A. II. ChatGPT in Legal Practice
ChatGPT can perform legal tasks, including passing the Uniform Bar Examination. Moreover, the chatbot earned a score of 297, approaching the 90th percentile of test-takers. GPT-4 correctly answered 75.7 percent of questions on the multiple-choice portion of the Multistate Bar Examination, compared to an average of 68 percent for humans. While the chatbot’s high score is impressive, it also demonstrates that the system is “not completely free of errors.” ChatGPT’s bar exam pass rate indicates its ability to apply legal reasoning and analysis—skills used daily by attorneys.
A. How Does ChatGPT Assist Attorneys?
Generative AI will likely save attorneys time and money, as it can analyze large volumes of legal documents. Many legal scholars believe that ChatGPT can function as a virtual legal assistant, paralegal, and associate. In addition to analyzing documents, ChatGPT can also research the applicable law and write motions and memoranda. Moreover, the technology may be able to refine a closing statement for a trial and prepare significant motions, the types of tasks often performed by associates. ChatGPT’s extensive capabilities will likely reshape the legal profession as we know it.
B. What Uptake Has There Been to Date?
While some large law firms are embracing generative AI, several firms have been hesitant to adopt the new technology. Allen & Overy Shearman announced it would adopt legal-focused generative AI. DLA Piper and Dentons followed, stating they would release a new chatbot technology. This technology, based on GPT-4, will “assist lawyers with legal research, help them create legal documents and hone their arguments.” Further, Dentons reported that it will “train staff on the risks inherent in the technology, including inaccurate and biased responses.” Dentons partnered with Microsoft “to ensure that data uploaded . . . is not used to train the tech[nology], no one outside [the firm] can access it, and it is erased after 30 days.”
On the other hand, many firms have banned or restricted generative AI. For instance, Am Law 100 firm Blank Rome stated that “ChatGPT has not been approved for use at this time. . . .” Moreover, BakerHostetler has banned lawyers from “inputting client information into any generative AI model, whether or not the information is confidential.” Michael Best & Friedrich also prevented firm employees from accessing ChatGPT. Further, Judge Brantley Starr of the U.S. District Court for the Northern District of Texas required attorneys to certify AI-assisted court filings are “checked for accuracy . . . by a human being.” Many sophisticated law firms and courts have adopted conflicting procedures on how to use AI, further complicating the legal profession’s approach to the technology. Regardless of a law firm’s perspective on generative AI, the technology will affect the legal profession’s future and how attorneys conduct their legal practice.
A LexisNexis study of 4,180 individuals conducted in the United States in March 2023, consisting of 1,176 lawyers, 1,239 law students, and 1,765 consumers, found “that the legal market is significantly more aware of generative AI than the general population.” At the time of the study, eighty-six percent (n=1,011) of the lawyers were aware of generative AI, compared to fifty-seven percent (n=1,006) of the consumers. Further, eighty-four percent (n=987) of the lawyers surveyed “believe generative AI tools will increase the efficiency of lawyers, paralegals, or law clerks.”
In August 2023, LexisNexis presented findings of an additional study conducted in Canada, France, the United Kingdom, and the United States. From March through July 2023, 7,950 individuals were surveyed; and of those individuals, 3,752 were lawyers, 1,239 were law students, and 2,959 were consumers. According to the study, only fifteen percent (n=562) of lawyers are using generative AI for law-related purposes, yet forty-three percent (n=1,613) intend to use generative AI in the future for legal work.
Furthermore, a March 2023 study by the Thomson Reuters Institute reported that 443 attorneys at “large law firms (more than 180 attorneys)” and “midsize law firms (between 30 and 179 attorneys)” in Canada, the United Kingdom, and the United States were surveyed regarding their attitudes on ChatGPT and work. Sixty-two percent (n=274) of the respondents were from midsize law firms, and thirty-eight percent (n=168) were from large law firms. In that survey, eighty-two percent (n=363) of respondents “said they believe . . . generative AI can be readily applied to legal work; and a slightly smaller majority [fifty-one percent (n=225)] said it should be applied to legal work.” While many attorneys are optimistic, sixty-two percent (n=274) reported concerns with using generative AI at work. The main concerns reported were accuracy, security, privacy, and client confidentiality.
C. Examples of ChatGPT in the Legal Practice
From drafting legal documents and conducting legal research to providing personalized legal advice, ChatGPT possesses a wide range of capabilities in providing comprehensive legal advice. Related to generative AI’s potential to help with specific tasks lawyers perform, sixty-five percent (n=2,438) of the lawyers surveyed by Thomson Reuters saw potential in researching matters, fifty-six percent (n=2,101) saw potential in drafting documents, forty-four percent (n=1,650) saw potential in analyzing documents, and thirty-five percent (n=1,313) saw potential in writing emails. Overall, generative AI is likely to assist attorneys with tasks such as researching, drafting pleadings, and managing large discovery requests and disclosure responses.
LexisNexis and Westlaw have delved into the generative AI space. In 2023, Thomson Reuters introduced Westlaw Precision. Precision uses an LLM to analyze content on Westlaw to generate answers. Precision distinguishes itself from ChatGPT, as it produces responses grounded in primary sources. Similarly, Lexis+ AI, a generative AI platform, is now available to second- and third-year law students at ABA-accredited law schools. Lexis+ AI boasts “linked hallucination-free legal citations.” The system allows for “conversational search, intelligent legal drafting, insightful summarization, and document analysis.”
D. Perspectives Regarding ChatGPT
1. Attorney’s Perspective
Overall, the legal profession is generally optimistic about AI and its ability to overcome some of the profession’s “biggest pain points.” Thomson Reuters conducted a study between May and June 2023 of 1,200 legal professionals. About half of the survey participants based in the United States and the majority of the other half were located in the United Kingdom, Canada, and Latin America. Of those surveyed, seventy-five percent (n=900) believed AI will increase productivity. Moreover, sixty-seven percent (n=804) of respondents believed AI will have a “transformational or high impact on their profession in the next five years.” Based on the responses, the study observed generally “that legal professionals were positive about the potential of generative AI to improve productivity, curb costs, enhance client service and open up new services and revenue sources.”
Nonetheless, many attorneys expressed concerns when using generative AI. Twenty-five percent (n=300) of respondents were concerned about accuracy; nineteen percent (n=228) were worried about job losses; fifteen percent (n=180) were concerned about data security, and fifteen percent (n=180) were worried about ethics tied to AI. A similar report conducted by LexisNexis found that eighty-eight percent of the 3,752 lawyers surveyed (n=3,301) had some ethical concerns with generative AI. Moreover, Mark McCreary, cochair of the privacy and data security practice at Fox Rothschild, said that “[t]he privacy considerations with something like ChatGPT cannot be overstated.”
2. General Perspective
As of August 2023, in a LexisNexis survey of 5,057 adults (18 years and above) in the United States, eighteen percent of U.S. adults surveyed (n=910) have used ChatGPT. The study aims to reflect the diverse population in the United States by “gender, race and ethnicity, partisan affiliation, education, and other categories.”
Furthermore, consumers reported the top three areas they intended to use generative AI include requesting “[g]eneral legal advice,” “[c]reating a will,” and finding “[l]egal requirements for setting up a business.” Sixty percent (n=2,508) reported they are most likely to use generative AI to request general legal advice; forty-three percent (n=1,797) reported they are most likely to use generative AI to create a will; and forty-one percent (n=1,713) reported they are most likely to use generative AI to find legal requirements for a business. Nevertheless, seventy-two percent (n=3,009) of consumers cited concerns about the ethics of generative AI. As ChatGPT continues to enhance its capabilities and society increasingly embraces technology, attitudes toward generative AI will likely become more positive.
III. Limitations of ChatGPT
A. Capacity Limits
One of ChatGPT’s main limitations is that it can become overwhelmed with users, and unable to produce outputs at peak times. Capacity is not solely determined by the number of users on the platform; many factors can cause ChatGPT to be overloaded. For example, the request complexity of user requests and the rate at which users send requests can impact the capacity limits.
B. Hallucinations
OpenAI stated that the technology “will occasionally make up facts or ‘hallucinate’ outputs,” so providing incorrect information. It is estimated that the system will hallucinate around three percent of the time, the lowest percentage compared to other chatbots. Meta’s chatbot hallucinated around five percent of the time, while a Google system, PaLM, reported a staggering twenty-seven percent hallucination rate. OpenAI’s recommendation for hallucinations by ChatGPT is for users to select the “Thumbs Down button” to indicate an irrelevant or incorrect answer. Metz says ChatGPT can “fabricate information” including, names, dates, medical explanations, books, and historical events that never occurred. Moreover, ChatGPT, Google’s Bard, and Microsoft’s Bing chatbots all repeatedly provide inaccurate information when asked the same questions.
C. Hallucinations in Practice
As the legal community begins to use generative AI, hallucinations from ChatGPT are becoming more prevalent in practice. In June 2023, New York attorneys Steven Schwartz and Peter LoDuca submitted a legal brief “filled with fake judicial opinions and legal citations, all generated by ChatGPT.” Mr. Schwartz, a seasoned attorney practicing for more than thirty years, stated that he learned about ChatGPT from his children, and “had never used it professionally.” The opposing party could not locate the cases, so the judge ordered the attorneys to provide copies. The attorneys later admitted that ChatGPT generated these phantom cases.
U.S. District Judge P. Kevin Castel imposed sanctions, ordering Mr. Schwartz, Mr. LoDuca, and their law firm, Levidow, Levidow, & Oberman, to pay a USD 5,000 fine. While the judge argued that the attorneys acted in bad faith, making “false and misleading statements to the court,” the attorneys argued that they made a good faith mistake in using the technology. The judge stated that there is nothing inherently wrong with attorneys using AI, but the “ethics rules ‘impose a gatekeeping role on attorneys to ensure the accuracy of their filings.’”
D. Biased Information
ChatGPT can also produce biased information. Further, it has been reported that “[r]esearchers predict that generative [AI] could make disinformation cheaper and easier to produce.” In an analysis of over five thousand images generated by AI, researchers noticed that images created using prompts listing high-paying jobs mostly included people with lighter skin tones. Moreover, images created to show people with high-income occupations such as lawyers, politicians, doctors, and judges were dominated by men. The biases exhibited in generative AI may be worse than reality. For instance, around thirty-four percent of judges are women, whereas only three percent of the generative AI images for judges showed women.
Because chatbots are trained by humans, these trainers can share disinformation such as conspiracy theories in persuasive ways. One danger of ChatGPT producing biased information is that users cannot tell when the answer is disinformation unless they already know the answer.
E. Cybersecurity Issues
ChatGPT also poses risks related to hacking and cybersecurity. For example, ChatGPT presents new methods “for hackers to potentially breach advanced cybersecurity software.” From 2021 to 2022, global cyberattacks increased by thirty-eight percent. In the fourth quarter of 2022, it was reported that “cyberattacks reached an all-time high . . . with an average of 1168 weekly attacks per organization.” In a report on November 9, 2023, British multinational law firm Allen & Overy announced that it had experienced a cyberattack. Moreover, it was reported that this “incident is the latest in a long line of hacks against law firm[s] . . . in recent months [that included] Bryan Cave Leighton Paisner, Proskauer Rose, Kirkland & Ellis, DLA Piper, K&L Gates, and Orrick Herrington & Sutcliffe.”
AI presents a risk for “phishing” scams. ChatGPT can “converse . . . without spelling, grammatical, and verb tense mistakes,” creating the ability to appear like “a real person.” Companies using ChatGPT must equip IT teams with tools to detect ChatGPT and similar generative AI phishing scams. While ChatGPT can generate code, it cannot yet identify code deemed malicious or used for hacking.
While these are pressing concerns, arguably the most dangerous concern is the potential for ChatGPT itself to be hacked. If the system itself were hacked, ChatGPT could generate biased and distorted messages, becoming a “dangerous propaganda machine.” Moreover, ChatGPT could hack user information and gain sensitive data about ChatGPT users. It is important to acknowledge ChatGPT’s limitations to effectively use the chatbot.
IV. Attorney-Client Privilege
A. What Is the Attorney-Client Privilege?
The U.S. Supreme Court in Upjohn Co. v. United States stated that “attorney-client privilege is the oldest of the privileges for confidential communications known to the common law.” The purpose of the privilege is to “encourage full and frank communication between attorneys and their clients and thereby promote broader public interests in the observance of law and administration of justice.” Further, the privilege rests on the need for the attorney to know all information that relates to the client’s representation and “to encourage clients to make full disclosure to their attorneys.” The attorney-client privilege stands as the basis for the relationship between clients and their legal counsel.
Moreover, the Model Rules of Professional Conduct state that “in the absence of the client’s informed consent, the lawyer must not reveal information relating to the representation [of a client].” The attorney-client privilege also prohibits actions by a lawyer that do not reveal “protected information but could reasonably lead to the discovery of such information by a third person.” Not only does the lawyer have an obligation not to reveal privileged information, but also the lawyer “shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”
The attorney-client privilege should be distinguished from the duty of confidentiality. While the purpose of both is to protect the confidentiality of the information or communication shared between an attorney and client, the attorney-client privilege is narrower, and only applies to communications between attorneys and their clients. Further, the duty of confidentiality prevents the attorney from revealing any information shared by the client.
B. Scope of Attorney-Client Privilege
The attorney-client privilege, the work product doctrine, and the principle of confidentiality are the pillars underlying the attorney-client relationship. The duty of confidentiality applies to all information relating to the representation of a client, not just matters communicated in confidence. The ABA Model Rules of Professional Conduct mandate that “[a] lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by [one of the rule’s exceptions].” Lawyers in a law firm may disclose information about a client’s case to other lawyers in the firm unless the client has specifically instructed that the information be contained to specified lawyers.
In Upjohn, the Court expanded the attorney-client privilege in the corporate context. Before the ruling, courts used a limited “control group test,” where only officers, directors, and managerial employees who have legal decision-making authority are protected by the privilege. The Court rejected the control group test, concluding that communications by employees are covered by the attorney-client privilege.
The Court reasoned that the control group test overlooks the purpose of giving professional information to a lawyer to enable the lawyer to give sound and informed advice. The Court further reasoned that the control group test creates difficulty for an attorney to convey “full and frank legal advice” to the company’s employees. All in all, the Supreme Court expanded the attorney-client privilege’s application to protect communications made between attorneys and nonmanagement employees. Nevertheless, the Ninth Circuit in In re Grand Jury held that attorney-client privilege does not protect communications with the primary purpose of providing business advice, even if legal advice is incorporated.
C. What Is Required for the Privilege to Apply?
1. Purpose Must Be to Obtain Legal Advice
To invoke the attorney-client privilege, a party must demonstrate the existence of a communication between counsel and the client, that legal advice was sought, and that the communication was intended to be and was kept confidential. Additionally, the privilege only applies when both the client actively sought legal advice and the attorney provided such advice. Under the totality of the circumstances, the client must seek the attorney for legal advice. In essence, the privilege might not apply if the task could have been handled by someone without legal knowledge and the lawyer was not engaged in a “professional capacity.” As Jacqueline Kate Unger states: “[W]here the client seeks legal advice which . . . relates to business concerns, the privilege still applies.” This rule aims to protect a lawyer’s relationships, as conversations with friends are not privileged.
2. Communications Must Be Made in Confidence
Next, to be privileged, there must be a communication between a client and a lawyer. Further, the communication must “reasonably be intended as confidential.” Asserting that the communication was intended to be confidential is insufficient; rather, the court looks at the circumstances around which a statement was made to determine the intent. Shouting sensitive client information in a crowded area or with others present is not in confidence, so the privilege likely does not apply to these scenarios.
D. Limitations and Exceptions
While the duty of confidentiality applies to every communication between attorneys and their clients, the attorney-client privilege does not apply to every communication and can be waived. Under the ABA Model Rules of Professional Conduct, Rule 1.6(b), a lawyer may disclose client information to prevent harm; to prevent the client from committing certain crimes or frauds; to address financial harm caused by the client’s criminal actions; to seek legal advice on rule compliance; to establish claims or defenses; to comply with the law or court orders; or to resolve conflicts of interest, provided the disclosure does not compromise privilege or prejudice the client.
The ABA Model Rules of Professional Conduct were adopted in 1983. Hence, none of the exceptions to the attorney-client privilege account for using AI to input sensitive client information. AI was not prevalent when the Model Rules of Professional Conduct were drafted. Therefore, lawyers are placed in an ethical dilemma of how to use generative AI to their advantage without compromising privilege. Moreover, as society becomes more digitized, the attorney-client privilege faces new challenges.
E. When Is Attorney-Client Privilege Broken?
The client holds the attorney-client privilege, meaning the client has the authority to waive or invoke the privilege. As highlighted by Model Rule of Professional Conduct 1.6, if a client seeks legal advice to further a criminal act or fraud, if a third party is present, or if there is litigation between a lawyer and client, then the privilege is waived. As Stephen D. Ginsburg suggests: “Either voluntary or inadvertent disclosure to outside or non-covered recipients, professional advisors outside the privilege, and experts and consultants, can result in waiver as a matter of law.” If a client voluntarily discloses the contents of the communication to a third party, the privilege is often waived. Further, inadvertent disclosure may violate the Model Rules, unless the lawyer makes “reasonable efforts” to prevent disclosure.
F. Evolution of Attorney-Client Privilege
1. Digital Communications and Privilege
The rise of technology and the prevalence of digital communication methods have changed the way attorneys view the privilege. Emails frequently appear in litigation because the privilege was waived—whether intentionally or unintentionally. As technology evolves, the attorney-client privilege becomes more vulnerable, so it is important to study where the boundaries of technology and the privilege lie.
2. Email, Messaging Apps, Video Conferencing
Email has become a ubiquitous tool for legal correspondence. The sheer volume of emails sent and received by an attorney on any given day makes it easier for inadvertent disclosure to occur. The simple act of pressing “reply all” or “forward” allows for the attorney-client privilege to potentially be waived if sensitive information is shared with third parties. Moreover, email makes it easy to send sensitive client information to the wrong recipient. For instance, an attorney in the law firm of Wilmer Cutler Pickering Hale and Dorr LLP (also known as WilmerHale), sent privileged documents to other attorneys working on the case and inadvertently copied a Wall Street Journal reporter. Although the firm asked the reporter to delete the emails, the firm later found out that the reporter printed and retained hard copies.
Messaging apps, used for informal communications, can blur the lines of what constitutes a breach of privilege. Video conferencing platforms, which increased in significance during the pandemic, can create unintentional sharing of confidential information. Moreover, video conferencing consultations create a greater likelihood of third parties eavesdropping on the conversation. Therefore, attorneys must exercise caution in using technology.
3. Social Media
On one hand, social media’s ubiquity has brought new opportunities for attorneys to market their work; however, social media is also an invitation for waiver of the attorney-client privilege. Further, social media can facilitate unintended attorney-client relationships and promote unethical behavior. Social media’s ease of sharing information by the click of a button may result in sharing privileged information about a client to unintended recipients. If a client discloses information about a case or privileged information, that information can likely be used against the client in litigation.
4. Digital Records
As the legal profession transitions from hard copies and faxing to digital records, the cloud, and emails, the attorney-client privilege becomes more vulnerable. Digital records create a higher likelihood of data breaches and waiving the attorney-client privilege. In this rapidly evolving digital landscape, legal professionals must adapt to new technologies while meticulously navigating the intricacies of the attorney-client privilege.
V. Lawyers’ Technical Obligations
Lawyers have an ongoing obligation to adhere to the Model Rules of Professional Conduct. This includes staying in tune with technological advances and developments. Moreover, Model Rule 1.1, comment 8 provides that “a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.” Lawyers must protect the attorney-client privilege and also remain up to date on technology. This presents an ethical conflict when the obligation to maximize the benefits of emerging technologies and the attorney-client privilege conflict.
VI. Legal Analysis: ChatGPT and Attorney-Client Privilege
First, lawyers must understand the capabilities and limitations associated with integrating AI into their practice. In addressing the integration of AI within the legal profession, the American Bar Association
urges courts and lawyers to address the emerging ethical and legal issues related to the use of [AI] in the practice of law including: (1) bias, explainability, and transparency of automated decisions made by AI; (2) ethical and beneficial usage of AI; and (3) controls and oversight of AI and the vendors that provide [the service].
It is an attorney’s ethical obligation to stay up to date with emerging technologies. Nevertheless, a lawyer should not use technology to compromise the attorney-client privilege. Striking this balance is challenging, yet imperative.
For the attorney-client privilege to apply, there must be a communication, made between privileged persons, made in confidence, to seek legal advice. If an attorney uses ChatGPT for assistance on a client’s work or if a client inputs confidential information, the purpose is likely for “legal advice.” The exceptions to the attorney-client privilege do not include any carveout for AI or chatbots, so lawyers are faced with a novel and complex issue of if, and when, the privilege applies.
A. Case Law Interpreting Emerging Technologies and Attorney-Client Privilege
Currently, no Supreme Court cases have ruled on generative AI and attorney-client privilege. Nevertheless, some state and federal courts have interpreted how emerging technologies impact the privilege. It is important to analyze how various courts have perceived the privilege to propose a framework for integrating generative AI.
Even if a disclosure is “inadvertent,” if the “holder of the privilege . . . [takes] reasonable steps to prevent disclosure” and “the holder promptly [takes] reasonable steps to rectify the error,” then the attorney-client privilege is not waived. The Seventh Circuit in Carmody v. Board of Trustees of University of Illinois considered the application of attorney-client privilege and electronic disclosure. In Carmody, an information technology manager sued under 42 U.S.C. § 1983, the Civil Rights Act, after his termination following a network security breach. Printed copies of a professor’s privileged emails were found in Carmody’s home newspaper box. The university subsequently fired Carmody.
The district court ruled that Carmody could not offer into evidence documents that the defense inadvertently turned over to Carmody in discovery. The court held that the inadvertent document disclosure did not waive privilege. The university’s counsel received thousands of documents from the university; therefore, it was not unreasonable for a privileged document to be inadvertently provided “among the hundreds of documents” disclosed to Carmody. The court also reasoned that the heading “ATTORNEY-CLIENT COMMUNICATION PRIVILEGED AND CONFIDENTIAL” at the top of the memorandum should have indicated the document’s privileged nature to Carmody and his attorney. The document itself is an attorney-client communication, containing legal advice, thus there was no indication the Board of Trustees intended to waive the privilege. Moreover, the court held that the defendant took reasonable steps to prevent and rectify the disclosure. This case is important, as it analyzes disclosure of privileged information through e-discovery.
A voluntary disclosure of a privileged document to a third party will generally destroy the privilege. The court in In re Pacific Pictures Corp. analyzed “whether a party waives attorney-client privilege by voluntarily disclosing privileged documents to the federal government.” This case involves the rights to the Superman character, with the heirs of the creators, a Hollywood producer and attorney, Mark Toberoff, and D.C. Comics involved in litigation. Toberoff voluntarily disclosed documents to the U.S. Attorney’s Office in response to a subpoena. Subsequently, it was noted that “D.C. Comics . . . requested all documents disclosed to the U.S. Attorney, claiming that the disclosure of these unredacted copies waived any remaining privilege.” The court held that disclosure to the government results in a waiver of the privilege. The court reasoned that selective waiver does not encourage the attorney-client privilege’s purpose of encouraging “full disclosure to one’s attorney in order to obtain informed legal assistance.” The court further reasoned that only the Eighth Circuit recognizes “selective waiver.” This case is important because it highlights the rule that disclosure to a third party waives attorney-client privilege and the court’s reluctance to adopt a “selective waiver” rule for disclosures to government officials.
B. Legislation, Guidance, and Resolutions Interpreting AI and Attorney-Client Privilege
The State Bar of California issued practical guidance for using AI in the legal profession on November 16, 2023. The State Bar recommended that lawyers refrain from inputting clients’ confidential information into generative AI systems “that lacks adequate confidentiality and security protections.” Further, lawyers should anonymize client information and avoid inputting identifiable information. The State Bar also stated that “[a] law firm should consult with IT professionals . . . to ensure that any AI system in which a lawyer would input confidential client information adheres to stringent security, confidentiality, and data retention protocols.”
Remote work, while convenient, poses additional challenges to the attorney-client privilege and duty of confidentiality. In 1999, the ABA Standing Committee on Ethics and Professional Responsibility released Formal Opinion 99-413 Protecting the Confidentiality of the Unencrypted E-Mail. Subsequently, in 2017, the ABA issued Formal Opinion 477R, updating the 1999 opinion. Formal Opinion 477R discussed the importance of protecting client information transmitted over the internet. The committee recognized the prevalence of cyber threats and provided recommendations on how to use security measures to conduct client interactions via email. On March 10, 2021, the ABA released Formal Opinion 498, which recommended attorneys disable listening devices such as Siri and Alexa in workspaces. Further, Formal Opinion 498 urged lawyers to install security-related updates, use complex passwords, install antivirus software, use encryption, and use VPNs. Throughout this opinion, the ABA expressed its concern with technology leaking sensitive client information. The formal opinion also addressed how the ABA approaches technology and attempts to regulate the potential for a data leak exposing attorney-client communications.
In February 2023, the American Bar Association passed Resolution 604, urging organizations to ensure AI technologies are monitored by human authority, oversight, and control. The resolution recognized the opportunities and limitations of AI, and urged developers to ensure transparency and traceability of AI systems. Transparency includes disclosing when AI is used and enabling others to understand how the AI system is developed, trained, and operated.
C. Is ChatGPT’s Information Confidential?
A critical step in determining whether ChatGPT waives the attorney-client privilege is analyzing OpenAI’s privacy policy and whether information is confidential within the service. When asking ChatGPT whether the interaction is confidential, it responds, “Yes, your interactions with me are confidential. I don’t store personal data from conversations unless it’s provided for the purpose of the ongoing session, and I’m designed to prioritize user privacy and data security.” Further, when inputting “I am a lawyer, and I am going to provide you with my client’s case. Can you assist in spotting the legal issues?” ChatGPT responds, “Of course, I’d be happy to help. Please provide me with the details of your client’s case, and I’ll do my best to spot any potential legal issues.” When following up and asking the chatbot, “Would this violate attorney-client privilege?” it responds,
As an AI language model, I don’t have the ability to establish an attorney-client relationship or provide legal advice. However, discussing general legal principles or hypothetical scenarios typically doesn’t create an attorney client relationship of violate attorney-client privilege.
However, it’s important to exercise caution and avoid disclosing any confidential or sensitive information that could potentially compromise the attorney-client privilege. It’s always advisable to consult directly with a qualified attorney to ensure that communications are protected by the attorney-client privilege.
ChatGPT’s responses conflict with OpenAI’s privacy policy, causing confusion on if, and when, the privilege applies.
These conflicting responses highlight the uncertainty attorneys face with generative AI. On one hand, ChatGPT can revolutionize the way attorneys conduct their practice, eliminating frivolous, time-wasting tasks. On the other hand, the attorney-client privilege is at the forefront of the relationship between attorneys and their clients. The use of these technologies tends to create an ethical dilemma for the legal profession: efficiency at the price of ethics.
The OpenAI website states that the conversations may be reviewed by AI trainers to improve the systems. Yet, in April 2023, ChatGPT introduced a new feature, allowing users to “turn off chat history.” Open AI states that when the chat history is disabled, the information “won’t be used to train and improve [the] models.”
On August 28, 2023, ChatGPT launched “ChatGPT Enterprise,” a more secure and private version of the generative AI technology. Moreover, OpenAI claims that ChatGPT Enterprise, does not use an organization’s data for training. OpenAI also claims that the version has “enterprise-grade security and privacy,” because there is data encryption at rest (AES 256) and in transit (TLS 1.2+). Nevertheless, because ChatGPT targets Enterprise toward organizations in general, rather than law firms specifically, it is unclear how the attorney-client may be affected by ChatGPT Enterprise.
Open AI’s privacy policy indicates that when a user creates an account, the technology collects personal information such as account information, user content, communication information, and social media information. Further, when someone visits, uses, or interacts with OpenAI’s services, the technology collects log data, usage data, device information, cookies, and analytics. OpenAI states that it “use[s] [p]ersonal [i]nformation . . . to provide administer, maintain, and/or analyze the [s]ervices.” OpenAI also uses personal information to improve its services, conduct research, communicate, develop new programs, and prevent fraud, criminal activity, or misuse of the service.
D. Is ChatGPT a “Third Party”?
Disclosure to a third party can constitute waiver of the attorney-client privilege. The analysis of whether ChatGPT and other generative AI systems are considered “third parties” is vital to answering the question of whether interaction with ChatGPT waives privilege.
On one hand, disclosing information to ChatGPT can be viewed as synonymous with disclosing the information to other parties, thus waiving the privilege. On the other hand, ChatGPT is a vital resource that provides attorneys with insightful information, allowing them to save time and money and can be viewed as “part of the firm.” When asked if it is considered a third party for purposes of the attorney-client privilege, ChatGPT responds, “As an AI developed by OpenAI, I don’t have legal personhood or the capacity to establish an attorney-client relationship. Therefore, any communication with me wouldn’t fall under the attorney-client privilege. However, I’m designed to prioritize user privacy and confidentiality within the bounds of OpenAI’s policies.” Nonetheless, so long as there are “human contractors” that interact with users’ input into ChatGPT, the system is likely a third party.
Even if ChatGPT is considered a third party, future courts may adopt a selective waiver rule. In this case, even if an attorney or client discloses privileged information to a generative AI chatbot, the courts will not consider the disclosure to be a waiver of the privilege. In Pacific Pictures Corp., however, the court rejected the proposed selective waiver for disclosures to government employees, reasoning that the rule does not support the privilege’s purpose. Further, only the Eighth Circuit recognizes selective waiver, making it a very limiting option.
Unlike disclosing privileged information to a government official, disclosing information to ChatGPT aids clients and attorneys. ChatGPT can serve as a valuable tool for offering in-depth and refined insights, which can greatly support attorneys in preparing legal documents such as motions and contracts. Therefore, sharing privileged information with generative AI can enhance the comprehensive disclosure of relevant facts to an attorney. Moreover, as generative AI advances, society will likely increasingly appreciate its capacity to aid attorneys, ultimately encouraging clients to be more open in sharing information with their attorneys.
E. To What Extent Does Interaction with ChatGPT Waive the Privilege?
There are several scenarios in which sensitive client information may be released to ChatGPT. First, an attorney may input the information into ChatGPT. Second, a client who is represented by an attorney may disclose information to ChatGPT. Third, pro se clients may input information regarding their cases into ChatGPT before undergoing representation with attorneys. Each of these scenarios presents a unique challenge to the attorney-client privilege.
1. If an Attorney Inputs Client Information into ChatGPT, Does That Constitute a Waiver of Privilege?
First, to establish attorney-client privilege, the communication must be from a client to a lawyer, made in confidence, and the purpose must be to obtain legal advice. While a lawyer may violate the duty of confidentiality by disclosing sensitive, confidential client information, the attorney-client privilege is much narrower in scope.
Voluntary or inadvertent disclosure to individuals outside the scope of privilege or to professional advisors outside the privilege can lead to a waiver of the privilege. If an attorney inadvertently discloses sensitive client information, so long as reasonable remedial steps are taken to remedy the action, then the privilege is likely not waived. Nevertheless, if an attorney voluntarily divulges sensitive client information to ChatGPT, there is likely a waiver of privilege and a violation of the Model Rules of Professional Conduct. Even if the privilege is not waived, the duty of confidentiality is likely breached.
2. If a Client Inputs Data into ChatGPT While Represented by an Attorney, Does This Constitute a Waiver of Privilege?
Another intriguing scenario arises when a client independently inputs data into ChatGPT while represented by an attorney. This scenario prompts us to consider whether this type of action constitutes a waiver of the attorney-client privilege.
The power to waive the attorney-client privilege belongs to the client. In Arizona, a client may elect to waive the protection of the privilege, and a waiver is consent to the disclosure of communications that occurred between the client and the attorney. Moreover, if a client does not treat the communication as privileged, the communication will not be recognized as confidential by the court. Thus, under this scenario, it is likely that the attorney-client privilege is waived.
3. If a Client Inputs Information into ChatGPT and Later Seeks Legal Advice from an Attorney, Is the Client Information Still Privileged?
Furthermore, the question of privilege extends to situations in which a client first inputs information into ChatGPT to seek legal advice and later retains an attorney for advice on the same matter. We must examine whether the client’s information remains privileged under these circumstances.
Before a client has received advice from an attorney, there is no communication “relating to the representation of a client.” Moreover, a person who has not spoken with an attorney about a case does not have the attorney-client privilege yet, as the person is not a client. Furthermore, because the client has not consulted with an attorney, there would be no privileged information at that point. Likely, a client who uses ChatGPT before obtaining legal advice does not compromise the attorney-client privilege because there is no privilege before the client communicates with an attorney.
4. To What Extent May an Attorney or Client Use ChatGPT Without Waiving Privilege?
Lastly, it is crucial to establish clear boundaries regarding the extent to which attorneys and clients can use ChatGPT without inadvertently waiving the attorney-client privilege. This issue necessitates careful consideration of ethical and legal principles governing attorney-client relationships in the context of evolving technology, including ChatGPT.
All in all, these are important scenarios to determine whether lawyers are acting within their professional duties. The Model Rules of Professional Conduct allow a lawyer’s use of a hypothetical so long as “there is no reasonable likelihood that the listener will be able to ascertain the identity of the client or the situation involved.” This further complicates the privilege analysis, as ChatGPT is a chatbot, not a human. Moreover, when asking ChatGPT about privilege and whether the information is confidential, ChatGPT provides responses that conflict with the OpenAI privacy policy.
ChatGPT is arguably less likely to ascertain the identity of a client than to disclose the same information to a human. Nonetheless, ChatGPT is trained by humans, so attorneys should err on the side of caution and not disclose any sensitive client information to the chatbot. In the future, it is likely that ChatGPT will need updates and periodic training. It is unclear whether OpenAI will continue to train the system with “human contractors.” If OpenAI develops a training system that does not involve human trainers, there would likely be no difference between inputting sensitive client information into Google or Westlaw and ChatGPT. Therefore, in the future, ChatGPT may become a tool for attorneys to use without compromising the privilege. Nevertheless, this rule does allow for some hypothetical disclosure, and it is unclear where to draw the line.
VII. Best Practices and Recommendations
In the ever-evolving landscape of the practice of law, attorneys struggle to navigate complex ethical challenges while embracing the power of AI to streamline their work. Legal practitioners are left without a comprehensive framework on how to use generative AI without compromising the attorney-client privilege. An adequate framework is needed for attorneys to leverage the technology effectively.
In essence, inputting sensitive, privileged client information into ChatGPT to seek legal advice is likely a violation of the attorney’s ethical duties under the Model Rules of Professional Conduct. Because ChatGPT is trained by humans, sensitive client information may inadvertently be disclosed to these trainers, who are third parties. To maintain the privilege, the inputted information must be made in confidence between the client and attorney to obtain legal advice. Nonetheless, lawyers may “use . . . a hypothetical” to discuss the case “so long as there is no reasonable likelihood that the listener will be able to ascertain the identity of the client or the situation involved.” The question remains of where to draw the line of information that may be inputted into ChatGPT without compromising the privilege.
A. Developing Software for the Firm without Compromising Privilege
First, law firms should create a platform or software that leverages ChatGPT’s technology without using sensitive client information to train the system. In November 2023, Thomson Reuters announced a series of generative AI assistants on Westlaw. Thomson Reuters also announced it would be building on the AI assistant called CoCounsel, the world’s first legal AI assistant. Because this is a new technology, it may be vulnerable to hacking. Further, the system uses generative AI, which may incorporate biases. Therefore, this system does not eliminate all the downfalls of generative AI.
B. Developing a Comprehensive Regulatory Framework for Generative AI
On October 30, 2023, President Biden issued an executive order outlining the federal government’s first regulations on AI, including that AI cannot be used to produce weapons. Nevertheless, the regulations also recommend that photos, videos, and audio developed by AI should be watermarked, indicating they were AI-created. While these regulations may prevent the use of AI to create destructive weapons or disseminate false information, the United States lacks a sui generis framework for regulating generative AI and privacy.
Many states have imposed regulations on AI, including the Illinois Artificial Intelligence Video Interview Act, which requires employers to disclose that they use AI during job interviews and prevents employers from sharing the applicant videos, except to the extent necessary to evaluate the candidate’s fitness for the position. Moreover, in 2023, Colorado, Connecticut, and Virginia adopted consumer privacy laws, allowing residents to opt out of profiling activity. The California Privacy Rights Act of 2020 (CPRA) provides California residents with similar data protections . Overall, the United States lacks a sustainable federal legal framework for navigating privacy and generative AI. Moreover, as different jurisdictions create laws and guidelines, inconsistencies between the states create increasing cross-jurisdictional issues.
C. Virtual Attorney Chambers
One possible recommendation is to create a virtual environment to mimic a physical attorney’s office. The virtual chambers would allow for private interactions. Combining this idea with generative AI would create a secure room for a client, an attorney, and an AI chatbot. In the secure room, the client would engage in discussion, ask legal questions, and receive advice from both the attorney and the assisting chatbot. This would allow the client to benefit from the lawyer’s legal expertise as well as the chatbot’s assistance with research and drafting. By integrating AI technology into the attorney-client interaction, this innovative approach could enhance the efficiency and effectiveness of legal consultations.
D. Blockchain-Powered Legal Platform
With rapid technological advancements, integrating blockchain technology fosters security, transparency, and efficiency. Blockchain, a public ledger, can be applied to almost anything traditionally saved to a database or spreadsheet. The blockchain could create a decentralized legal platform, giving clients a revolutionary framework for interacting with attorneys while leveraging AI tools. Blockchain employs smart contracts that can be automated to securely manage and process large amounts of data, enhancing the confidentiality and integrity of communications between attorneys and clients. With smart contracts and robust encryption protocols, clients can engage with ChatGPT and legal practitioners in a secure and confidential environment.
E. Dynamic Privilege Protocol
As generative AI continues to advance, generative AI systems may implement dynamic privilege protocols. When an attorney or client inputs information that otherwise may compromise the privilege, the system may learn to recognize the information’s sensitive nature. The system could serve as a safeguard to information that could potentially breach confidentiality or waive the attorney-client privilege. Moreover, generative AI systems may adapt to redact sensitive information so that the attorney-client privilege remains intact.
F. Strengthening Cybersecurity and Data Protection
One of the main concerns of generative AI is the potential for a data breach or other cybersecurity issues. If attorneys use ChatGPT Enterprise or a similar technology equipped for businesses, where the system is not trained with user input, the possibility of a data breach may still compromise the sensitive information in the system, thereby waiving the attorney-client privilege. Even if the system is not trained with an attorney’s input, a hack of the system per se reveals the information to a third party and could constitute a waiver of privilege if reasonable steps are not taken to remedy the disclosure.
With improved security, the chance of a data breach can be reduced. However, it is unlikely that the technology will ever reach the point where it is unable to be hacked. Thus, there is uncertainty about whether a system hack unintentionally waives the privilege. Strengthening the security of generative AI is one step towards achieving a system that attorneys can leverage while lowering the risk of waiving the attorney-client privilege.
G. Promoting Transparency and Accountability in AI Algorithms
The OpenAI privacy policy may seem unclear to the average user. Moreover, the likelihood of a data breach could result in the loss of privilege even if disclosing sensitive client information to ChatGPT does not waive the privilege. The confusing privacy policy and differing viewpoints make it difficult for users to know their rights. Further, because generative AI is a relatively novel technology, there are currently few laws mandating transparency and accountability. In the event of a data breach or a disclosure to a third party, there must be clear accountability and measures to remedy such a breach.
H. Continuing Legal Education for Attorneys
Continuing legal education (CLE) is vital for attorneys to keep up with updates and developments in the profession. Most states mandate CLE hours after an attorney is admitted to a state bar. While the ABA may modify these requirements to include law and technology, educating attorneys on generative AI should also be required under the ethics and professionalism module.
I. ABA Rules of Professional Responsibility Change
One possible recommendation is to update the ABA Model Rules of Professional Conduct. The use of generative AI has largely been without a framework in the ABA Rules of Professional Responsibility. Nevertheless, these rules serve as a guiding framework for attorneys, and their adaptation to the digital age is imperative.
First, the ABA should provide clear guidance on the use of generative AI in attorney-client communications to mitigate the risk of a privilege waiver. Moreover, the ABA should mandate training on how to interact with AI systems to leverage the benefits of technology while preserving the attorney-client privilege. This training can be achieved through CLE requirements. Further, a revised ABA framework can outline specific data and security standards that attorneys must adhere to when using generative AI. Moreover, this requirement would restrict attorneys from using systems that do not have adequate cybersecurity standards to secure confidential client information. Because using AI can present new conflicts of interest, ABA rules should incorporate provisions on how to manage AI-generated conflicts of interest. Finally, the ABA should consider establishing ethics review boards or committees to ensure attorneys are compliant with evolving technology standards.
VIII. Future Implications
The rapid advancement of technology, particularly in the realm of generative AI, has disrupted the legal profession. Often thought to be stagnant, the legal profession is faced with many questions on how to effectively leverage technology. Law firms are using generative AI to enhance their competitive advantages and streamline time-consuming tasks. While this technology has been shown to support attorneys in mundane responsibilities such as drafting documents and email management, it also presents many ethical and legal questions. Moreover, generative AI can assist indigent individuals who otherwise may not be able to afford legal services.
Attorneys have an ethical obligation to keep abreast of emerging technologies. This ethical requirement poses interesting questions for the future of legal practice. As AI continues to develop, will it become an ethical violation not to use AI? If not an ethical violation, will the duty of care and diligence for attorneys increase? If an attorney or law firm chooses not to use AI, when using AI could have been more accurate and saved clients’ money, is the lawyer subject to discipline for lack of competence? Further, must an attorney inform opposing counsel if the attorney intends to use AI? Lawyers also must grapple with the ethics of billing hours when they use generative AI. Each of these novel questions will soon become a reality.
Although it is not an imminent reality, AI has the potential to replace some lawyers in some contexts. If this potential is realized, many challenges with the attorney-client privilege will arise. Questions arise considering whether the generative AI should adhere to the ethical standards imposed on human attorneys, whether it would be considered a lawyer, and how it could navigate situations involving opposing parties without violating the ABA Model Rules of Professional Conduct. In a world where AI replaces lawyers, the entire notion of attorney-client privilege may be called into question. As technology continues to develop, these questions linger, demanding thoughtful consideration. Even if AI does not replace lawyers, generative AI will likely become a widespread tool used by society at large.
Generative AI has sparked significant changes within the legal profession in a matter of months. As technology continues to advance, the legal profession will continue to be challenged. Quantum computing, an emerging technology that uses quantum mechanics to solve problems that are too complex for computers today, is likely to have impacts on generative AI. Quantum computers promise to turbocharge the evolution of AI, allowing AI systems to advance even more rapidly. Currently, quantum computers are used for “simulations of particle behavior, optimization problems involving multiple variables, [and] accelerating the training of AI algorithms” to name a few. While they have the potential to change the legal landscape, quantum computers have significant security concerns and could lead to increased litigation. Moreover, the U.S. government has identified quantum computing as a national security concern.
For the sake of this Comment, here is ChatGPT’s final words on the matter: “ChatGPT walks into a bar and the bartender asks, ‘Hey, are you a lawyer?’ ChatGPT responds, ‘Nope, but I can assist with your legal troubles faster than you can say “lawsuit”!’ And the best part? No hourly fees, just tips in terabytes!”
Conclusion
Technology is constantly evolving. The intersection of ChatGPT and attorney-client privilege represents a compelling and evolving area within the legal landscape. As explored throughout this Comment, the advent of generative AI, including ChatGPT, raises fundamental questions about the long-standing attorney-client privilege. The technology offers advantages in terms of efficiency and the legal profession’s accessibility while challenging established legal principles.
This Comment has explored questions relating to the disclosure of client information to ChatGPT, such as whether an attorney may disclose the information, whether a client may input the information into ChatGPT while undergoing representation, and whether a client who discloses the information to ChatGPT and later seeks the advice of an attorney still retains the privilege. Finally, this Comment explored the question of privilege if AI were to take over the legal profession.
Ultimately, ChatGPT and other generative AI systems are reshaping the legal profession, and the attorney-client privilege and Model Rules of Professional Conduct must evolve. This Comment proposes several recommendations for the legal profession to navigate the technology without compromising privilege to better serve the interests of justice and the represented clients.
Attorney client privilege is at the legal profession’s core. Generative AI may potentially save attorneys time and resources; however, imputing sensitive client information into a generative AI system may compromise the attorney-client privilege. So long as ChatGPT is trained with user input, disclosing client information to it likely waives the attorney-client privilege. Nevertheless, there is a fine line between disclosing specific client information and general information regarding legal claims. It is likely within an attorney’s ethical conduct to disclose general, vague information about a client’s case to ChatGPT, so long as a reasonable person would not be able to guess the specific details of the case. Because ChatGPT and similar generative AI tools are becoming increasingly prevalent and accurate, it is within an attorney’s obligation to stay abreast of these technologies and learn how to use them effectively.
