What happens to privilege when a law firm uses a third party AI tool?

Privilege is not automatically waived when a firm puts client material into a third party product, and it is not automatically preserved either. The question courts and bar authorities keep returning to is whether the firm took reasonable steps to keep the material confidential, which makes most of the analysis a set of facts a buyer can check before signing rather than argue about afterwards. The AI Legal Index grades 130 legal AI vendors on Privilege and Confidentiality Posture and records three of those underlying facts separately. Across the index, 8 vendors publish a confidentiality position an outsider can verify end to end, 6 of 130 document that retrieval enforces the firm's own access model at query time rather than a second permission system, and 33 of 129 commit in their terms to telling the customer when a third party asks for its data. 79 publish nothing on that last question at all, which means a firm using them would learn about a subpoena to its vendor after the material had already gone.

This page is not legal advice and does not tell a firm whether privilege survives any particular deployment. That answer depends on the jurisdiction, the matter and the facts, and it belongs to the firm and its own counsel. What an index can do is narrow the question to the part a buyer controls, which is the evidence a vendor publishes before anyone signs anything. Three records carry most of that weight: the ethical wall posture, the subpoena notice commitment, and whether the agreement addresses privileged material at all.

What a vendor signs privately, the index cannot see, so what it grades is what the vendor publishes: whether the agreement a buyer can read before signing addresses privileged and work product material directly rather than treating it as ordinary customer content. 8 vendors record an A on Privilege and Confidentiality Posture: Alexi, Casepoint, Eve, Everlaw, GC AI, Noxtua, Patlytics and Solve Intelligence. A further 58 carry substantive published commitments with one real gap, usually a segregation or retention term stated in a trust page rather than in the agreement. 50 make the claim without publishing the document behind it, and 14 publish nothing on the question a buyer can check. A firm can still negotiate a bespoke confidentiality term with any vendor here. The grade records what was on offer without asking.

6 of 130 vendors document that retrieval enforces the source document system access model at query time, per user and per matter: Casepoint, CosmoLex, DeepJudge, Harvey, MyCase and Vincent AI. That is the posture that leaves an existing ethical wall intact, because the wall keeps being enforced by the system that already maintains it. 26 maintain their own permission model and document it, which works and moves the burden onto the firm to keep two access models in step. 29 assert segregation in public materials with no published detail on how it is enforced, and 69 publish nothing on walls or matter level segregation. A retrieval layer that indexes the whole corpus and answers from all of it defeats a wall silently, and the failure surfaces as a conflict rather than as an error message.

Full definitions of every value on this signal are on the signals reference, and each vendor profile carries the source and the verification date behind its recorded value.

Three limits, stated plainly, because a low grade here is a statement about disclosure and would be misread as a finding about the product. A negotiated engagement term or a signed confidentiality agreement is a private document, so a vendor that grants a firm exactly what it asked for in a bespoke contract records only what it published. A vendor that answers these questions well in a security questionnaire and publishes nothing grades on the published position. And an absence is dated: it means not located in public sources on the date shown, and a vendor that publishes a term tomorrow is redated the day it does. A signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.

What none of that changes is the buyer’s position. A commitment that exists only in a sales conversation leaves no artifact, and an artifact is what a firm hands to its own risk committee, its malpractice carrier, or a court asking what reasonable steps were taken.