Does uploading privileged documents to an AI tool waive attorney-client privilege?

It can. In United States v. Heppner (S.D.N.Y., February 2026), Judge Rakoff held that a defendant's exchanges with Claude weren't privileged, partly because Claude's consumer privacy policy allowed Anthropic to train on and disclose user data. The vendor's terms for your plan tier decide most of the risk.

What do ethics rules require before using AI for legal work?

Competence, confidentiality, client communication and reasonable fees, per ABA Formal Opinion 512 (July 29, 2024). In practice: understand the tool, read its data terms rather than its marketing, verify every output, and bill hourly work only for time actually spent.

What happened in Mata v. Avianca?

Two New York lawyers filed an opposition citing six decisions that ChatGPT had invented, then stood by them after the court asked for copies. On June 22, 2023, Judge Castel imposed a $5,000 penalty jointly and severally on both lawyers and their firm and ordered letters to each judge falsely named.

What should a legal department look for in an AI vendor contract?

A written commitment not to train on your inputs or outputs, a data processing agreement naming every subprocessor, deletion on termination, and the plan tier the terms apply to. Consumer and business plans of the same product often run on different terms.

Can a general counsel approve AI tools for the whole legal department?

Yes, if the review is documented and covers data handling, not just price. California's 2026 guidance says managerial lawyers should set clear AI policies, including for agentic tools, and train staff periodically.

AI governance for legal teams: privilege and confidentiality

Q: Do federal courts require AI disclosure in filings?

Some judges do; there's no single federal rule. The Fifth Circuit decided in 2024 not to adopt an AI rule. In the Southern District of New York and the Northern District of California, the AI requirements we found come from individual judges' rules, so check the assigned judge's practices before each filing.

Image: Pexels, used under the Pexels License.

If you run a legal team, you don't need a new rulebook for AI. Competence, confidentiality, supervision and candor to the court decide almost every question, and the bar opinions published since 2024 say exactly that. What's new is where the risk turns up: in a vendor's privacy policy, in a chat log a court can order produced, in one judge's standing order.

So the checklist comes first, then the sources behind each line. We rewrote this guide on October 15, 2026, after finding four legal errors in the earlier version; the correction note at the end lists them.

The legal department AI checklist

Name one owner. A senior lawyer, usually the general counsel, owns the approved-tools list and signs off on each vendor review.
List approved tools by plan tier, not by vendor. The same product can sit on different terms. OpenAI says it may use content from its Free, Plus and Pro plans to train its models unless the user opts out, while ChatGPT Business, Enterprise, Edu and the API aren't used for training by default. Put the tier on the list.
Read the terms, not the brochure. California's 2026 guidance says reasonable efforts "require more than reliance on generalized marketing assurances" and may mean reading the terms of use and privacy policy. Record what you read and the date.
Ask for segregation and keep watching. New York's bar task force tells lawyers to get assurance that the provider will keep each client's information segregated, and to monitor the provider for changes.
Verify every citation and quotation against the source before it's filed or goes into client advice. No exceptions for "just a draft."
Before every filing, read the assigned judge's individual rules and the court's local rules for an AI section. Some judges want a signed certificate.
Keep prompt records on litigated matters. At least one federal magistrate judge already requires it (details below), and they're cheap to keep.
Fence in agents. If a tool can open email, the document system or client files on its own, limit what it can reach, and don't let it send anything outside the firm without a person reviewing it first.
Write the billing rule down. Hourly bills reflect time actually spent, even when AI made the task faster.
Train staff and log the training. Then plan for the bad day: who tells the court and the client when an AI error turns up after filing.

What the ethics rules say

Every source below lets lawyers use AI. None of them creates a technology exception. Dates are publication dates.

Source	Date	What it means for a legal team
ABA Formal Opinion 512	July 29, 2024	ABA's first formal opinion on generative AI. Model Rules 1.1 (competence), 1.6 (confidentiality), 1.4 (communication) and 1.5 (fees) principally apply. In most cases you can't charge a client for learning a tool.
California State Bar, Practical Guidance	First issued November 16, 2023; revision approved May 14, 2026	The 2026 version replaces the 2023 one and adds agentic AI. Read terms and privacy policies; limit agents' access to firm systems; hourly billing reflects time actually spent.
NYSBA Task Force on AI report	Approved April 6, 2024	Get assurance the provider protects and segregates each client's information; monitor the provider for changes.
Florida Bar Ethics Opinion 24-1	2024	Lawyers may use generative AI but must protect client confidentiality, provide accurate and competent services, avoid improper billing and follow advertising rules.
D.C. Bar Ethics Opinion 388	April 2024	If a product saves what you type or lets it shape answers to outside users, use a different product, negotiate better terms, or enter only non-confidential data.
Texas Opinion 705	February 2025	Always verify outputs. Lawyers answer for their work product "regardless of who (or what)" did the research and drafting.

On supervision, California's guidance says managerial lawyers "should establish clear policies regarding the uses of generative AI, including more autonomous or agentic AI tools," and staff should get periodic training. On agents it's blunt. A lawyer "must not deploy an agentic AI system in a manner that permits autonomous external transmission of client information" without safeguards and human review. Texas makes the same point about verification from the other side: relying on AI for research carries "many of the same perils" as relying on an inexperienced or overconfident nonlawyer assistant.

Privilege: the chat log problem

On February 10, 2026, Judge Jed S. Rakoff of the Southern District of New York ruled from the bench in United States v. Heppner that a criminal defendant's written exchanges with a generative AI platform were not protected by the attorney-client privilege or the work product doctrine. His memorandum giving the reasons was filed on February 17. The platform was Claude, and the confidentiality part of the reasoning rests on the vendor's own terms:

Excerpt from Judge Rakoff's February 17, 2026 memorandum in United States v. Heppner on Claude's privacy policy

Screenshot: United States v. Heppner, 25 Cr. 503 (JSR), memorandum of February 17, 2026, S.D.N.Y. (ECF 27), via CourtListener.

That's why item 2 of the checklist sorts tools by plan tier. A court reading your vendor's consumer privacy policy will find the same kind of language Judge Rakoff quoted. We'd treat the ruling as the floor for planning rather than the last word: it's one district judge in a criminal case. Our Heppner explainer covers the work product half.

Lawyers argued about it on r/Lawyertalk in July. "Using the consumer version (tells you it isn't confidential) vs the enterprise version (is not used to train, remains confidential) is certainly a choice," wrote East-Construction894. Others thought the ruling went too far. Madroc92 called it wrongly decided, then described a policy that already follows the checklist: "My firm allows use of the closed, enterprise-licensed Microsoft Copilot, which doesn't share data or train its model on our data."

https://www.reddit.com/r/Lawyertalk/comments/1usi97w/us_v_heppner_client_drafted_defense_strategy_in/

Court AI rules: what's actually in force

There's no single federal AI filing rule. What exists is a patchwork, mostly judge by judge.

The Fifth Circuit decided not to adopt one. It proposed an AI rule for briefs, took comments, and then posted its decision on June 10, 2024, as Bloomberg Law reported:

The Fifth Circuit's notice declining to adopt a special rule on AI in drafting briefs

Screenshot: "Court Decision on Proposed Rule," U.S. Court of Appeals for the Fifth Circuit.

The last line is the one to remember. No rule doesn't mean no risk; it means the ordinary rules on accurate filings apply in full.

In the Southern District of New York, the requirements we found come from individual judges. Judge Vernon S. Broderick, for example, posted a model certificate on October 29, 2025. The filer certifies that an AI tool was used, says who reviewed the filing for accuracy, and describes the steps taken to verify every cited authority; non-compliance "may result in sanctions, the document being stricken, or other remedies."

The Northern District of California works the same way. Magistrate Judge Susan van Keulen's standing order, updated February 2026, makes a signature on any filing with AI-generated content a certification that the content was personally verified, says the court "will impute any errors by such AI tools" to the signer, and requires counsel to keep "records of all prompts or inquiries submitted to any generative AI tools."

Those two are examples, not a list. Judges add and revise these rules, so the check belongs in every filing workflow (item 6).

What Mata v. Avianca actually decided

Roberto Mata sued the airline Avianca. On March 1, 2023, his lawyers filed an opposition citing decisions that ChatGPT had made up, six of them in the end: "Varghese," "Shaboon," "Petersen," "Martinez," "Durden" and "Miller." Avianca's reply questioned whether the cases existed, and in April the court ordered copies. According to the court, the lawyers "doubled down and did not begin to dribble out the truth until May 25."

On June 22, 2023, Judge P. Kevin Castel sanctioned Peter LoDuca, Steven A. Schwartz and their firm, Levidow, Levidow & Oberman. He found bad faith by the two lawyers, held the firm jointly responsible under Rule 11, and imposed a $5,000 penalty on the three of them jointly and severally, plus letters:

The conclusion of Judge Castel's June 22, 2023 sanctions order in Mata v. Avianca

Screenshot: Mata v. Avianca, Inc., 22-cv-1461 (PKC), Opinion and Order on Sanctions, S.D.N.Y. (ECF 54), page 34, via CourtListener.

The penalty was small. The letters, to Mata and to every judge falsely named as an author, were the humiliating part. Read the opening of the order before you write your AI policy: there is "nothing inherently improper about using a reliable artificial intelligence tool for assistance," but "existing rules impose a gatekeeping role on attorneys." The court said the record "would look quite different" if the lawyers had come clean once the cases were questioned. Standing by them drove the sanction as much as filing them. Later orders are in our hallucination sanctions tracker.

The contracts that need AI language

These are our recommendations for the documents a legal department signs or owns, not legal requirements.

Vendor agreements for AI tools. Ask for notice before model changes that materially affect output (a month gives you time to re-test), a right to terminate without a cure period if the vendor trains on your data without written consent, and indemnity for IP claims over generated output. Our agentic AI contract clauses go further.

Data processing agreements. Confirm the DPA covers what the AI system actually does with data, names every subprocessor including the model provider underneath, and rules out training outside the services you pay for.

The employee acceptable use policy. Ban client and confidential data in tools that aren't on the approved list, and require staff to flag AI use in court filings and regulatory submissions so item 6 can happen.

NDAs. Say that entering the other side's confidential information into an AI tool without a DPA in place counts as disclosure to a third party.

Customer terms. If your product uses AI with customers, say so, say what data it processes, and say the output isn't professional advice.

Insurance. Ask your broker in writing whether your E&O and D&O policies cover claims arising from AI-assisted work, and keep the answer.

What this guide doesn't cover

State court rules and non-US courts are outside this check; we read federal court sources only. ABA Formal Opinion 512's own PDF refused our requests, so the row above relies on the ABA's announcement of the opinion. We didn't review later filings in Heppner. Bar guidance from states not in the table may differ.

Correction, October 15, 2026: an earlier version said "New York State Bar Association Opinion 1253" addressed AI confidentiality; Opinion 1253 (February 27, 2023) is about conflicts of interest among family members, and the New York guidance above is the bar's April 2024 task force report. It said the Southern District of New York and the Northern District of California require attorneys to certify AI-generated content court-wide; the requirements we found come from individual judges. It said the Fifth Circuit has standing orders on AI in briefs; the Fifth Circuit decided in June 2024 not to adopt an AI rule. It said the Mata court "sanctioned all of them"; the order imposed one penalty jointly on two lawyers and their firm, plus letters. We also removed an unsourced claim that Lloyd's syndicates and AIG sell AI hallucination cover.