ChatGPT and Legal Professional Privilege: what every UK solicitor must know before using AI

Drafted with Lex, reviewed and validated by Anis Aidoudi

Pasting a confidential client contract into ChatGPT to get a quick analysis. Uploading a witness statement into Claude to prepare for a hearing. Thousands of UK solicitors do this every day without realising the serious legal and professional risks they are taking. This article sets out the rules that apply, the real risks, and the only genuinely compliant approach.

1. Legal Professional Privilege: an absolute protection

Legal Professional Privilege (LPP) is one of the most fundamental protections in English law. It encompasses both legal advice privilege, covering confidential communications between a lawyer and client made for the purpose of giving or receiving legal advice, and litigation privilege, covering communications made for the dominant purpose of litigation that is reasonably anticipated.

LPP is not merely a procedural rule. It is a substantive right that belongs to the client, recognised by the Supreme Court as a fundamental human right under Article 8 ECHR (privacy) in cases such as R (Prudential plc) v Special Commissioner of Income Tax [2013] UKSC 1.

2. What happens when you upload a document to ChatGPT

When you upload a document to ChatGPT, Claude, Gemini or any other cloud AI service, the following happens technically:

• The document is transmitted in clear to servers outside your firm, typically in the United States
• The data is processed by the provider's systems and may be accessed by their employees for safety review, quality control or model improvement
• Depending on the terms of service, data may be used for training future models (unless you have opted out, and opt-outs are not always reliable)
• Those US servers are subject to the US Cloud Act, American authorities can compel production of data held by US companies worldwide, without notifying the data subject
• You have no visibility or control over what happens to the data once it leaves your network

3. What the SRA says

The Solicitors Regulation Authority has warned about the risks. Its warning notice "Misuse of AI" (17 August 2026) is relevant to these duties under the SRA Code of Conduct:

• Paragraph 6.3: you must keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents
• Paragraph 6.4: you must not use confidential information for the benefit of anyone other than the client
• The SRA's warning notice says that, depending on the provider's terms, settings and technical architecture, information entered into AI systems may be stored, retained or used to improve the tool
• The SRA's warning notice says both paid-for and free AI tools may lack the contractual and technical safeguards needed to protect client confidentiality, and that firms should understand the safeguards that apply. UK-hosted cloud services may still be subject to extraterritorial legal demands

4. The professional consequences

SRA disciplinary proceedings

Breach of confidentiality obligations under the SRA Code of Conduct can result in disciplinary action ranging from a reprimand or fine to suspension or strike-off. The SRA has said it will have regard to the notice when exercising its regulatory functions.

Civil liability to clients

If a client suffers loss as a result of a privilege waiver caused by a solicitor uploading their documents to a cloud AI, for example, if the opposing party successfully argues that privilege has been waived over a key document, the solicitor's exposure to a negligence claim is significant. Professional indemnity insurance may not cover deliberate or reckless breaches of confidentiality.

Client relationship damage

Beyond legal consequences, the loss of a client's trust following a confidentiality breach is irreversible in most cases. In sectors where confidentiality is paramount, M&A, criminal defence, family law, immigration, a single incident can destroy a practice's reputation.

5. The highest-risk situations in daily practice

• Pasting contract clauses or entire agreements into ChatGPT for analysis or drafting suggestions
• Uploading witness statements, expert reports or counsel's opinions into any cloud AI
• Using Microsoft Copilot with a tenant that processes data outside your firm's control
• Sending case files through cloud translation tools (Google Translate, DeepL) for foreign-language documents
• Storing matter files on personal cloud storage (Google Drive, Dropbox) without appropriate data processing agreements
• Using any AI tool through a personal account rather than a firm-approved, data-protected configuration

6. The only genuinely compliant approach

One of the safest ways to use AI with confidential client files without risking LPP waiver is to ensure that processing takes place within your firm, on hardware you physically control, with your data staying within your network.

This is precisely the architecture of LegisBox: the AI is installed on-premises, on dedicated hardware in your firm. Your clients' documents stay within your network, for analysis, storage and model improvement alike. The internet connection is used only to retrieve updates to public law sources (BAILII, legislation.gov.uk, Find Case Law), not client data.