Pasting away privilege: lawyers, clients and AI in England and the BVI
A solicitor pastes a draft letter into a free chatbot to polish the wording. A client, before instructing lawyers, uploads the contract to ChatGPT and asks whether there is a claim. Neither act feels remarkable. Each may have destroyed confidentiality, and with it any claim to legal professional privilege.
The Upper Tribunal speaks
In UK and R (on the application of Munir) v Secretary of State for the Home Department (AI hallucinations; supervision; Hamid) [2026] UKUT 81 (IAC), the Upper Tribunal became the first English court or tribunal to comment directly on what happens to privilege when confidential material is fed into a publicly available AI tool. The Tribunal said that uploading confidential documents into a public AI tool such as ChatGPT (the Tribunal called these “open-source” tools, although strictly they are proprietary hosted services) places the information “on the internet in the public domain”, breaching client confidentiality and waiving privilege. Conduct of that kind, the Tribunal added, may itself merit referral to the Solicitors Regulation Authority and should be reported to the Information Commissioner’s Office. The point does not appear to have been fully argued and will no doubt receive further judicial attention, but it is the first reported English statement on the question, and few practitioners will want to be the test case.
The Tribunal drew a deliberate distinction between public tools of that kind and closed systems operating within a secure network. The label on the tin matters. One of the solicitors before the Tribunal had used ChatGPT for entirely mundane purposes, improving draft emails to clients and summarising Home Office decision letters. It is precisely that everyday convenience which creates the risk.
The doctrinal logic is orthodox. Confidentiality is a precondition of both legal advice privilege and litigation privilege. A public chatbot is a third party, and many free tools operate on terms which permit the provider to retain inputs and use them to train future models. Disclosure in those circumstances is not the limited, purpose-bound disclosure that the courts have tolerated for translators, copying bureaus and cloud storage providers operating under obligations of confidence. Disclosure to a public AI tool may therefore destroy privilege, and a party who has allowed the information to escape will find it very difficult to resist later disclosure.
A different problem from hallucinations
Munir arose, as the parenthetical case name suggests, from fabricated citations placed before the Tribunal, the same vice exposed in R (Ayinde) v London Borough of Haringey [2025] EWHC 1383 (Admin) and, in New York, Mata v Avianca. Those cases concern competence, supervision and candour to the court. The privilege observations in Munir are of a different order, and in the long run more significant, because they bite even where the AI output is flawless. A perfectly accurate summary of privileged legal advice, produced by a public chatbot, may still destroy privilege.
The client side of the problem
Lawyers are only half the story. Privilege protects communications between lawyer and client, and material produced for the dominant purpose of litigation. A prospective claimant who rehearses the strengths and weaknesses of their case with a public chatbot, before or after instructing lawyers, generates a record which is neither confidential nor privileged, and which may be disclosable. A federal district court in New York has reached a similar result on its facts: in United States v Heppner (S.D.N.Y., February 2026), a client’s unsupervised use of a public AI platform was held not to attract attorney-client privilege or work product protection.
In cross-border fraud and asset recovery litigation, where privilege challenges are routine ammunition, this should concentrate minds. An opponent who can establish that your client briefed a chatbot before briefing counsel has been handed a weapon, and the disclosure exercise now needs to ask the question.
The position in the BVI
Privilege in the British Virgin Islands is rooted in English common law principles, so while Munir is not binding there, it is likely to prove highly persuasive in privilege disputes before the Eastern Caribbean Supreme Court. There is, as yet, no ECSC practice direction on generative AI, but the region is moving quickly around it. The Caribbean Court of Justice issued a practice direction in February 2025, followed by the Turks and Caicos Islands in August 2025, Jamaica in September 2025 and the Bahamas in November 2025, the last of these prompted by the first reported Bahamian case of hallucinated citations. The absence of an ECSC direction offers no comfort to BVI practitioners or their clients. The underlying doctrine applies now, practice direction or not, and the offshore context, with its layered structures, nominee arrangements and parallel proceedings, only multiplies the routes by which an unguarded prompt may surface.
The international direction of travel
The same themes recur elsewhere. The American Bar Association’s Formal Opinion 512 (July 2024) requires lawyers to evaluate how a generative AI tool handles data before client information goes anywhere near it, and warns that boilerplate consent in an engagement letter may not be adequate for sensitive uses. In Singapore, the Supreme Court’s guide for court users has, since October 2024, expressly required court users to comply with confidentiality, personal data protection and legal privilege obligations when using generative AI tools, and the Ministry of Law published a sector-wide guide in March 2026. The consistent message across jurisdictions is that use of AI is permitted, responsibility is not transferable, and confidentiality remains the lawyer’s problem.
Practical takeaways
- Adopt and enforce a firm AI policy. Distinguish clearly between approved enterprise tools, procured on contractual terms providing for zero data retention and no training on inputs, and public tools, which should be prohibited for any client-related material.
- Update your terms of business and engagement letters, and use them to address both halves of the problem. The first half is the firm’s own use of AI: the terms should state whether and how the firm uses AI, the categories of tool permitted, the confidentiality and data protection commitments obtained from providers, and the basis of client consent. Informed consent for sensitive uses requires a conversation, not a clause. The second half is the client’s use, and it belongs at the outset of the retainer, not in the small print. A prominent paragraph in the engagement letter itself should warn the client, and for corporate clients their directors, officers, employees and others involved in the matter, against putting material relating to it into public AI tools, and should invite the client to disclose any chatbot exchanges that have already taken place, since those may need to be assessed for disclosure. The warning arrives too late to cure anything done before instruction, but it stops the conduct continuing, creates a record that the advice was given, and routes the client’s questions to the one channel that actually attracts privilege.
- Munir is emphatic that a solicitor who delegates work remains responsible for its accuracy and for how it was produced. That extends to knowing which tools juniors and support staff are actually using.
- Reinforce the warning when a dispute crystallises. Litigation hold language should repeat the caution against putting dispute-related material into public AI tools, extend it to everyone within the client organisation touching the matter, and flag that existing prompts and outputs may be disclosable. By that stage the message should be a reminder of advice given at engagement, not news.
- Diligence your providers, and mind data protection. The Tribunal’s reference to the Information Commissioner’s Office is a reminder that the same upload may engage the UK GDPR, and in the BVI the Data Protection Act 2021, quite apart from privilege.
Privilege is frequently the battleground on which cross-border disputes are won and lost. It has taken centuries of jurisprudence to build, and the cheapest way to lose it is now a free website.
This article is for general information purposes only and does not constitute legal advice.
