Nothing about your duty of confidentiality changes because the third party is a model. What changes is how easy the breach has become: one paste, no file, no email, no trace. For a professional-services firm the duty arrives from three places at once, each with a different cure. A licensing body wants a vendor contract or client consent. A client agreement wants whatever it says. A statute wants paper signed before processing. Satisfy all three and you still have the part no document covers: whether the person with a client deck open at 6pm can tell that this file does not belong in that window.
Three duties, not one
Most firms treat confidentiality as one rule, then find during a client security review that they were holding three. Each bites in a different place and has a different cure.
| Source | What it actually says | What satisfies it |
|---|---|---|
| Licensing or professional body | No disclosure to a third party without consent, with a contractual alternative in some codes | A vendor confidentiality agreement or client consent, plus evidence you chose one |
| Client contract or engagement letter | Whatever was negotiated: subprocessor lists, data residency, notice duties, sometimes a flat ban | Reading the clause before the first prompt, then matching the tool to it |
| Statute or regulation | Consent or signed paper before processing, with penalties attached | The executed agreement, dated before the first client file |
The licensing row is the one people quote and read least closely. For lawyers, ABA Formal Opinion 512, issued 29 July 2024, reads six existing duties into generative AI use and names the confidentiality rules it touches: Model Rule 1.6 for current clients, 1.9(c) for former clients, and 1.18(b) for prospective clients. That breadth catches firms off guard. An intake memo from someone who never retained you is covered, and so is a matter closed four years ago.
For accountants the equivalent is AICPA Code of Professional Conduct 1.700.001, which bars disclosing confidential client information without specific client consent, read with interpretation 1.700.040 on third-party service providers. Tax work carries a statute on top. IRC §7216 makes knowing or reckless disclosure of tax return information a misdemeanor, punishable by up to a year in prison, a fine of up to $1,000, or both. The civil penalty under §6713 is $250 per disclosure, capped at $10,000 a year. Those numbers are small. The license is not.
Consultancies, agencies, engineering practices, recruiters and advisory firms sit in a harder spot. No licensing body, so the whole duty lives in the client contract, where it is specific, varied, and unread after signature.
The moment a prompt becomes a disclosure
The question underneath this is when an input leaves your control. Three vectors, and firms worry about the wrong one.
Training ingestion. On consumer tiers, inputs may be used to improve the model unless someone found the setting. Most feared, easiest to close with a purchase.
Sub-processing. The query is routed to downstream vendors nobody on your side vetted. If your client contract carries an approved-subprocessor list, this is the clause you are breaching, and careful prompting does not fix it.
Retention. Stored prompts become a corpus that is discoverable, subpoenable and breachable. The sharpest case is not a hack. In The New York Times v. OpenAI, a magistrate judge ordered the preservation of output log data that would otherwise have been deleted. Consumer-tier chats and API traffic without a zero-retention amendment fell inside that order; enterprise and zero-data-retention accounts sat outside it. A copyright fight between two companies you have never dealt with reached into the retention policy of whichever account your staff happened to be using. Tier decided whether it reached yours, which is the full argument in our comparison of enterprise AI accounts and consumer logins.
An inspection product does not close any of this. A paste creates no file-movement or mail-flow event, and the controls that do exist have published limits, as our look at data-loss prevention for AI assistants sets out.
A federal court has now taken privilege away
For anyone treating this as theoretical, February 2026 ended that. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled from the bench on 10 February 2026, with a written memorandum on 17 February, that documents a defendant generated using the public version of Claude carried neither attorney-client privilege nor work-product protection. He had used it on his own initiative, after retaining counsel, to work through the charges he expected.
Three holdings matter even far from criminal defense.
- The platform is a third party. No reasonable expectation of confidentiality existed where the privacy policy reserved rights to collect data and share it, including with government authorities.
- Work product needs counsel’s direction. Material prepared independently, not by or at the behest of a lawyer, is not work product, however legal its subject.
- You cannot cure it later. Sending the output to counsel afterward did not make it privileged. Read that one twice: it turns a bad habit into a permanent loss, which is why the control sits before the paste rather than after it.
The ruling made no finding that a business-tier tool would have preserved privilege, and nobody should claim that protection exists until a court says so. What the facts establish is who causes these losses: a client, under pressure, on a free account. Any firm that gives clients homework between meetings now has a reason to say something in writing.
Contract or consent: pick the route and date it
This is the distinction almost every guidance document leaves buried.
AICPA interpretation 1.700.040 gives two routes before client information reaches a third-party service provider. Either you hold a contractual agreement requiring the provider to keep it confidential, with reasonable assurance of procedures against unauthorized release, or you obtain specific client consent. It is an or. A firm with the right vendor paper does not need to chase consent client by client.
The legal side is stricter in one way. ABA 512 concludes that because many self-learning tools can lead directly or indirectly to disclosure of information relating to a representation, informed client consent is required before inputting it. Then it closes the shortcut: adding general, boiler-plate provisions to engagement letters purporting to authorize generative AI use is not informed consent. New York City Bar Formal Opinion 2024-5, issued 7 August 2024, takes the same line and separates a firm’s closed systems from tools that share inputs with third parties. It also says terms of use should be re-read periodically, because the vendor changes them and your consent was given against the old ones.
So: read the client contract, choose the route, get the paper, then write down which route you chose and why. That last step is what an insurer or client auditor asks for, and it takes an afternoon. Costs and sequencing are in our guide to what it costs to get an AI use policy written and rolled out.
Your clients are less squeamish than your policy assumes
Firms default to silence because silence feels safe. The client-side data says it is the expensive option.
Thomson Reuters surveyed more than 1,500 professionals for its 2026 AI in Professional Services Report. Organizational generative AI use came in at 40%, up from 22% a year earlier, with more than 80% of users working with it weekly. The finding that should reset your posture sits on the buyer’s side: two-thirds of corporate respondents want their outside firms to use AI, and fewer than 20% will mandate it. Clients want the efficiency and will not put permission in writing unless you raise it.
Describe your controls in two paragraphs: which tools are sanctioned, what the vendor terms say, who reviews output, how staff were trained. It answers a question competitors avoid and produces the artifact procurement asks for anyway.
The rules of engagement, on one page
A nine-page acceptable-use appendix is not a control, because nobody recalls page six with a deadline running. What works is short enough to hold in your head: named categories, one destination each, one approval path.
| Material | Approved destination | Why |
|---|---|---|
| Client-identifying documents, deal papers, financials | Administered firm account only | Contract and licensing exposure both land here |
| Tax return information | Administered account, §7216 position settled first | Criminal statute, not a preference |
| Health information | Administered account, vendor agreement signed first | Paper must predate processing |
| Prospective and former client material | Same rule as current clients | The duty reaches both |
| Internal drafts with no client identifiers | Administered account | Cheap to make the default |
| Public or published material | Any sanctioned tool | Do not spend judgment here |
Two lines belong underneath it. Where to ask: a named channel with a promised response time, because a rule with no route to “yes” is one people route around. And the recording carve-out: a transcription assistant on a client call captures confidential talk passively and triggers all-party consent recording statutes, a separate body of law with criminal exposure in some states. Decide on bots in advance.
Who the rule binds
The supervision rules do real work here. ABA 512 names Model Rules 5.1 and 5.3, so partners answer for the AI use of associates and nonlawyer staff alike. A paralegal pasting a client contract into a personal account is the firm’s problem. Partners who want the oversight framing rather than the configuration detail should start with the AI governance training options for leaders and boards.
Three groups get missed in nearly every rollout: contractors and fractional staff working from their own tools, subcontracted specialists who may be a sub-processor your client never approved, and clients themselves. A line in the engagement letter about what not to run through a public assistant is the cheapest protection here. On who should draft this, we compared the options in hiring help for AI policy.
The five-second call no document makes for you
Everything above is paper and configuration. It can be done in a month and does not touch the exposure that produces a reportable incident.
Detection handles patterned data well: card numbers, government identifiers, keys. It is poor at the material you would have to report, because that material has no pattern. A client’s unsigned agreement. An unreleased valuation. A support thread dense with free-text detail. Whether that file belongs in that window is a judgment, made by a person, in seconds, under time pressure. That is where a policy document stops being useful and an AI enablement question starts.
The fix is not a longer document or another annual module. The annual module teaches suspicion of strangers; this needs discernment about your own work, which is most of the difference set out in our comparison of AI risk training and traditional security-awareness training. What moves the number is an hour where people bring their own client material, make the call out loud, and get corrected by someone who can say “that one, no, and here is the version of it that is fine.”
That gap is the argument in our safe AI use playbook: a document describes the behavior and does not produce it. The same distance between a purchase and a capability runs through the case that buying licenses is not the same as building.
Where to start this month
Four steps, in this order, because each makes the next cheaper.
- Read your five largest client agreements for confidentiality, subprocessor and notice clauses. The strictest one sets your firm-wide floor.
- Decide the route per tool, contract or consent, and write the choice down with a date. Get the vendor paper before any client data moves.
- Publish the one-page rule with a named approval channel and a response promise, plus the engagement-letter line about client-side use of public assistants.
- Run one working session per team on the firm’s own documents. A facilitated session sits in a $2,000 to $15,000 market range, small against the license spend and larger in effect on this risk.
For a second opinion on where your firm stands before you spend anything, book a free AI-readiness call. We run hands-on LLM fluency sessions on a team’s own documents and daily work, and we will say plainly when a vendor agreement and a one-page rule would do more than a new tool.
Frequently asked questions
Does putting client information into an AI tool count as disclosure to a third party?
Usually yes. The vendor is a third party, and consumer-tier inputs may improve the model, route to sub-processors, or sit in logs. Professional codes treat that as disclosure, which is why they want vendor paper or client consent first.
Do we need client consent, or is a vendor contract enough?
It depends on your code. AICPA interpretation 1.700.040 gives two routes and lets you pick one: a contractual confidentiality agreement with the provider, or specific client consent. ABA Formal Opinion 512 is stricter for self-learning tools, requiring informed client consent before any input relating to a representation.
Is a clause in our engagement letter enough to cover AI use?
Not on its own. ABA 512 states that merely adding general, boiler-plate provisions to engagement letters purporting to authorize generative AI use is not informed consent. Use the letter to disclose, and get real consent where your code requires it.
Can using AI destroy attorney-client privilege?
A federal court has now held that it can. In United States v. Heppner, the Southern District of New York found in February 2026 that documents a defendant generated with the public version of Claude carried neither privilege nor work-product protection, and that forwarding them to counsel afterward did not make them privileged.
Does a business or enterprise account solve the confidentiality problem?
It solves part of it. Paid tiers generally bring a no-training commitment, administrator-controlled retention and an audit trail, and enterprise and zero-retention accounts were carved out of the 2025 preservation order in The New York Times v. OpenAI. But no court has held that any tier preserves privilege, and no tier decides whether a document should have been pasted.
Does anonymizing client data make it safe to use any tool?
It reduces risk rather than removing it. In small matters, deal size, industry and timeline name the client even with names stripped. Treat redaction as one control among several, never as a reason to use an unsanctioned tool.
What about AI note-takers on client calls?
Treat them as a separate decision. They capture confidential talk passively, with no deliberate upload, and they engage all-party consent recording statutes, which carry criminal exposure in some states. Decide in advance which calls may be recorded and by which tool.
What does a client security review ask about this?
Which tools are sanctioned and who approved them; what the vendor terms say about training and retention; what the written rule is; how it is enforced; and what evidence exists that staff were trained. Keep a dated answer to each.
How do we know our rule is working?
Ask three questions 30 days in. What share of assistant traffic sits on administered accounts. Whether team leads, asked separately, describe the same rule. Whether the approval channel has had real questions, because silence means people decide alone.
Key takeaways
- The duty has no AI exemption and arrives from three sources at once: a licensing body, the client contract, and sometimes a statute. The strictest contract sets your firm-wide floor.
- Codes give you a route, not a slogan. AICPA 1.700.040 accepts a vendor confidentiality agreement or client consent; ABA 512 requires informed consent for self-learning tools and rejects boiler-plate engagement-letter language. It also reaches past current clients, since Model Rules 1.9(c) and 1.18(b) cover former and prospective ones.
- United States v. Heppner established in February 2026 that privilege and work-product protection can be lost through public-tier AI use, and that forwarding the output to counsel does not cure it.
- Two-thirds of corporate clients want their outside firms using AI and fewer than 20% will mandate it, so a firm that can describe its controls answers a question its competitors avoid.
- Paper closes the patterned risk. The residual is a judgment call made in seconds on unpatterned client material, and only practice on real documents builds it.
Dirk Jan van Veen, PhD
