AI-Assisted Docs Can Kill Attorney-Client Privilege

Did a court really say AI-generated documents lose attorney-client privilege?

Yes. A New York federal court ruled in early 2025 that documents created using consumer AI tools are not protected by attorney-client privilege or the work product doctrine. That is not a hypothetical risk or a legal theory someone floated at a conference. It is a ruling that opposing counsel can now cite to compel disclosure of your AI-assisted legal materials in litigation.

For SMB owners, this is the kind of detail that gets missed until it costs you. Most small business operators are using AI tools every day on exactly the kinds of documents this ruling targets: contract drafts, HR policy write-ups, responses to regulatory inquiries, internal legal memos, and communications about disputes.

What exactly did the court decide?

The court's reasoning centered on a straightforward principle: attorney-client privilege protects confidential communications between a client and their attorney. When you introduce a third-party AI tool into that process, you may be breaking the confidentiality chain that the privilege depends on.

The work product doctrine, which protects materials prepared in anticipation of litigation, ran into the same problem. If a consumer AI platform processed the content, the court found that protection does not automatically follow.

The practical read: typing your legal strategy into ChatGPT and asking it to refine your memo is not the same as talking to your lawyer in a private room.

This matters because attorney-client privilege is not just a technicality. It is the legal protection that lets you speak candidly with your attorney and develop strategy without fear that the other side will see your thinking. Waive it, even unintentionally, and your internal analysis becomes discoverable evidence.

Which AI tools trigger this risk?

The ruling specifically flagged consumer AI tools. That is an important distinction worth understanding before you assume your setup is safe.

| Tool Type | Example | Privilege Risk Level | |---|---|---| | Consumer AI (default settings) | ChatGPT Free, Claude.ai free tier | High: data may be used for training, third-party processing applies | | Enterprise AI with DPA | ChatGPT Enterprise, Claude for Enterprise | Lower, but not zero: verify your data processing agreement | | On-premise or private deployment | Self-hosted LLMs, Azure OpenAI with private config | Lowest: data does not leave your environment | | Attorney-managed AI tools | Tools run by your law firm under privilege | May preserve privilege if properly structured |

The key variable is whether a third party is processing your confidential content. Consumer tiers of major AI products typically include terms that allow the provider to use your inputs to improve their models, or at minimum route your data through external infrastructure. Either of those facts can be enough for a court to find that confidentiality was broken.

What kinds of SMB documents are actually at risk?

This is where most business owners underestimate their exposure. The documents at risk are not just formal legal filings. Think about what your team actually does with AI tools on a given week.

• Drafting responses to a customer lawsuit or demand letter
• Writing or revising employment agreements and termination letters
• Creating internal policy documents that touch on compliance
• Summarizing legal advice from your attorney so you can share it with a manager
• Preparing talking points for a difficult regulatory audit
• Drafting communications about an ongoing dispute with a vendor or partner

Each of those tasks, run through a consumer AI tool, could potentially be discoverable if litigation follows. And litigation follows more often than most small business owners expect. According to the U.S. Chamber Institute for Legal Reform, small businesses face a disproportionate litigation burden relative to their size and resources.

Does this mean SMBs should stop using AI on legal work?

No. It means you need a clear policy about which AI tools are used for which categories of work, and you need that policy before something goes sideways.

The answer is not to ban AI from legal workflows. AI can genuinely accelerate contract review, policy drafting, and compliance research. The answer is to treat legal and sensitive work as a separate category with its own tool requirements and review process.

Here is a practical framework:

Low-sensitivity work (public-facing copy, general research, non-confidential drafts): standard consumer AI tools are fine.

Medium-sensitivity work (HR documentation, vendor contracts, internal policy): use enterprise-tier tools with a signed data processing agreement, and have counsel review before finalizing.

High-sensitivity work (anything touching active or anticipated litigation, regulatory investigations, attorney communications): do not use consumer AI. Either use attorney-managed tools, a private deployment, or do not use AI at all. Run everything through your attorney.

How should SMB owners brief their teams on this?

Most employees do not think about privilege. They think about getting their work done faster, which is exactly why AI tools spread so quickly inside organizations without any governance structure. Someone on your ops team starts using Claude to draft responses to a vendor dispute, and by the time legal is involved, those drafts have already been processed by a third-party system.

A one-page internal policy is enough to close most of this risk. It does not need to be complicated. It needs to answer three questions for your team:

1. Which categories of work require approval before using AI tools?
2. Which AI tools are approved for sensitive work, and which are not?
3. Who do you ask when you are not sure?

If you do not have that policy written down and distributed, your team is making those calls on their own, which means they are probably making them wrong.

What we'd actually do

• Audit your current AI tool usage this week. Ask your team to list every AI tool they use and the types of documents they use it for. You will almost certainly find consumer-tier tools being used on sensitive legal or HR work. That is your immediate risk surface.
• Add a single-page AI use policy for legal and sensitive categories. It does not need legal review to be useful. Draw a clear line: consumer AI tools are not approved for anything involving active disputes, attorney communications, personnel actions, or regulatory matters. Enterprise tools with a signed DPA go in a second tier. Attorney-managed tools or private deployments go in a third.
• Brief your attorney and ask how they want AI used in your shared work. Your outside counsel may already have a position on this. If they are using AI on your matters, ask about their data handling. If you are sharing attorney communications with your team using AI summarization tools, stop until you have that conversation.

If you want to build a proper AI governance framework for your business, including policies, tool selection, and team training, that is exactly what we work through inside the AI For Business community at skool.com/aiforbusiness.