AI, legal privilege and the new governance challenge for UK Boards

“Don’t worry about it, we’ve had a customer complaint, but I asked AI to review their contract and it’s all dealt with.”

It’s a sentence that should strike fear into the heart of any legal team of any sized commercial business or corporation. From our conversations with GCs and Heads of Legal, it’s clear that there is a growing trend of well-intentioned but misguided AI use in legal matters. Well-meaning individuals are increasingly turning to ChatGPT or similar to check a legal position, contract or run through a potential dispute scenario and, in doing so, are unwittingly undermining legal professional privilege (LPP). This can have catastrophic consequences and ultimately the potential to destroy any future litigation strategy.

Today’s AI shortcut could be tomorrow’s courtroom problem…

The greater access to consumer grade AI tools has meant that individuals can generate legal complaints, even if the legal merit of the AI output may be questionable. Those same consumer tools can also seem a quick and effective solution for well-meaning staff to address or research potential legal problems, without the time cost of involving internal legal teams. The unintended consequence, however, is the potential irreversible loss of legal privilege.

AI and legal privilege: state of play

UK case law on AI tools and how they affect privilege has been limited, but the latest judiciary guidance from October 2025 is clear that “you should treat all public AI tools as being capable of making public anything entered into them”. This means that the use of consumer AI tools could result in confidentiality being lost as soon as privileged information is inputted.

As in-house AI solutions continue to emerge, there will be further questions asked of the nature of privilege when AI outputs are involved, but for now the same long- established conditions are required for litigation privilege. Specifically, that litigation must be in progress or in contemplation, and that communications must have been made for the sole or dominant purpose of conducting that litigation.

AI: increasingly undermining legal defence

Mismanagement of the use of AI is sufficient to cause tremors across an entire business. While any legal team should be immediately familiar with the potential consequences of jeopardising legal privilege, these may not be readily understood by a legal team member they delegate to, or a divisional or regional manager looking to “save bothering legal”. Even a company’s well-meaning CFO could find themselves caught up in legal privilege uncertainty after trying to streamline matters with AI usage.

Commercial ramifications

A complaint from a large contractor or singular consumer alike (by way of example) could therefore present damaging ramifications. If legal advice or litigation privilege is not established, then a business runs the risk of communications becoming disclosable, making boards and legal teams vulnerable to having to disclose any AI outputs to opposing parties, regulators, or prosecutors who are able to demand access to any prompts and AI-generated output. In the course of a dispute, this immediately undermines litigation strategy and could have further commercial consequences.

Every scenario will differ, but even if there is an argument to be made for privilege to be retained (which can be hard to achieve when the individuals involved are not lawyers), there are clear and obvious downsides. Significant time and costs are expended getting in the weeds of a privilege dispute, which can distract from the key issues in dispute and can have a significant impact on a party’s risk profile. With so many moving parts, even with what may seem a watertight internal policy on the use of AI, there is considerable risk attached.

Internal questions to ask (now)

From a Board-level perspective, there are several questions that boards should consider:

• Are our internal AI policies robust and is everyone aware them?

• Is every new employee inducted effectively on company use of AI?

• Do my employees know that any whisper of a legal issue should be escalated to the in house or external legal teams?

• Do we have effective reporting lines for raising concerns? Do colleagues know how and when to instruct the legal team effectively?

• Do we have a standard policy that is issued by the legal team as soon as there is the potential for a dispute, in particular in relation to the use of AI and the creation of documents?

• Do we believe there is no chance employees are waiving legal privilege without realising it?

If you answered ‘no’ to any of the above, then AI needs rapidly escalating to the top of your next Board agenda.

Beware the risks of the Annual Report!

This is a major AI governance risk hiding in plain sight. Annual reports rightly require businesses to conduct thorough risk management analysis. However, a business identifying risks associated with the course of their work could inadvertently leave any associated documents or communications subject to disclosure. If the risk management process is not leveraged with legal teams sufficiently involved, then any privilege that could attract to the potential risks and management of those risks may not be in place, and, ironically, the risk management exercise itself becomes a risk to be managed.