Does using AI for legal research risk a privilege waiver?

It can, depending on what is disclosed and to whom. Sending client confidences to a third-party model the firm does not control is a disclosure, and the analysis of whether privilege is affected turns on the facts of that disclosure. The practical protection is to control and record what actually reaches the model: classify privileged content in the prompt, block or redact it at the boundary, and keep an independent record of every call, so the firm can show what was and was not disclosed.

How does Model Rule 1.6 apply to AI tools?

ABA Model Rule 1.6 requires reasonable efforts to prevent unauthorized disclosure of information relating to a representation, and ABA Formal Opinion 512 applied that duty to generative AI. Using a model tool means a lawyer has to take reasonable steps to control what confidential content is sent to it. Enforcing classification and policy on the outbound prompt, and retaining a record of each call, is a concrete way to demonstrate those reasonable efforts at the point where disclosure happens.

What does matter identity add over user identity?

It lets policy enforce the boundaries between matters, not only between people. Binding a call to the matter as well as the lawyer means policy can reflect an ethical wall or a heightened-sensitivity matter, and the audit record shows which matter's material went to the model. With only a shared key, neither the person nor the matter is visible at the model boundary, and both are what a confidentiality review needs to see.

Is the document management system enough on its own?

No. The DMS controls which matters a lawyer can open, which is necessary and separate. Once a lawyer has a document in hand, they can paste it into a model, and that call is outside the DMS. The gateway governs what leaves for the model and records it, covering the point in the path where confidential material is disclosed to a third-party system. The two controls address different moments.

AI Security for Legal Research: Governing What Reaches the Model

A lawyer using AI for research moves privileged and confidential material into a prompt to get work done. Find the controlling authority on these facts. Draft an argument from this memo. Review this contract against these clauses. Each request is an HTTPS POST to a model endpoint, and the body carries client confidences, work-product analysis, and case facts that the duty of confidentiality is meant to protect. The research result saves hours. The request is a disclosure to a third-party system, and both the ethical duty and the risk of a privilege waiver ride on it.

The stakes are specific to legal work. ABA Model Rule 1.6 requires a lawyer to make reasonable efforts to prevent unauthorized disclosure of information relating to the representation, and ABA Formal Opinion 512 applied that duty to generative AI tools directly. A confidential client communication sent to a model the firm does not control is the disclosure the rule is written about.

Draw the boundary around the model call

A gateway governs the HTTP traffic between the legal AI tool and the model. It does not govern the document management system or a lawyer's local files.

Inside the boundary:

The research or drafting tool's HTTP call to the LLM, carrying the prompt.
The model's response returning to the tool.

Outside it:

The document management system's own access controls, which decide which matters a lawyer can open.
A document a lawyer edits locally and never sends to a model.

The gateway controls what confidential content leaves for the model and who sent it. Matter-level access control in the DMS is a separate obligation the firm still meets.

Bind each call to a user and matter identity

A shared firm key to the model destroys attribution and matter boundaries at once. Every lawyer's prompt reaches the model as one credential, so the firm cannot say which lawyer sent which client's confidences, and cannot enforce that material from one matter stays within it. Route calls through the gateway and bind each to the lawyer identity and, where the tool supplies it, the matter. Policy can then reflect matter sensitivity and ethical walls, and every prompt carrying privileged content names a person and a matter. This is the identity context a privilege-protection program depends on.

Classify privileged and confidential content in the prompt

A drafting prompt is built from whatever the lawyer pastes in, so the content leaving is not a reviewed template. A fact section can carry a client identity, a memo can carry work-product analysis, a contract can carry a counterparty's confidential terms. The gateway classifies the outbound prompt against confidential and privileged content markers and applies policy on the class, so a call seeking general case law is allowed while a call carrying identifiable client confidences is redacted or blocked before it reaches the model. Classification runs on the actual prompt, which is where the disclosure risk lives, rather than on a file labeled once at rest.

Constrain egress and record every disclosure

Restrict egress from the legal tooling so the only route to any model endpoint runs through the gateway, which stops a personally configured tool from bypassing policy. Every call then produces a decision record: the lawyer identity, the matter where available, the content class in the prompt, the outcome, the policy version, and a timestamp. The record commits before the response returns, on a write path the tool does not control. If a question of waiver or a bar inquiry ever asks what was disclosed to which model and under whose authority, that record answers per call, which is exactly what a self-written application log cannot promise.

DeepInspect

This is the problem DeepInspect was built to solve. A legal research tool sends confidential and privileged material to an LLM over HTTP, and DeepInspect sits inline at that boundary between the tool and the model endpoint it calls.

For every request, DeepInspect binds the call to the lawyer and matter identity the application supplies, classifies the prompt against confidential and privileged content markers, applies per-matter policy, and makes a deterministic, fail-closed decision before the material reaches the model. Every decision commits a signed, identity-bound audit record before the response returns, on a write path the tool never controls, which is the evidence a confidentiality duty and a waiver question both expect. DeepInspect governs the model traffic and does not replace the matter-level access control in your document management system. If your lawyers are sending client material into models and you cannot show what was disclosed, let's talk today.