ‘data privacy and data training pages make clear that such information is not private.” “As such, it would be inappropriate for the Court to seal a document that has already been provided to a private, for-profit research and artificial intelligence agency.”
- Some view this as following Heppner
- Cites to Heppner
- But the cited policies are from the Claude consumer tier
- These are not Market-standard subpoena/order clauses that would be found even with enterprise tier accounts
- Villanueva v. Las Vegas Metropolitan Police, 2:24-cv-00125 (D. Nev., 09/29/26)
- Plaintiff’s expert testified that he used ChatGPT to research and draft his report
- AI use was not disclosed previously
- Magistrate judge ordered the entire 40-page chat log produced
- District court judge reversed:
- Legal case summaries created by ChatGPT must be produced
- Expert consulted them in forming his opinions, so they are facts or data considered under Rule 26(a)(2)(B)(ii)
- The expert’s prompts reveal his mental impressions
- The deposition outline ChatGPT generated reflects his priorities for deposition and trial
- Outputs he pasted into his report are protected drafts under Rule 26(b)(4)(B)
- Also understood that AI is not a person: “Because ChatGPT is not a person, but was an application used in this instance as a research, drafting, and editing program, the Court finds that any privileged information is not waived by Melton’s use of the program.”
- Issues left open:
- Does use of non-enterprise AI violate privilege/work product protection?
- If not per se violation then what level of security/privacy is required?
- No training?
- No retention at all (ZDR)?
- No safety review?
- No Market-standard subpoena/order clause?
- How do we solve the A2J or even just BigLaw v. everybody else problem?
- How can lawyers evaluate the available AI systems and take concrete steps to protect their clients – and themselves
- Provider terms are the fulcrum of privilege issues
- Terms control everything
- Except when they don’t:
- Settings
- Exceptions
- Changes
- User errors
- What really controls is money – what you spend in terms of AI to obtain the terms you need (though, there are better ways now)
- Reviewing the “Big 3” (OpenAI, Anthropic, and Microsoft) shows that there are red flags galore for lawyers even at the enterprise tier levels (I have a chart for this)
- Consumer/pro-sumer grade is not enough for Rule 1.6
- Training = manual opt-out for all
- What can be toggled can be untoggled
- Especially since the request look so helpful and nice – who doesn’t want to help the company “improve results for everyone”?
- Software upgrades can also lead to untoggled toggles
- Retention also problematic
- OpenAI: kept until deleted
- Anthropic: If opt-out then can be deleted and will be purged within 30 days (otherwise kept up to 5 years)
- Microsoft: deletable but otherwise kept for 18 months
- Enterprise DPAs and no-training clauses do NOT always create a sufficient reasonable expectation of confidentiality
- Training clauses are better here:
- Open AI/Anthropic: off by default (but could be opted-in)
- Microsoft: always off
- Retention still troubling:
- OpenAI allows workspace retention setting but 90-day minimum and Zero Data Retention only for “qualifying API use” – and this is same with Astra for Legal
- Anthropic has Fable override for 30 days. Plus API standard retention is 7 days and again, only ZDR for big $$$ accounts
- Microsoft: governed by whatever your Purview admin does (haven’t heard of Purview and no idea who your admin for this is . . . yeah!)
- Steps that you can take
- Documenting counsel direction
- Do not refer to AI in terms that make it look like a person (meet the Sapir–Whorf hypothesis)
- Everything must be in writing/email
- Draft a client policy – an email is not enough
- Require the client to sign it
- BONUS: You can also put in terms to prevent ChatGPT Law Degree lawyering!
- Tiered AI governance frameworks and internal policy design
- Review before you write any policy
- Insurance guidelines/restrictions/bans
- Client guidelines/restrictions/bans
- Local bar guidance/rules
- Local court rules
- Your AI enterprise license protections on training and retention
- Your system settings and admin people/processes
- Your existing incident response policies
- Internal use policy for consumer-grade AI
- Follow insurance/client/bar/court guidelines/rules/etc. (list all)
- Use only systems from our approved list (list) – NO PERSONAL SYSTEM USE!
- Remember that AI inputs/outputs can be discoverable – act accordingly
- Never change training/retention settings or toggles (list authorized people/escalation path)
- Never input confidential information – ever
- Don’t use redaction as a form of privacy protection – it’s too easy to miss things/mess up
- Generalize or use synthetic data – but remember that AI can infer if too detailed
- Problem? Follow the (included) incident reporting protocol – “delete and pray” doesn’t work
- Get everyone to sign it (not just the lawyers – everyone)
- Update it regularly (and get signatures on that)
- Internal use policy for enterprise AI – is NOT a free-for-all
- Follow insurance/client/bar/court guidelines/rules/etc. (list all)
- Use only systems from our approved list (list) – NO PERSONAL SYSTEM USE!
- Remember that AI inputs/outputs can be discoverable – act accordingly
- Chart of training/retention provisions for all systems – with red-flags for potential traps
- Never change training/retention settings or toggles (list authorized people/escalation path)
- Follow ethical walls/restrictions – you understand these, the AI does not
- Problem? Follow the (included) incident reporting protocol – “delete and pray” doesn’t work
- Get everyone to sign it
- Update it regularly – and get signatures on the updates
- It should go without saying, but because of the importance I will say shout it anyway: VERIFY EVERYTHING AI TELLS YOU AS IF YOUR BAR LICENSE DEPENDS UPON IT
- Platform selection, vendor diligence, and consumer-grade tool prohibition
- As mentioned before, consumer/pro-sumer grade is never going to be enough
- If you can afford an enterprise/API license, use it with the appropriate policies
- If you cannot:
- Consider using a privacy-protective alternative; or
- Use with appropriate policies
- Review and understand your AI provider ToS/Privacy policy
- Sign up for provider updates, pay careful attention
- Put teeth into the personal AI system ban but be realistic
- FRE 502(d) orders and ESI protocols for AI-assisted workflows
- Include discovery concerns in all AI use policies and training
- Add AI prompts/outputs to preservation letter
- Adjust legal hold protocols to cover AI use
- Use FRE 502(d) order to protect against waiver of privilege through your own AI use
- But also include in the ESI protocol and obtain a protective order against having your production dumped into AI
- Revise expert agreements to protect against production of AI prompts/outputs
