The SDNY Privilege Ruling: A Wake-Up Call on GenAI Vendor Terms

In February 2026, a Southern District of New York judge did something no legal AI vendor's marketing deck had prepared partners for: she ordered a set of internal work product documents produced to opposing counsel, not because the legal analysis inside them was weak, but because the drafting tool's terms of service let the vendor keep and train on what was typed into it. Nine months later, the ruling has become shorthand in GC memos and malpractice carrier questionnaires alike. "Since the SDNY ruling earlier this year, firms have been re-examining every GenAI contract line by line" is now a sentence you'll hear in nearly every legal ops meeting that touches procurement.

The decision didn't invent a new doctrine. It applied a very old one — the confidentiality requirement underlying both attorney-client privilege and work-product protection — to a new fact pattern: a vendor contract that reserved the right to retain, access, and train on submitted prompts and documents. The court's reasoning was blunt. If a third party can contractually access and reuse your client's confidential material whenever it wants, you have not maintained the secrecy the privilege demands, regardless of how sophisticated or well-intentioned the tool is. That reasoning is now precedent, and it reframes legal AI procurement as a question of architecture, not just capability.

What Actually Happened, and Why It Traveled So Fast

The underlying dispute involved a commercial litigation team that used a general-purpose GenAI assistant — not a purpose-built legal platform, but a broadly available consumer-tier tool — to draft internal strategy memos and summarize deposition excerpts. Opposing counsel moved to compel production, arguing that the vendor's standard terms of service, which permitted retention and model-training use of submitted content absent an enterprise opt-out, meant the firm had voluntarily disclosed the material to an unaffiliated third party with no confidentiality obligation running back to the client.

The court agreed. Three findings from the opinion are doing most of the work in how firms are now re-reading their AI contracts:

• Contractual reservation of rights is sufficient, even without proof of actual training. The court didn't require evidence that the vendor had in fact used the firm's prompts to train a model. The mere contractual right to do so, absent a negotiated carve-out, was enough to defeat the confidentiality element.
• "Enterprise" branding doesn't cure a consumer-grade data policy. The tool in question was marketed for professional use, but the firm had never executed the vendor's enterprise agreement with its stricter data-handling terms — it was operating under the default click-through terms, which is the fact pattern researchers believe mirrors how a large share of AI-at-work usage happens.
• The waiver reached beyond the specific memo at issue. Because the same tool, under the same terms, had been used across a cluster of related work product, the court's order swept in additional documents the moving party hadn't specifically identified, on the theory that the confidentiality failure was systemic to the tool's use, not confined to one file.

That third finding is why the case traveled from a niche e-discovery bulletin into managing partner briefings. It wasn't about one bad memo. It was about the tool.

The Confidentiality Test Courts Are Now Applying

Strip away the procedural specifics and the test emerging from this line of cases is fairly mechanical, and it maps directly onto something firms can audit today: does the vendor's contract contain an enforceable, firm-specific no-retention and no-training commitment, or does it reserve discretionary rights to the vendor?

The pattern is consistent with earlier privilege scrutiny of cloud-based legal tools — the kind of analysis covered in our case search research on how courts treat AI-assisted work product — but the SDNY ruling is the first to treat the contractual terms themselves, rather than actual misuse, as the dispositive fact. That's a meaningfully lower bar for a privilege challenge, and it's why in-house counsel at several AmLaw 200 firms have reportedly asked procurement teams to re-run every active GenAI vendor contract through exactly this five-row test.

Where the Major Legal AI Platforms Actually Stand

Not every tool in the market carries this exposure, and it would be inaccurate to suggest otherwise. Purpose-built legal AI platforms — Harvey, CoCounsel, Lexis+ Protégé, Legora — generally operate under enterprise agreements that include no-training and confidentiality commitments as a baseline condition of selling into the legal market; that's table stakes for firms that have done basic vendor diligence. The risk the SDNY ruling highlights sits at two other points in the stack:

• General-purpose consumer tools used informally by individual attorneys, including ad hoc use of ChatGPT or Claude's consumer and even some Cowork-style tiers, where the default terms of service — not a negotiated enterprise rider — govern, and where an individual associate may not realize the distinction matters.
• "Enterprise" agreements that firms sign but don't fully map, where the no-training clause exists on paper but the firm hasn't verified what data actually leaves its environment, how long it's retained upstream, or whether sub-processors are bound by the same terms.
• Shared-cloud architectures generally, where even with strong contractual terms, the firm's full document corpus, chat histories, and agent logs live on vendor infrastructure — which means the firm's privilege posture is only as good as that one contract, forever, with no architectural backstop if the vendor changes its terms, gets acquired, or suffers a breach.

That last point is the one procurement teams tend to underweight. A contract is a promise. An architecture is a fact. The SDNY ruling rewards firms that can point to the fact, not just the promise.

Why Architecture, Not Just Contract Language, Is the Real Hedge

Here's the distinction that's easy to lose in the contract-review exercise: even a well-negotiated no-training clause with a shared-cloud vendor means the firm's full documents, embeddings, and interaction logs still reside on infrastructure the firm doesn't control. The firm is trusting the vendor's enforcement of its own policy, its own security posture, and its own longevity as a company. That's not a reason to panic — it's a reason to ask what the next layer of protection looks like for the matters where the stakes justify it.

This is the structural problem RAGbase Legal's private AI deployment architecture was built around, and it's worth being precise about what "private" means here, because the honest answer isn't "we never touch an LLM provider." RAGbase Legal can and does connect to external model providers, including the same frontier models firms already use elsewhere. The difference is what crosses the boundary:

• What stays on the firm's own infrastructure, under the firm's own permissions and audit controls: the full document corpus, the retrieval index and vector store, the agentic workflow logic, connector credentials, access logs, and every record of who queried what and when.
• What is minimized and sent externally, only when a query requires it: the small set of retrieved text chunks relevant to that specific question, transmitted to the model provider under the firm's own negotiated API terms — terms the firm selects and can audit, rather than inheriting a consumer product's default data-use policy by default.

Under the SDNY court's test, that distinction matters enormously. A discovery motion asking "what did you disclose to the vendor, and under what terms did the vendor have the right to retain or train on it" has a very different answer when the disclosure is a handful of retrieved paragraphs under a firm-negotiated API agreement than when it's the full memo, deposition transcript, or client file uploaded wholesale into a consumer interface. The firm controls the contract on the piece that actually leaves the building, and the vast majority of the privileged material never leaves at all.

A Practical Due-Diligence Checklist

For firms re-examining their GenAI stack in the wake of this ruling, the audit doesn't need to be exotic. It needs to be systematic:

1. Inventory every GenAI tool in active use, including shadow IT — individual attorney subscriptions to consumer tools that never went through procurement. Industry surveys have repeatedly found adoption gaps between sanctioned tools and actual usage; our analysis of the 98% adoption gap covers why this inventory step is harder than it sounds.
2. Pull the actual contract, not the marketing page, for each tool, and check specifically for retention windows, training rights, sub-processor flow-down, and whether the enterprise terms were actually executed versus defaulted to.
3. Map what data physically leaves the firm's environment for each workflow — full document upload versus minimized retrieval — and flag any tool where the answer is "the whole file."
4. Segment by matter sensitivity. Not every workflow needs the strictest architecture; routine research may tolerate a shared-cloud tool with solid contractual terms, while privileged strategy work, M&A diligence, and litigation hold material warrant the private-infrastructure tier.
5. Document the decision. If a privilege challenge comes, a firm that can show a documented, risk-tiered AI governance policy is in a dramatically stronger position than one that can only say "we trusted the vendor's terms page."

This kind of tiering — not a blanket ban on cloud AI, but a deliberate match between tool architecture and matter sensitivity — is the approach we walk through in more depth in our AI for law firms guide.

What This Means Going Forward

The SDNY ruling is unlikely to be the last word. Expect appellate courts to refine exactly how much contractual ambiguity is enough to defeat confidentiality, and expect vendors across the market — including the consumer-facing tiers of major AI labs — to tighten enterprise terms in response, because no serious legal AI vendor wants to be the next cited case. Some of that tightening is already visible: enterprise agreements increasingly lead with no-training language as a headline feature rather than a buried clause.

But the deeper shift is in how sophisticated buyers evaluate legal AI procurement. Contract language is necessary and, for most day-to-day workflows, probably sufficient. For the matters where a privilege challenge would be catastrophic — bet-the-company litigation, sensitive internal investigations, regulatory work — relying solely on a vendor's promise not to retain or train on data is a single point of failure that courts have now shown a willingness to test. An architecture where the firm controls the corpus, the logs, and the retrieval layer, and exposes only minimized chunks to a model under terms the firm itself negotiated, doesn't just reduce risk. It gives the firm an affirmative, demonstrable answer the next time a judge asks exactly what left the building and under what terms.

If your firm hasn't yet run its GenAI vendor stack through a confidentiality-term audit since this ruling, that's the first conversation worth having with IT, procurement, and the GC's office together — before the next discovery motion forces the question.