AI confidentiality risks for lawyers are built into the default settings of tools most attorneys are already using today, and most firms haven’t caught up to that reality. Many lawyers using AI tools right now are operating under a false assumption: that their client data stays private. It doesn’t. Not by default. Free tiers across every major AI platform retain conversation history, use that data to improve their models, and have already been linked to real incidents of data exposure. Even paid tiers require deliberate configuration to get anywhere close to actual confidentiality protections. That gap between what lawyers assume and how these systems actually work is where the risk lives.
This isn’t a reason to panic or abandon AI entirely. It is a reason to understand exactly what’s happening when you paste a case summary into a chatbot. By the end of this article, you’ll know where client data actually goes, what the bar requires of you right now, what technical controls work, and how to build a simple AI use policy your firm will actually follow.
Why “private” and “confidential” don’t mean the same thing to AI vendors
Privacy settings control what other users see. Confidentiality is a legal standard that requires active, contractual protection of your client’s information. Most AI vendors are built for the first. None of them are built for the second by default.
What free-tier AI tools do with your prompts
Free versions of ChatGPT, Google Gemini, and Microsoft Copilot retain your conversation history indefinitely unless you manually delete it, and by default, they use that data to improve their models. A lawyer typing a deposition summary into the free version of any major AI tool is feeding that information into a system they no longer control. The data has left the building. There’s also a specific complication with OpenAI: a federal court order, stemming from the NYT v. OpenAI copyright litigation, requires the company to preserve ChatGPT conversations, including deleted ones, for the duration of that legal hold. Deleting a conversation from your view doesn’t delete it from their servers.
How paid tiers change the equation (and where they still fall short)
Enterprise and business-tier subscriptions for ChatGPT, Google Workspace, and Copilot for Microsoft 365 do opt users out of model training by default and offer zero-data-retention options. That’s a meaningful improvement. But those protections aren’t automatic. They require deliberate configuration by an admin, and zero-data-retention is available primarily through API or business accounts, not standard consumer plans. Buying a paid seat doesn’t automatically make your prompts confidential.
The false comfort of “I deleted it”
Standard deletion across major AI vendors removes the chat from your view but typically takes around 30 days to purge from backend systems, and that window varies by vendor and product. It can be extended further by legal holds or court orders. For lawyers, this matters: a confidentiality breach doesn’t wait for you to realize it happened.
AI confidentiality risks for lawyers: the three pathways client data actually leaks
These aren’t theoretical attack scenarios. They are structural features of how AI systems work, and lawyers are running client data through them every day.
Model training ingestion
When a lawyer pastes a client memo, intake form, or deposition summary into an AI tool that uses data for training, that information can be memorized by the model. Published studies on LLM memorization, including research by Carlini et al., confirm that large language models can reproduce verbatim PII, including names, addresses, and private correspondence. The Samsung incident is the clearest documented example: engineers shared confidential source code with ChatGPT, and that data was incorporated into the model’s training pipeline with no mechanism to retrieve or delete it. Following the incident, Samsung restricted employee use of ChatGPT internally. Treat pasting a client file into a public AI tool the same way you’d treat faxing it to a shared office printer in a building you don’t own.
Third-party API chains
Many AI-powered legal tools, including document summarizers, contract reviewers, and research assistants, are built on top of major AI models through APIs. When client data passes through these tools, it doesn’t always stay with that tool’s vendor. It travels to the underlying model provider as well. Firms often have no visibility into this chain and no data processing agreement with the underlying model. The legal tool you signed up for may be a pass-through to a system you never evaluated.
Cloud storage defaults and cross-matter access
Even in enterprise environments, AI tools configured without proper access controls can allow data from one client matter to surface in a query related to another. Retrieval-augmented generation (RAG) systems retrieve information based on semantic similarity, not document ownership. Without explicit privilege-level tagging at the document level during ingestion, the AI may retrieve and present privileged communications from unrelated matters when responding to a query about a different client. This isn’t a bug. It’s the system working exactly as designed, without the safeguards it needs for a legal context.
What bar ethics actually require right now
The bar has already drawn the line. Many firms continue to wait for additional guidance, but waiting for “more clarity” isn’t a defensible position when current obligations are already on the books.
ABA Formal Opinion 512: the baseline every firm must meet
Issued in July 2024, ABA Formal Opinion 512 addresses AI use directly under Model Rule 1.6. It requires informed client consent before a lawyer inputs confidential information into a self-learning generative AI tool. That consent must include the lawyer’s own explanation of the risks: which information will be disclosed, how others might use it, and what safeguards are in place. Boilerplate language buried in an engagement letter doesn’t satisfy this requirement. The opinion also triggers disclosure obligations when AI use is novel, material to the representation, or affects billing.
How state bars are adding teeth
Several states have gone further than the ABA baseline. New York’s Formal Opinion 2025-6 specifically covers AI transcription of client meetings and requires explicit client consent. Florida’s Advisory Opinion 24-1 mandates reasonable precautions, including researching the AI tool’s own data policies before use. California’s proposed Rule 1.6 amendment would make AI-related confidentiality violations a direct rule breach rather than an interpretive question. As of mid-2026, no AI-specific disciplinary cases have been published, but that is unlikely to remain true as adoption grows. Law firms that establish proper controls now won’t be caught justifying inaction after a breach forces the issue.
Mitigating AI confidentiality risks for lawyers: technical controls that actually work
This section isn’t a security checklist. It’s the minimum a law firm needs to function responsibly with AI tools, covering what to require from vendors, how to structure access, and where redaction falls short.
Encryption and zero-retention agreements
Any AI vendor a firm works with should meet a clear baseline: AES-256 encryption at rest, TLS 1.3 in transit, and a written zero-data-retention agreement. Zero-data-retention means inputs and outputs are never logged beyond the immediate session. That commitment must be contractual, not assumed from a marketing page. SOC 2 Type II certification is a widely recommended procurement standard in legal technology guidance, and if a vendor can’t produce a SOC 2 report and a signed DPA with explicit zero-retention language, they aren’t ready for legal work.
Access controls and audit trails
Role-based and attribute-based access controls restrict which AI tools can access which client files. This mirrors the conflict-of-interest walls firms already maintain; the AI infrastructure needs to reflect those same boundaries. Audit trails must record what the AI accessed, under whose authorization, and what it produced. Those records must be tamper-evident and matter-specific. This documentation isn’t just a security measure; it’s what a firm needs to demonstrate supervisory compliance under Model Rule 5.3.
Query blocking over smart redaction
For privileged documents, the correct default is block, not redact. Replacing a client name with a token still transmits a privileged document to an external AI model. The content is still there. Deploy an AI gateway that automatically detects and blocks sensitive client data from reaching unauthorized platforms in real time. Simple tokenization is not sufficient protection when privilege requires zero transmission of the underlying content.
Building a simple AI use policy your firm will actually follow
A 20-page policy document no one reads is the same as no policy. The goal is something enforceable, specific, and short enough that attorneys and staff will actually consult it.
The four non-negotiables every policy must include
Four clauses cover the essential ground. First, prohibited inputs: confidential client information may never be entered into an unapproved AI tool, period. Second, an approved tool list: attorneys may only use vetted tools that meet the vendor standards described above. Third, a human review mandate: AI output may not be filed, sent to clients, or used in representations without attorney verification. Fourth, a disclosure obligation: the firm’s use of AI must be disclosed in the engagement letter with affirmative client consent for privileged work. These four clauses address competence, confidentiality, supervision, and disclosure under the ABA Model Rules without requiring a policy that reads like a software license.
Engagement letter consent language that works
The Virginia Bar Association’s Model AI Policy provides the most directly usable template. A workable consent clause reads something like this: “The Firm may use approved artificial intelligence platforms to conduct research, develop work product, or otherwise assist in providing services. The Firm employs reasonable measures to protect against the improper disclosure of client confidential information and will not knowingly include identifiable client confidential information in any interaction with an AI system such as an open large language model.” Keep it readable by clients, not just by lawyers reviewing it. The clause should specify what tools are used, what safeguards are in place, and that the firm won’t knowingly input identifiable confidential information into public AI systems.
The marketing vendor blind spot most law firms miss
Every internal AI risk discussion matters. So does the one most firms skip entirely: the vendors managing their marketing, intake systems, and advertising.
Why your marketing agency’s AI is part of your risk profile
Law firms share significant data with their marketing partners: intake form responses, consultation request details, client demographics, and practice area inquiries. If a marketing vendor feeds that data through a public AI system without a zero-retention agreement or proper data siloing, the firm has a confidentiality problem it didn’t create but still owns. The bar doesn’t distinguish between a confidentiality breach caused internally and one caused by a vendor. Your exposure is the same either way.
How Thrive Business Marketing structures AI-assisted marketing to keep client data siloed
Thrive Business Marketing works exclusively with law firms and builds its AI-assisted marketing specifically around legal industry data sensitivity. Thrive designs its systems so that marketing operations, intake tracking, and ROI reporting run in a closed-loop environment, keeping AI-supported functions separate from client matter details and intake responses. For firms evaluating their full risk surface, the marketing vendor relationship deserves the same due diligence as any internal AI tool. Ask any vendor you’re considering how they handle intake data, whether they’ve signed a DPA, and whether their AI tools are subject to zero-retention agreements. A vendor that has never considered attorney-client privilege in its data architecture is a liability, regardless of how strong their campaign results look.
The bottom line
AI confidentiality risks for lawyers are not hypothetical. They are built into the default settings of tools many lawyers are already using today. The bar has been clear: informed consent, adequate safeguards, human oversight. Those aren’t aspirational guidelines, they’re current obligations under ABA Opinion 512 and a growing stack of state-level guidance.
The framework in this article gives your firm what it needs to assess its current exposure, tighten vendor controls, and put a workable AI use policy in place. The technical controls exist. The policy templates exist. The only variable is whether your firm treats this as a priority now or waits until a breach makes it one.
Law firms that act now won’t be caught justifying inaction after a breach forces the issue. That’s the better position to be in, and it’s not a difficult one to reach.