9
Every privilege waiver story starts the same way: not with a subpoena, not with a motion to compel, but with a partner who needed a faster answer on a Tuesday afternoon. The draft went into a hosted AI tool. The tool returned a useful summary. The matter moved forward. And somewhere in that exchange, the firm’s most sensitive client work quietly left the walls of the firm.
That is the privilege waiver you didn’t see coming. It is not a dramatic courtroom confrontation. It is a routine workflow decision made in good faith, by a competent professional, with no idea that the keystroke carried legal consequences.
What you are actually doing when you paste
When you feed client material into a public or hosted AI service, you are not asking a question. You are transferring information to a third party under terms you have not read, on infrastructure you do not control, in a jurisdiction you cannot verify. The model does not keep your secret because it has no duty to. It has a terms-of-service agreement, and that is not the same thing.
The attorney-client privilege protects communications made in confidence for the purpose of legal advice. Confidence is the load-bearing element. The moment a communication is shared with a third party outside the privileged relationship, the confidence is broken — and with it, the privilege. A court does not need to find that the AI provider actually read the document. It needs to find that the client reasonably expected the communication to remain confidential, and that expectation is hard to defend once the material has been transmitted to an outside system.
The exposure is broader than you think
The risk is not limited to the dramatic case of a model regurgitating a client’s name. Consider what a hosted tool does with your input. It may retain prompts for training. It may route traffic through servers in jurisdictions with different disclosure rules. It may be accessible to the provider’s own staff, contractors, or support engineers. Each of these is a third party. Each one is a potential leak in the wall of confidence your privilege depends on.
And the exposure compounds. A conflict check run through a free tool, a deposition outline drafted in a browser tab, a settlement analysis summarized by a hosted assistant — each is a separate transfer, a separate break in confidence, a separate argument opposing counsel can raise. You do not lose privilege in one dramatic event. You lose it in a hundred small ones, none of which anyone flagged at the time.
Why the fix is architectural, not behavioral
The instinct is to respond with policy: a memo telling attorneys not to use hosted AI. That memo will fail, because the pressure that drove the partner to the tool will not disappear. The demand for faster, cheaper, better work is real. The answer is not to forbid the behavior. It is to make the safe behavior the easy behavior.
That means running AI where the data already lives — inside the firm’s own walls, on the firm’s own hardware, under the firm’s own control. When the model is on-premises, nothing leaves. There is no third party. There is no transfer. The confidence is preserved because the infrastructure never crossed the boundary in the first place.
This is the core of the sovereign approach: the moat is expertise, compliance, retrieval, and on-prem hardware. The model is a tool you own, not a service you rent. Your client’s material stays in your custody, subject to your controls, protected by the same walls that protect everything else you hold in confidence.
The privilege waiver you didn’t see coming is preventable. But it is only preventable if you close the door before the first paste — not after the first motion.
Start with the Confidential AI Exposure Checklist at 9tailsadvisory.com/checklist/. Nine lives. Zero leaks.