TLDR: OpenAI CEO Sam Altman has confirmed that conversations with public versions of ChatGPT are not protected by legal confidentiality and are discoverable in legal proceedings. This warning serves as a critical alert for legal and compliance firms about the risks of breaching attorney-client privilege. The article urges firms to immediately audit and restrict the use of public AI for client work, emphasizing the need for formal policies and a shift towards secure, enterprise-grade solutions.
In a stark admission that reverberates through the legal and compliance sectors, OpenAI CEO Sam Altman has explicitly confirmed that conversations with public versions of ChatGPT are not protected by legal confidentiality. He warned that these chats are discoverable and could be produced in legal proceedings, a statement that shatters any remaining illusions about the privacy of public generative AI tools. For legal and professional services firms, this is not just a news item; it’s a red alert. It signals an immediate and urgent need to audit and severely restrict the use of these platforms for any client-related work to mitigate the catastrophic risk of breaching attorney-client privilege.
The End of Plausible Deniability
For months, cautious voices in legal tech have warned about the inherent risks of inputting sensitive information into public AI models. However, Altman’s statement, coming directly from the source, elevates this from a theoretical concern to an undeniable fact. The era of plausible deniability is over. Any law firm, legal department, or compliance team that continues to permit the use of public AI tools for substantive work without robust safeguards is now acting in direct opposition to a clear warning from the tool’s own creator. This admission effectively serves as a notice, making it significantly harder to defend a potential breach as an unforeseeable accident.
Discoverable by Design: How Public AI Waives Privilege
Understanding why these conversations are not confidential is critical. Attorney-client privilege is fragile; it is waived the moment protected information is shared with a third party. When an attorney, paralegal, or any firm employee inputs client-related queries into a public AI tool, they are disclosing that information to a third party: the AI provider. Public-facing generative AI models often use input data to train their systems, meaning sensitive details could be retained and potentially resurface in responses to other users. This act alone can obliterate privilege. Compounding this risk is the reality of legal discovery. As evidenced by court orders in ongoing litigation against AI companies, firms like OpenAI may be required to preserve all user chats—even those users have attempted to delete—making them a treasure trove for opposing counsel in future legal actions.
A Minefield for Ethical Obligations and Compliance
Altman’s warning has profound implications for a lawyer’s core ethical duties. The ABA Model Rules and their state-level equivalents demand strict adherence to principles that are directly challenged by the careless use of public AI:
- Duty of Confidentiality (Rule 1.6): This cornerstone of the legal profession requires lawyers to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of client information. Using a public AI tool that logs and learns from sensitive data is arguably a failure to make such reasonable efforts.
- Duty of Competence (Rule 1.1): Modern legal competence includes technological competence. An attorney’s duty now extends to understanding the tools they use, including the significant privacy and privilege risks associated with public AI platforms.
- Duty to Supervise (Rules 5.1 and 5.3): Partners and supervising attorneys have a duty to ensure that all firm employees, including junior associates and paralegals, comply with professional obligations. This responsibility now squarely includes oversight of AI tool usage to prevent well-meaning but uninformed staff from exposing the firm to liability.
For compliance officers, the landscape is equally treacherous. The use of public AI can create immediate conflicts with data privacy regulations like GDPR and CCPA, which impose strict rules on the processing and transfer of personal data.
Your Immediate Action Plan: Audit, Restrict, and Educate
This moment demands decisive action, not tentative policy memos. Legal and compliance leaders must act now to protect their clients and their firms.
- Declare an Immediate Moratorium: Temporarily halt the use of all public, non-enterprise generative AI tools for any work involving client information, pending a full review.
- Conduct a Comprehensive Audit: You cannot manage what you do not measure. Deploy tools and surveys to understand precisely which AI platforms are being used within your organization, by whom, and for what purposes.
- Establish a Formal AI Use Policy: Draft and implement a clear, unambiguous policy that distinguishes between high-risk public tools and secure, enterprise-grade AI solutions that may offer contractual privacy and data protection. This policy must be unequivocal about prohibiting client data input into public platforms.
- Educate Your Entire Team: A policy is only effective if it is understood and followed. Conduct mandatory training for all personnel on the risks of AI and the specifics of your new policy. Emphasize that this is a matter of ethical obligation and risk management, not a restriction on innovation.
The Path Forward: From Prohibiting Risk to Procuring Solutions
The clear message from OpenAI’s CEO is not that AI has no place in the legal profession. On the contrary, the technology holds immense promise for enhancing efficiency and delivering value. The takeaway is that the era of casual, unregulated experimentation with public-facing AI tools in a professional legal context is definitively over. The forward-looking strategy is not to shun AI, but to engage with it through a lens of security, confidentiality, and professional responsibility. The focus must now shift to vetting and adopting enterprise-grade AI solutions specifically designed for the legal industry—platforms that offer private instances, robust data encryption, and contractual guarantees that your firm’s and your clients’ data will remain confidential and privileged.
Also Read:
