Use AI and lose privilege?

Generative artificial intelligence is now part of ordinary business and legal practice. It can assist with summaries, drafts, chronology work and first-pass analysis. Its convenience, however, gives rise to a real privilege risk where confidential or legally privileged material is entered into a public AI tool.

We discuss two recent overseas decisions that provide useful reference points to illustrate how Australian Courts may apply conventional privilege principles to the use of public AI systems.

Why does using public AI create a privilege risk?

The legal issue is not whether AI is useful. It plainly can be. The issue is whether the way in which the tool is used is consistent with maintaining confidentiality.

In Australia, legal professional privilege protects confidential communications and documents made or prepared for the dominant purpose of giving or obtaining legal advice, or for use in existing or anticipated litigation. The dominant purpose test was confirmed by the High Court of Australia in Esso Australia Resources Ltd v Commissioner of Taxation (1999) 201 CLR 49.

Privilege may also be lost. In Mann v Carnell (1999) 201 CLR 1, the High Court confirmed that waiver depends on whether the privilege holder has acted inconsistently with maintaining the confidentiality which privilege exists to protect. The subjective intention of the privilege holder is not decisive.

That framework is important when considering public AI tools. If privileged material is uploaded to a system that may retain, review, reuse, disclose or train on that material, the question becomes whether the user has acted inconsistently with maintaining confidentiality. The same point is reinforced by Glencore International AG v Commissioner of Taxation (2019) 265 CLR 646, where the High Court treated legal professional privilege as an immunity from compulsory production, rather than a standalone cause of action, and observed that equity may protect confidential privileged material where confidentiality remains available to be protected.

Can privilege be waived by uploading confidential material to public AI?

In UK and R (on the application of Munir) v Secretary of State for the Home Department[2026] UKUT 81, the Upper Tribunal (Immigration and Asylum Chamber) considered the conduct of legal representatives in proceedings where false authorities had been cited and where AI use was suspected. The Tribunal emphasised that legal representatives must ensure that legal arguments and authorities placed before the tribunal are factually and legally accurate.

The privilege point was expressed in direct terms. The Tribunal stated that uploading confidential documents into an open-source AI tool, such as ChatGPT, is to place that information on the internet in the public domain, thereby breaching client confidentiality and waiving legal privilege.

For Australian purposes, Munir is probably best seen as a waiver warning. It assumes that the relevant material is already confidential or privileged and asks what happens when that material is uploaded to a public AI platform. The answer given by the Tribunal is that confidentiality is lost and privilege is waived.

In Australia, as you would expect, if the conduct is objectively inconsistent with maintaining confidentiality, the waiver analysis in Mann v Carnell is engaged. The stronger the evidence that the public AI tool may retain, reuse, disclose, process or train on the material, the harder it will be to maintain that privilege was preserved.

Can AI-generated material fail to attract privilege in the first place?

In United States v Heppner, No. 25 Cr. 503 (JSR), 2026 BL 52143 (S.D.N.Y., 17 February 2026), the defendant used Anthropic’s Claude platform to prepare documents addressing possible defence strategy and legal arguments after receiving a grand jury subpoena and retaining lawyers. He later shared those documents with his lawyers and asserted attorney-client privilege and work product protection over them.

The United States District Court for the Southern District of New York rejected that claim. Judge Rakoff held that the communications were not with an attorney, were not intended to be and were not in fact kept confidential, and were not made for the purpose of obtaining legal advice from counsel. The Court also rejected work product protection because the documents were not prepared by counsel or at counsel’s direction.

The significance of Heppner is different from Munir. It is not principally a waiver case, but instead a case about whether privilege or work product protection attaches in the first place. A document is not privileged merely because it concerns a legal topic or because it is later provided to lawyers. The legal character of the document depends on the purpose, confidentiality and circumstances of its creation.

That distinction matters in Australia. A client, insured, director, claims handler or employee who independently uses a public AI tool to create material about a claim or dispute may later face a threshold privilege issue. The question may not be whether privilege was waived. It may be whether there was ever a communication or document made for the dominant legal advice or litigation purpose recognised in Esso.

What should Australian businesses, insurers and claims teams be worried about?

The risk is acute in contentious matters. Public AI tools may be used to summarise counsel’s advice, review a solicitor’s report, analyse a claim file, prepare a mediation position, convert a coverage advice into a board update or identify issues from discovered documents. Each use may involve confidential or privileged material.

The risk is not confined to lawyers. A client, insured, broker, claims handler, expert, consultant, director or board member may use a public AI tool without appreciating the privilege consequences. If privileged material is uploaded, the privilege holder may later need to explain why that conduct was not inconsistent with confidentiality.

There are also related privacy and data security issues. Legal and insurance files frequently contain personal information, sensitive information, health information, financial material and commercially sensitive documents. Even if a privilege dispute never arises, use of a public AI tool may create privacy, contractual confidentiality, regulatory and reputational issues.

What have Australian courts and professional bodies said about AI use?

Australian courts and professional bodies have already moved in this area. For example, the Supreme Court of New South Wales Practice Note SC Gen 23 identifies risks associated with hallucinated material, inaccurate references, confidentiality, privacy and legal professional privilege. It also restricts the use of generative AI in relation to evidentiary material and requires verification of authorities and evidentiary references in written submissions where AI has been used.

The Federal Court of Australia has also issued a generative AI practice note emphasising that the use of AI must be responsible and consistent with existing legal and professional obligations, particularly where court material, confidential material or protected information is involved.

The Law Society of NSW has warned that placing confidential client information into a publicly available generative AI system is akin to placing it in the public domain and may cause clients to lose privilege. That guidance is consistent with the duty of confidentiality under rule 9 of the Australian Solicitors’ Conduct Rules and with the obligations of competence, supervision and candor to the court.

What practical steps should lawyers, insurers and businesses take before using AI?

The use of public AI tools should be treated as impermissible where the input material is privileged, confidential, sensitive or produced as part of the Court process. That includes barristers’ advices, solicitor reports, expert drafts, coverage advices, claim strategy, discovered documents, subpoenaed material, material subject to suppression or non-publication restrictions and material subject to the implied undertaking in Harman v Secretary of State for the Home Department [1983] 1 AC 280.

There are two separate privilege risks. The first is the risk outlined in Munir: existing privileged material may be disclosed in a manner inconsistent with confidentiality, with the result that privilege is waived. The second is the risk outlined in Heppner: material generated through a public AI tool may never attract privilege at all if it was not created confidentially, for the requisite legal purpose and within or at the direction of the lawyer/client relationship.

That distinction matters in practice. If a lawyer uploads counsel’s advice to a public AI platform to prepare a summary, the likely issue is waiver. If a client independently uses a public AI platform to develop a litigation strategy note and later sends it to lawyers, the likely issue is whether the document ever had the character of privileged material. The fact that a document is later sent to lawyers should not be assumed to cure the circumstances in which it was created.

The safest operational rule is therefore simple. Do not input privileged, confidential, personal, sensitive or court-controlled material into public AI tools. If AI is to be used in a legal workflow, it should be confined to approved enterprise or legal AI tools where the data-use, access, retention, training, confidentiality and audit settings are known, documented and consistent with client terms, panel requirements and firm policy.

The supervision point is just as important. Internal policies should deal not only with whether AI output can be used, but also with what material can be entered into the tool in the first place. Junior lawyers, claims staff, paralegals, experts and consultants need to understand that a prompt can disclose privileged material just as surely as an email can. Supervision should include input control, output verification and documented escalation for high-risk uses.

Finally, AI output should not be used as a substitute for legal judgment. Authorities, quotations, statutory references, procedural statements and evidentiary references must be checked against reliable legal sources. Nor should AI be used to verify its own work. The practical discipline here is the same as the privilege discipline itself. Retain control over the process, retain control over the information, and do not confuse convenience with confidentiality.