Using AI Tools Without Waiving Privilege
ChatGPT, Copilot, and the next ten tools your associates will install. A framework for AI adoption that keeps work product protected.
The privilege question, simplified
If a third party can read the prompt or the output, the privilege analysis is the same as forwarding the document to that third party. Enterprise tiers with no-training contractual terms and zero-retention APIs are the floor.
What to allow, what to block
Allow: enterprise tenants with signed BAAs or equivalent legal-sector data processing addenda, audit logs, and tenant-scoped data isolation.
Block: free-tier consumer accounts, browser extensions that exfiltrate page content, and any tool that cannot produce a current SOC 2 Type II.
Training the firm
The policy is only as good as the partner who routes around it. Make the sanctioned tools faster than the unsanctioned ones — that is the only enforcement that works.
Free Assessment
See what an attacker sees.
Run a no-obligation external attack-surface scan on your firm's domain in under two minutes.
Start the assessment
