Artificial intelligence has quickly become part of everyday business. It's used to summarize documents, draft communications, and analyze complex issues in seconds. 

It has also created a new risk that many organizations have not fully considered: what happens when someone uploads privileged legal advice to an AI platform or asks it for legal advice?

In Canada, privilege is one of the legal system's most closely protected safeguards. It exists so clients can communicate candidly with their lawyers and receive legal advice without fear that those communications will later be disclosed. The protection depends on maintaining confidentiality.

That is where AI enters the picture.

When people paste legal opinions, emails from counsel, draft pleadings, investigation summaries, or settlement strategies into an online chatbot (or ask it legal questions), they are often focused on getting a quick answer. Few stop to consider where that information is stored, who may access it, how long it is retained, or how it may be used by the platform. Those questions matter because they go directly to the confidentiality that privilege is designed to protect. 

By way of example, I had a case a few years ago that involved the breach of non-solicit and non-compete provisions by the Defendant corporation. One of the shareholders of this closely held company turned to a legal chatbot for advice about what they had done and he, let's say, over-shared with the chatbot. None of it was confidential and any privilege was waived by posing the questions to the chatbot. I found a log of the entire conversation online when I was preparing to question the corporate representative. The Plaintiff got a good settlement soon after. 

To be clear, no Canadian court (as far as I am aware but correct me if you think I'm wrong) has yet provided a definitive answer on whether entering legal advice into a generative AI platform automatically waives privilege. But that uncertainty should not be comforting. If privileged information is disclosed to an external platform, an opposing party may argue that confidentiality has been compromised and that privilege has been lost. Even if that argument ultimately fails, the resulting dispute may be expensive, distracting, and entirely avoidable.

The analysis is not the same for every platform. A public consumer chatbot presents different risks than a properly configured enterprise system operating under negotiated contractual protections, restricted retention policies, controlled access, and robust security measures. But the existence of additional safeguards does not eliminate risk. 

Organizations should understand exactly how a platform handles information before uploading legal advice to it.

Even if privilege ultimately survives, organizations may still face issues relating to confidentiality obligations, privacy requirements, cybersecurity policies, contractual restrictions, or professional duties. The legal question is not always limited to privilege.

AI can be an extraordinarily useful business tool but it needs to be carefully used. Until an AI platform has been vetted by legal, information security, and governance stakeholders, legal advice, settlement strategy, investigation materials, and communications with counsel are usually better left out of the prompt box.

Technology is evolving quickly. The principles underlying solicitor-client privilege are not. Organizations that understand the difference will be better positioned to capture the benefits of AI without creating unnecessary legal risk. Don't be the one to let the cat out of the bag!

Disclaimer: This article provides general information only and does not constitute legal advice. The privilege implications of using AI tools are fact-specific and depend on the particular platform, contractual terms, security controls, and circumstances of disclosure. Organizations should obtain legal advice regarding their specific situation before sharing privileged or confidential information with any AI system.

Craig Alcock is a commercial litigator who advises businesses on complex disputes, risk management, and efficient dispute resolution strategies focused on achieving practical outcomes.