AI and client confidentiality collided in a federal courtroom in February 2026, when Judge Jed S. Rakoff of the Southern District of New York ruled that using a public AI chatbot negated attorney-client privilege in United States v. Heppner, not because the lawyer did anything reckless, but because the tool itself made confidentiality structurally impossible. The defendant had used Anthropic’s Claude to analyze his legal exposure, generated 31 AI-assisted documents, and shared them with his attorneys. The government moved to compel production. The court granted the motion. The documents were not protected. As a Southern District ruling, Heppner is not binding nationwide, but it is already shaping how courts and bar associations think about AI use and privilege, and every firm in the country should treat it as a serious warning.
Most firms don’t discover the conflict between AI use and client confidentiality until something goes wrong. The risks aren’t hypothetical. They’re embedded in the architecture of tools your team is already using: free-tier chatbots, browser extensions, and ad-hoc summarization workflows that get started before anyone asks whether it’s safe. Even confidential data that flows through marketing and intake systems can end up in public AI environments if outside vendors aren’t careful about how they handle it. At Thrive Business Marketing, our intake and data-handling processes are designed so that any information a law firm shares with us, case types, client demographics, intake details, stays in controlled environments and never touches a public AI system. That’s a standard every vendor in your ecosystem should be held to.
This article breaks down exactly where the risks live, what controls actually work, and how to build a firm-wide AI use policy your team will follow.
How AI and client confidentiality failures expose client data without warning
Most attorneys assume AI tools are neutral recipients of their inputs. They’re not. Consumer-tier AI products, ChatGPT Free, Plus, and Pro accounts, Claude’s individual plan, and Gemini’s personal tier, all default to using user inputs for model training. When an attorney pastes a client’s case facts into a prompt, that data can enter a training pipeline, making it potentially accessible through future model outputs for other users. Opting out of training requires navigating account settings that many users may not notice, and opting out doesn’t affect data that was already submitted before the change.
The distinction between consumer and enterprise accounts is critical. ChatGPT Team, Enterprise, and API accounts exclude inputs from training by default under a Data Processing Addendum. Anthropic’s Commercial Terms for business tiers explicitly prohibit training on customer content. Google’s Vertex AI enterprise contracts carry the same guarantee. But the free and individual-tier versions of these same tools carry none of those protections. If your attorneys are using personal accounts because the firm hasn’t set up enterprise access, your client data is almost certainly in a training pipeline somewhere.
The multi-tenant cloud problem
Even setting aside training data concerns, shared SaaS AI environments mean your firm’s prompts sit on the same infrastructure as other users. Logging, caching, and error review processes mean vendor staff can access that data. This isn’t a settings issue or a privacy policy nuance, it’s a fundamental architectural reality. Private deployment or VPC isolation materially reduces this exposure, and in many cases can eliminate it, but must be paired with contractual and operational controls to be effective.
AI and client confidentiality: prompt leakage and agentic AI risks
In agentic AI setups, where tools chain together to complete multi-step tasks, the risk compounds. System prompt injection, where a malicious or poorly structured input causes the model to surface system-level instructions or previously cached data, is a documented attack vector flagged in published security research and vendor advisories. If your firm uses AI agents with access to client documents, email threads, or intake records, a single vulnerable prompt can inadvertently surface confidential content in a generated output. This is especially dangerous because the leakage is invisible until it causes damage.
What courts and bar associations now require
The Heppner ruling rested on three facts that apply broadly: Claude is not an attorney; Anthropic’s privacy policy allowed disclosure of user inputs to third parties; and Heppner had no reasonable expectation of confidentiality when he used the tool. The court also held, on those facts, that transmitting non-privileged content to a lawyer after the fact does not retroactively restore privilege, though whether privilege can be restored is ultimately fact-specific and may vary across courts. If your attorneys are pasting case facts into a public AI tool, the resulting output may already be unprotected, regardless of what happens to it next.
One week before Heppner, the Eastern District of Michigan reached a different result in Warner v. Gilbarco, where a pro se litigant’s AI use was found protected under the work product doctrine. The split matters. Courts aren’t applying a new AI-specific rule, they’re applying existing privilege principles to the facts in front of them. The facts your attorneys create when they use a public AI tool are the ones that will determine the outcome if privilege is challenged.
ABA Formal Opinion 512 and what it actually requires
ABA Formal Opinion 512 (July 2024) confirmed that Rule 1.6 applies directly to generative AI use. If an AI tool poses a risk of direct or indirect disclosure of client information, lawyers must obtain informed client consent before inputting that data. Informed consent isn’t a checkbox on an engagement letter. The opinion requires lawyers to explain the specific kinds of data being disclosed, the tool’s data retention and training practices, the risk of inadvertent disclosure, and the safeguards in place. General boilerplate doesn’t satisfy the standard.
State bars have aligned consistently with this framework. California’s Practical Guidance (November 2023) requires anonymizing client information and informed written consent before using third-party AI. Florida Advisory Opinion 24-1 permits AI use only when the lawyer can reasonably guarantee confidentiality compliance. D.C. Ethics Opinion 388 and Pennsylvania’s Joint Formal Opinion 2024-200 both require strict security measures and client communication when AI is material to the representation. No jurisdiction has carved out an exception. A lawyer’s duty of confidentiality now explicitly includes understanding how the tools they use handle client data.
Technical controls that actually block accidental disclosure
The safest technical approach is to redact sensitive identifiers before any data reaches a language model. Client names, matter numbers, settlement figures, and personal identifiers should be stripped or tokenized at the retrieval stage, before the prompt is constructed and sent. Several LLM firewall tools scan prompts for sensitive patterns and block or mask them automatically, a category that includes dedicated AI data-loss prevention solutions designed specifically for legal and regulated environments. Data minimization reinforces this: give the model only what the task requires, nothing more. A model summarizing a deposition transcript doesn’t need the client’s name to produce a useful output.
Private deployment eliminates the multi-tenant risk at its source. In a private VPC or on-premises deployment, the model runs on infrastructure your firm controls, and data never crosses into vendor-accessible environments. This requires more setup than a SaaS subscription, but for firms handling high-value or sensitive matters, it’s the architecture that removes the exposure rather than just managing it. Pair private deployment with multi-factor authentication, role-based access controls, and AI tool access restricted to managed devices.
Logging, encryption, and output auditing
Encrypt data in transit with TLS and data at rest with AES. Use redacted logging: record that a prompt was sent, who sent it, and when, without storing the full sensitive payload. Set short retention windows for prompts and outputs, limiting the exposure window if a breach occurs. Routine output auditing, reviewing AI-generated content for accidental inclusion of sensitive terms before delivery, catches problems before they become incidents. These aren’t exotic controls. They’re standard data security practices applied to a new category of tool.
Vetting AI vendors before handing over client data
Many firms skip vendor due diligence for AI tools because they treat them like software subscriptions rather than data processors. That framing is wrong. Every AI tool your firm uses is a data processor with access to the information you feed it. The contract governs what they do with that information, and the default terms on consumer and small-business plans almost never favor the law firm.
Five contract clauses are non-negotiable for secure AI use in law firms:
- A zero-retention clause requiring data deletion after each processing session.
- A no-training guarantee explicitly prohibiting use of inputs and outputs for model improvement.
- A data residency clause specifying the jurisdiction and infrastructure where data is stored.
- Either a private deployment requirement or explicit written authorization for any SaaS architecture used.
- Audit logging rights giving the firm access to immutable records of all data access events.
Vendors that meet the bar and those that don’t
Enterprise-tier products from Anthropic (Claude for Work/Enterprise), OpenAI (ChatGPT Enterprise), and Google (Vertex AI enterprise contracts) can deliver these guarantees through negotiated addendums, typically combined with private deployment via AWS Bedrock with VPC Private Links or Azure AI with private endpoints.
Legal-specific tools including Advira, Sana Agents, Beveron, and Lawra’s Sovereign Suite are marketed as being built with private deployment and zero-retention architectures, claims worth verifying directly against their current contract terms and product documentation. By contrast, Harvey, CoCounsel, and Lexis AI have not, as of this writing, offered private deployment options; client data flows through their servers, creating a structural privilege risk that contract terms alone may not fully resolve. Confirm deployment options and retention policies directly with any vendor before onboarding.
The same due diligence applies to every outside partner that touches your firm’s data, not just your in-house AI stack. Intake forms, onboarding documents, and marketing questionnaires all carry client information. At Thrive Business Marketing, we specifically structure how law firm data flows through our systems so that sensitive information shared during a marketing engagement stays in controlled environments. Before you bring on any vendor, ask directly: where does our data go, who can access it, and can you put a zero-retention and no-training guarantee in writing?
Writing an AI use policy your firm will actually follow
A policy that lives in a shared drive folder is not a policy. The firms handling this well treat their AI use policy as a governance structure with enforcement mechanisms, not a document created to check a compliance box. The goal is a living policy that guides daily decisions, surfaces problems before they become breaches, and gives every attorney and staff member a clear answer to the question: “Can I use this tool for this task?”
Every firm AI and client confidentiality policy needs four core elements:
- An approved use case list defining what AI is permitted for: drafting routine correspondence, summarizing documents, preliminary legal research.
- A clear prohibition list specifying what can never go into a non-approved tool: client names, matter numbers, privileged communications, settlement figures, full case files.
- A verification mandate requiring attorney review and sign-off on all AI-assisted work product before filing or delivery.
- An approval process requiring written requests for any new AI application, reviewed by whoever owns AI governance at the firm.
Training requirements and incident response
New hires should complete AI policy training within 30 days of joining. All staff complete annual refreshers and sign an acknowledgment confirming they’ve reviewed the current policy. Training covers the practical risks: hallucinations and fabricated citations, knowledge cutoffs, data privacy exposure, and the non-negotiable rule that every citation in an AI-generated document must be verified in a real legal database before it goes anywhere. If a citation can’t be found, it gets removed, no exceptions.
Incident response needs the same specificity. When a suspected disclosure or fabricated citation is identified, work stops immediately. The attorney or staff member notifies the AI Lead within 24 hours. All logs and transcripts from the session are preserved. The AI Lead, working with firm management, determines whether the incident requires client notification, malpractice carrier notification, or bar reporting. Personnel must report suspected errors, unauthorized tool use, inaccurate summaries, and vendor security concerns through the same channel. The protocol only works if people know it exists and know what triggers it.
The firms that get this right aren’t avoiding AI
They’re the ones who audit their tools, demand the right vendor contracts, train their staff, and build policies that teams actually use. The Heppner ruling didn’t create new law. It applied existing privilege principles to facts that a law firm created by using a public AI tool without any confidentiality architecture. That outcome is entirely preventable.
Managing AI and client confidentiality requires action at every layer: the tools attorneys use daily, the vendors in your intake and marketing ecosystem, the training that keeps your team informed, and the contracts that hold your technology partners accountable. None of these layers work in isolation. Start with the controls in this article and work through each layer systematically. If you’re not sure where your firm stands on any of it, that uncertainty is your starting point.
Thrive Business Marketing works with law firms that hold every part of their operation, including their marketing partner, to the same data security standard their clients expect. If you want to understand exactly how our intake and data processes are structured before you engage, ask us. We’ll walk you through it.