AI Platforms and Privilege Waiver: What Courts Are Deciding

A federal magistrate in the Northern District of California issued a discovery ruling in February 2026 that sent a quiet shockwave through legal operations teams: the court declined to protect a set of litigation strategy documents from disclosure, in part because they had been processed through a commercial AI platform whose terms of service permitted use of customer inputs for model improvement. The matter is under seal, and the underlying merits dispute is unrelated to AI — but the privilege ruling has circulated widely in legal tech circles because of what it signals. Courts are no longer treating AI vendor relationships as legally invisible. They are asking the same question privilege doctrine has always asked: did you voluntarily disclose this information to a third party in a way that is inconsistent with keeping it confidential?

That question is getting harder to answer when the third party is a large language model running on shared infrastructure.

The Doctrinal Fault Line Courts Are Navigating

Attorney-client privilege and the work-product doctrine share a common vulnerability: voluntary disclosure to a third party can destroy both protections. The classic formulation requires that communications be made in confidence and that confidentiality be maintained. Work product receives somewhat stronger protection — it can survive disclosure to some third parties without waiver, as long as disclosure wasn't to an adversary or someone likely to disclose to one — but it is not invincible.

Commercial AI platforms introduce a structural complication that courts are only beginning to work through systematically. When an associate pastes a litigation memo into ChatGPT, or uploads a contract to Harvey, or queries a document set through a cloud-based legal AI tool, several things happen simultaneously that have no clean analog in prior privilege case law:

• The input travels over the internet to infrastructure the firm does not control
• The vendor may retain the input for some period under its data retention policy
• The input may be used for model training, fine-tuning, or evaluation — depending on the specific product tier and terms
• The firm's employees may not know which of these things happened, or when

The February 2026 California ruling is not an outlier. At least two other district courts — one in the Southern District of New York, one in the Northern District of Illinois — have issued orders in Q1 2026 requiring parties to disclose which AI tools were used to process documents that are claimed as privileged, and to produce the relevant vendor agreements and data processing terms. Those aren't yet definitive privilege-waiver rulings, but the discovery posture itself signals that courts view the question as live and non-frivolous.

The practical implication: the mere act of using certain AI platforms may now be a discoverable fact in litigation, and the vendor's data handling practices may become evidence in a privilege dispute your firm didn't anticipate.

Why Terms of Service Are the Wrong Document to Be Reading

The instinctive response from legal ops teams when this issue surfaces is to pull up the vendor's terms of service, find the clause that says customer data is not used for training, and treat the problem as solved. That response is understandable and almost entirely inadequate.

Consider the structure of the problem:

The California ruling made this point explicitly, though in narrower terms: the court noted that the contractual relationship between the law firm and the AI vendor did not establish the kind of common-interest or confidential-relationship exception that would prevent disclosure from being characterized as voluntary. A ToS clause saying "we don't train on your data" is a representation from the vendor to the customer. It is not a legal finding, not a technical guarantee, and not binding on a court evaluating whether a disclosure occurred.

The more fundamental issue is that ToS documents describe policy; they don't describe architecture. Two platforms can have identical data-use clauses and radically different data flows. One might process everything locally within a customer-controlled environment. Another might send full document text to a shared inference endpoint, retain it in a request log for 30 days, and route it through three subprocessors in different jurisdictions. Both will have ToS language that sounds reassuring.

This is why the question managing partners should be asking — and increasingly, the question opposing counsel and courts will ask — is not "what does the terms of service say" but "show me the data flow diagram."

The Architectural Question Courts Are Forcing Into the Open

The emerging judicial scrutiny has a useful clarifying effect: it forces a technical question that most law firms have been avoiding. What actually happens to a document or prompt when it enters your AI platform?

For most commercial legal AI products — and this includes well-funded, well-regarded platforms — the honest answer involves some version of the following: the full document or full prompt is transmitted to a hosted LLM, processed there, and the response is returned. The firm's data touches infrastructure the firm does not control, under API terms the firm may not have negotiated directly, processed by a model the firm cannot audit.

That is not a scandal. It is a reasonable engineering choice for a hosted SaaS product. But it has a privilege consequence that courts are beginning to articulate.

The architectural alternative — and this is the distinction that matters legally, not just commercially — is a system where the full document corpus, the retrieval index, the agentic scaffolding, the permissions layer, and the client matter context all remain on firm-controlled infrastructure, and only the minimal retrieved content needed to answer a specific query is ever transmitted to an LLM provider, under API terms the firm controls directly.

Think of the difference this way:

Fully hosted model (typical SaaS legal AI):

Full document → Vendor cloud → LLM processing → Response
[Firm loses custody at step 2]

Retrieval-augmented architecture with firm-controlled index (RAG-native deployment):

Full document corpus → Firm-controlled index and vector store
Query → Retrieval layer (firm infrastructure) → Minimal relevant chunks → LLM API call
[Firm retains custody of corpus; only retrieved chunks leave the perimeter]

In the second architecture, what leaves firm infrastructure is not the client's M&A agreement, not the litigation strategy memo, not the full context of a matter. What leaves is a small number of text chunks — potentially a few hundred tokens — that are retrieved as relevant to a specific query, sent to the LLM under the firm's own API credentials, and not retained by the model provider beyond the inference call (under standard enterprise API terms from OpenAI, Anthropic, Google, and others, which explicitly exclude inputs from training).

This is not a data-handling promise from a vendor. It is a structural property of how the system is built. The firm doesn't need to trust that the vendor isn't training on their data, because the full documents never reach the vendor.

This architectural distinction is at the core of how private AI deployment should be evaluated — not as a premium feature, but as a privilege-preservation mechanism.

What the Circuit Split Means for AmLaw 200 Firms Right Now

As of Q1 2026, federal courts have not converged on a unified standard for AI-related privilege waiver. The rulings that have emerged are at the district court level, and they vary in how strictly they apply the voluntary-disclosure analysis to AI platform interactions. Some judges have been skeptical that using a legal AI tool, standing alone, constitutes privilege-defeating disclosure. Others have been more willing to look through the ToS to the actual data flow.

What this uncertainty means in practice:

• Discovery requests will increasingly include AI tool usage as a line of inquiry in privilege disputes. Expect "identify all AI platforms used to process documents withheld as privileged" to become standard boilerplate in 2026.
• In camera review of AI data flows is a live possibility in contested privilege disputes. If opposing counsel challenges your privilege log on AI grounds, you may need to demonstrate to a court what actually happened to the documents.
• Malpractice exposure is real and underappreciated. If a firm's use of a commercial AI platform contributes to a privilege waiver that damages a client, the malpractice analysis is straightforward. The question isn't whether courts have definitively ruled — it's whether the firm took reasonable precautions given known risk.
• Bar ethics opinions are accelerating. Several state bars issued formal guidance in 2025 on AI and competence obligations. The Q1 2026 rulings will likely accelerate formal ethics opinions specifically addressing privilege and confidentiality in AI contexts.

The firms most exposed are not the ones that have avoided AI entirely — those firms have a different set of competence problems. The most exposed firms are those that rolled out commercial AI broadly, without doing a data flow audit, and are now sitting on two years of potentially discoverable AI interactions. That is a significant portion of the AmLaw 200.

For a broader framework on managing these risks as AI becomes embedded in practice, the AI for law firms guide covers the governance layer in detail.

The Vendor Conversation You Need to Have Before the Next RFP

Legal ops teams and CIOs evaluating AI platforms in this environment need to restructure the due diligence process. The standard RFP template — security certifications, SOC 2, uptime SLAs, data residency promises — is necessary but not sufficient. The questions that matter for privilege analysis are architectural, and most vendors are not accustomed to answering them precisely.

Here is the due diligence framework that should be applied to every AI platform currently in use or under evaluation:

Tier 1: What Leaves the Firm's Infrastructure?

• Does the system send full documents to the LLM, or only retrieved chunks?
• What is the maximum token count of content that leaves firm infrastructure per query?
• Are full prompts (including system prompts with matter context) transmitted externally?
• Who controls the API credentials used for LLM calls — the firm or the vendor?

Tier 2: What Is Retained Externally?

• What is the retention period for inputs at the LLM provider level?
• Is the firm on an enterprise API tier that excludes inputs from training?
• Are inputs retained in the vendor's own logging infrastructure, separate from the LLM provider?
• What subprocessors receive any portion of the input?

Tier 3: What Does the Firm Control?

• Where does the retrieval index and vector store reside?
• Can the firm delete specific documents from the index and confirm deletion?
• Does the firm have audit logs of what was retrieved and transmitted for each query?
• Can the firm produce a data flow diagram for opposing counsel or a court if required?

The ability to answer Tier 3 questions confidently — and to produce documentation — may be the difference between a manageable privilege dispute and a waiver finding. Platforms like RAGbase Legal are built on the premise that the agentic layer, the connectors, the retrieval index, the vector stores, the permissions model, and the workflow automation all live on the firm's own infrastructure. What may move to an LLM provider — under the firm's API terms, with standard enterprise data protections — is the minimal retrieved context needed to generate a response. That architectural choice isn't marketing positioning. It's a direct response to the privilege analysis courts are now conducting.

The case search functionality, for example, operates entirely within the firm's retrieval layer. The LLM sees only the retrieved case excerpts relevant to a query, not the underlying matter file or the client context that informed the search.

The Deeper Issue: Custody as a Legal Concept, Not Just a Security One

Law firms have spent decades thinking about document custody in the context of physical files, then electronic files, then cloud storage. The mental model — the firm controls the documents, the documents don't go anywhere without the firm's authorization — has been foundational to privilege analysis.

Commercial AI, as typically deployed, breaks that mental model without announcing that it has done so. When an associate uses a hosted AI tool to analyze a contract, they experience it as a local, private interaction. The documents feel like they stayed in-house. In architectural reality, they may have traversed multiple cloud environments, been processed by multiple models, and been retained in multiple logging systems — none of which the firm controls or can fully audit.

The judicial system is in the early stages of reconciling privilege doctrine with this architectural reality. The February 2026 California ruling will not be the last word. There will be circuit-level opinions. There will likely be bar ethics guidance that cites specific architectural features as relevant to the confidentiality analysis. There may be standing committee guidance from the ABA.

But firms that wait for doctrinal clarity before acting on architectural risk are making the same mistake that firms made with email encryption in the 1990s — waiting for a court to tell them that unencrypted email was a problem before treating it as one. The prudent standard is not "is there a definitive ruling against this" but "given what courts are examining, does our current AI architecture preserve the structural conditions for privilege?"

The practical starting point is not a platform switch. It is a data flow audit of every AI tool currently in use at your firm — a map of what leaves firm infrastructure, when, under whose API terms, retained by whom, for how long. Most firms that undertake that audit discover that their actual data flows are materially different from what they assumed based on vendor marketing. The firms that have already done this work are in a significantly better position when a privilege challenge surfaces in discovery. If your current AI vendor cannot produce a precise, technically accurate data flow diagram — not a security whitepaper, not a ToS summary, but an actual diagram of what moves where — that inability is itself a meaningful data point about the custody question courts are beginning to ask.