Privilege, training terms, and what a February 2026 federal decision changed about using AI on client matters.
Seventy-nine percent of legal professionals now use AI in their work, and solo and small-firm lawyers have moved decisively toward general-purpose chat tools — Claude and ChatGPT — rather than legal-specific platforms. The productivity case is settled. The question that actually keeps lawyers from putting client matters through these tools is the right one: is it confidential?
For most of the AI era the honest answer was "probably, be careful." In February 2026 a federal court gave the profession something better than a vibe: a holding. This article covers what that decision actually held (it is narrower — and more useful — than the scare headlines), what the ethics framework expects, and the specific, checkable configuration that separates confidential AI use from the kind that ends up as Exhibit A.
In February 2026, the U.S. District Court for the Southern District of New York held that dozens of AI-generated documents were not protected by privilege. The court's reasoning is the part every practitioner should read closely: the problem was not that AI was used. The problem was the consumer terms of service the tool was used under — terms that permitted the vendor to log conversations, use them to train models, and disclose them to third parties. Sharing confidential material under terms like that, the court concluded, is inconsistent with a reasonable expectation of confidentiality — and without that expectation, privilege fails.
Two implications follow. First, the decision is not an anti-AI holding — it is a read-the-terms holding, and it gives careful lawyers a map. Second, the distinction it turns on is one most firms have never actually checked: whether the accounts their AI work runs through are consumer accounts or commercial ones.
| Consumer chat account | Commercial / API terms | |
|---|---|---|
| Training on your inputs | Often permitted by default unless you find and enable the opt-out — Anthropic's consumer terms (August 2025) train on Pro/Max chats by default | Typically excluded by the agreement |
| Human review of inputs | Often reserved in the terms of service | Narrower, contractually bounded |
| Retention | Long or indefinite | Shorter, contractual |
| What a court sees | The Heppner problem: terms inconsistent with an expectation of confidentiality | Counsel-directed use under confidentiality-consistent terms |
Vendor terms change. This table describes patterns as of mid-2026, not any vendor's current agreement — verify yours.
Note what this means for the most common setup in small firms: a personal Pro subscription used for a mix of personal and client work. That account's defaults are precisely the fact pattern the SDNY court found fatal. Fixing it costs either fifteen minutes (verify the training opt-out is actually enabled) or a plan change (API or commercial terms, where training is excluded by contract rather than by a toggle you have to remember).
ABA Formal Opinion 512 (July 2024) remains the controlling national framework for generative AI, and it maps the familiar duties onto the new tools: competence (understand the tool's limits), confidentiality (vet where client information goes — the terms question above), communication (disclosure to clients is fact-specific and jurisdiction-dependent), supervision (staff and vendors using AI are your responsibility), and candor (verify before you file — fabricated citations remain the fastest route to a sanctions order).
The states have layered their own guidance on top — California's (the strictest, updated for agentic AI in May 2026), Florida's Opinion 24-1, New York's 2025-6, and Texas's Opinion 705 among them. The common thread across all of them matches the Heppner logic: the duty is to understand and control where client information goes and under what terms, not to avoid the technology.
If you want to score your own practice against these controls, we built a free ten-question self-audit — with a model AI-use policy skeleton, engagement-letter language, and the carrier-questionnaire prep list. Get the privilege self-audit here.
Claude is not inherently confidential or inherently risky for legal work — the configuration decides. Used through a default consumer account with training defaults untouched, it presents the Heppner fact pattern. Used under API or commercial terms, on infrastructure the lawyer controls, with attorney review of every output, it is among the most defensible ways to do AI-assisted drafting at volume — and Anthropic has leaned into the profession, shipping an official legal plugin suite in 2026.
That configuration gap is the reason Legal Skills HQ exists. Our members run a curated legal skill catalog on a private workspace in their own cloud account: no vendor middleman in the data path (we architecturally cannot see client documents — there is no Legal Skills HQ server to see them), and a setup process — we call it Legal Mode — that makes verifying no-training terms a required step rather than a toggle someone hopefully remembered. Every skill in the catalog outputs drafts for attorney review, with citation verification built into the research workflows.
It depends on the terms and configuration it runs under, not on the model itself. Consumer chat plans have historically permitted logging, human review, and default training — the exact features the SDNY court weighed against privilege. Commercial and API terms typically exclude training and shorten retention. The confidential-use playbook: commercial/no-training terms, a data path counsel controls, attorney review of every output.
No. The court held that documents produced under consumer terms permitting logging, training, and third-party disclosure were inconsistent with a reasonable expectation of confidentiality. The reasoning turns on the terms of use, not the technology. Counsel-directed use under confidentiality-consistent terms stands on different footing.
Plan-dependent. Anthropic's consumer terms (updated August 2025) permit training on Pro and Max conversations by default unless the account owner opts out. Commercial and API terms exclude training on inputs. Verify the current terms and your account's actual settings — "I think I opted out" is not verification.
ABA Opinion 512 treats communication as fact-specific, and state guidance varies — several bars expect disclosure or consent in some circumstances. Check your jurisdiction's opinion, and consider engagement-letter language describing AI-assisted work under no-training terms with attorney review. (The self-audit includes a draft clause.)
Run the four controls above, in order: verify your terms first (fifteen minutes, decides everything downstream), map the data path, name the reviewer, write the policy. Then pick one high-volume document workflow — contract drafting, discovery responses — and put the tool to work where review is already part of your process.
Legal Skills HQ preloads a private AI workspace — in your own cloud account, no vendor in the data path — with battle-tested skills for contract drafting, discovery responses, demand packages, and deposition summaries. Legal Mode makes no-training terms a required setup step. The founding cohort gets the entire catalog free during early access.
Join the founding member list Or start with the free privilege self-audit