Client Confidentiality and Generative AI

<p>Client confidentiality concerns have emerged as one of the central challenges in the legal profession’s adoption of generative AI. Yet history suggests that such anxieties are overstated. The introduction of prior transformational technologies like email and the cloud prompted similar warnings about lawyer-client confidentiality but now their use is widely permitted and often required. The better question, then, is not whether lawyers may use generative AI given confidentiality concerns, but how.</p> <p><span>The problem is that early responses have struggled to provide satisfactory answers. Instead, much of the scholarly literature, practitioner commentary, and bar guidance to date has rested on conceptual imprecision about lawyers’ confidentiality obligations, incomplete understandings about how large language models are built and operate, and an underdeveloped appreciation of the range of potential responses. This has led to generalized warnings about speculative harms that are driven more by anxiety than by careful analysis of real risks. The resulting guidance has been at best incomplete and at worst counterproductive.</span></p> <p>This Article responds by offering a new analytical framework for evaluating confidentiality concerns arising from lawyers’ use of generative AI. First, it disaggregates the duty of confidentiality into three distinct responsibilities: secrecy, security, and loyalty. Second, it maps these responsibilities onto three corresponding categories of AI-specific risk—disclosure, access, and conflicts—and shows how the profession’s focus on disclosure obscures more significant concerns. Third, it evaluates the range of available mitigation strategies and explains why no single response is either necessary or sufficient. Fourth, it synthesizes these insights into a calibrated decisionmaking protocol for lawyers that accounts for different practice settings, technologies, and client expectations. In some cases, this protocol will prohibit the use of AI tools; in others, it will permit them.</p> <p>To be clear, the aim here is neither to minimize confidentiality risks nor to advocate for reflexive prohibitions. It is instead to replace underspecified, fear-driven guidance with a structured risk-management approach grounded in technical reality and professional judgment.<i><a rel="nofollow"></a></i></p>