AI and Attorney–Client Privilege before anyone is a client

Last reviewed 31 July 2026  ·  Rule text and opinion language checked against the linked sources on the date shown.

Does the duty apply before someone is a client?

Duties can arise before representation. Rule 1.18 protects qualifying prospective-client consultations; not every unsolicited message is such a consultation. See Comment [2] for the distinction.

One distinction worth keeping straight, because the two get used interchangeably and they are not the same. Attorney-client privilege is an evidentiary doctrine, defined by state and federal law, that governs what can be compelled in a proceeding. The ethical duty of confidentiality is broader, applies regardless of source, and is what Rule 1.18 and Rule 1.6 address.¹

Privilege and ethical confidentiality have different scopes. Have counsel assess both for the actual information and providers in the workflow.

Does routing intake through software break confidentiality?

Not by itself. What it changes is who has to be trusted. Every vendor in the path is a place the information can travel: the messaging provider, the automation layer, the model provider, any analytics tool watching the same page. Rule 1.6(c) requires reasonable efforts to prevent unauthorized access, and reasonable is measured by what the firm actually checked.

Rule 1.6(a) is the general prohibition: a lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, disclosure is impliedly authorized to carry out the representation, or it is permitted by paragraph (b). Paragraph (c) adds the security duty.²

Which means the question to ask a vendor is not “is this secure?” Every vendor answers yes. The question is what you can put in a file to show what you checked.

What did ABA Formal Opinion 512 say about self-learning tools?

It singled them out. Formal Opinion 512, issued 29 July 2024, warns that self-learning tools “by [their] very nature raise the risk that information relating to one client’s representation may be disclosed improperly, even if the tool is used exclusively by lawyers at the same firm”, and calls for informed client consent before entering representation information into them.

The opinion also holds that generic consent is not enough: informed consent requires telling the client what specific information is disclosed, to what, and what could go wrong.³⁴⁵

For procurement, ask whether any provider uses the information for model training, how it is retained, and who can access it. Have the firm assess whether consent or a different configuration is required for the intended use.

What should be in the vendor contract?

The following are procurement questions, not a list of contract terms universally required by the Model Rules. Agree appropriate controls with your counsel and the vendor.

Written vendor obligations support, but do not replace, the firm’s supervision and information-security review.

What should the intake script avoid collecting?

Everything the firm does not need in order to route the matter. No social security number, no date of birth, no insurance policy number, no medical records and no photographs of injuries in an automated first exchange. Collect the name, the callback number, the language, what happened and roughly when, then let the human collect the rest.

This is the cheapest control available, and firms consistently skip it because a longer intake form feels more thorough. It is not more thorough. It moves sensitive material into a system before anyone at the firm has decided the matter is one you want.

Every field you do not collect is a field that cannot leak, cannot be retained past its usefulness, and cannot appear in a subprocessor’s logs. Minimising the script is a security measure, not a convenience one.

What should a firm do this week?

Write down every provider that touches an intake message. Include forms, communications, automation, storage, AI processing, and any optional integrations. The list defines what needs review.

• List the path a web form takes from submission to a human reading it.
• List the path a missed call takes, including any answering service.
• Note who at each vendor can read the content, not just who can access the account.
• Note what is retained and for how long at each hop.
• Name one person responsible for keeping that list current.

Review that map before selecting a tool. It can reveal unnecessary data transfers and clarify who owns each part of the process.