EU Legal Professional Privilege Challenged by AI Confidentiality Risks

JD Supra Technology & Cyber

Published March 27th, 2026

Detected March 28th, 2026

Summary

This article discusses how the adoption of Generative AI tools poses new challenges to legal professional privilege (LPP) under EU law. It highlights concerns that using AI may inadvertently undermine LPP protections, potentially exposing communications to public authorities. The guidance aims to identify key challenges and offer practical advice for safeguarding LPP.

View original document View source feed page

What changed

The increasing use of Generative AI tools by businesses presents novel and largely untested challenges to the preservation of legal professional privilege (LPP) under EU law. Communications involving AI-produced or processed materials risk compromising LPP, potentially leading to the disclosure of documents and communications to public authorities during regulatory investigations or legal proceedings. This is particularly concerning as LPP under EU law applies broadly to legal advice from EEA-qualified external counsel and, in some member states like France, is being extended to in-house counsel.

Businesses must carefully consider the implications of submitting LPP-protected information to AI chatbots. The article identifies key challenges posed by Generative AI to LPP under EU law and provides practical guidance for safeguarding privilege. This includes understanding the scope of LPP, which covers all legal advice and preparatory documents for seeking advice from independent EEA-qualified external lawyers, and recognizing that advice from in-house lawyers is not currently covered under broader EU law, though discussions are ongoing.

What to do next

Review internal policies regarding the use of AI tools for legal advice and communications.
Assess the risk of submitting LPP-protected information to AI chatbots.
Consult with legal counsel on specific AI use cases to ensure privilege is maintained.

Source document (simplified)

March 27, 2026

Navigating legal professional privilege under EU law in the age of AI

LinkedIn Facebook X Send Embed

The adoption of Generative AI tools has introduced novel and largely untested challenges to the preservation of legal professional privilege ("LPP"), which intersect with broader discussion on the scope of LPP for competition law purposes, the revisiting of the scope of LPP in certain Member States, such as France, and the revisions to Regulation 1/2003.

As businesses increasingly use AI-powered tools to deal with real-world business and legal issues – some of which may develop into disputes – there is a material concern that the protections afforded by LPP may be inadvertently undermined. Where privilege is lost, documents and communications that would otherwise be shielded from disclosure may become accessible to public authorities during regulatory investigations or in legal proceedings. Disputes on whether communications with counsel involving AI-produced or processed materials are protected by LPP have already arisen in other jurisdictions and indeed show that such exposure is real.

As the use of AI tools becomes more prevalent, businesses must carefully consider whether submitting LPP-protected information to AI chatbots risks compromising the privilege. This client alert identifies key challenges that the use of Generative AI tools may pose to LPP under EU law and provides practical guidance in safeguarding LPP.

Key principles of Legal Professional Privilege under EU law

By way of background, LPP under EU Law:

Applies to any legal advice 1 regardless of the field of law.
Covers communications with an EEA-qualified external counsel 2 provided they were made for the purpose of the exercise of the client's rights of defence or seeking or providing legal advice. For a long time, the scope of EU LPP was relatively narrow and applied only to communications made for the purpose, and in the interests of, the client's rights of defence. 3 The judgment in Orde van Vlaamse Balies 4 broadened the scope of LPP. Essentially, the CJEU held that correspondence between lawyers and clients should be protected not only under Article 47 of the Charter of Fundamental Rights of the EU ("CFR") but also under Article 7 of CFR (respect for private life). So, LPP is now protected in all cases, irrespective of the matter or case at stake and covers legal advice more broadly, such as regulatory or commercial advice, and also the very existence of the advice.
Does not currently cover legal advice from in-house lawyers. This was also recently confirmed by the European Commission in a policy brief (although discussions on the topic are ongoing in the context of the planned reform of Regulation 1/2003 and recently French legislation extended the scope of LPP to cover in-house counsel).
Applies to internal notes reporting the content of legal advice received from an EEA-qualified external legal counsel provided that the notes are confined to reporting the content of advice. 5 This is a narrow category, as it would not in principle cover, for example, an in-house counsel's comments or views on external counsel's advice communicated internally.
Covers preparatory documents created exclusively for seeking legal advice from an independent EEA-qualified external lawyer. In order for a client to be able to effectively consult a lawyer without constraint, it may be necessary in certain circumstances for the client to prepare working documents or summaries as a means of gathering information that will be useful or essential for the lawyer's understanding of the context, nature and scope of the facts for which legal advice is sought. Such preparatory documents, even if they were not exchanged with a lawyer or were not created for the purpose of being sent physically to a lawyer, are covered by LPP provided they were drawn up exclusively for the purpose of seeking legal advice from a lawyer. 6

Assessing LPP Considerations when using AI tools

As the EU Courts have not yet considered preservation of LPP in the context of AI-generated or AI-processed content, there is some legal uncertainty as to whether, and under what conditions, LPP is preserved when privileged content is generated, processed or summarised by AI tools. This question relates to both the underlying legal advice (original advice produced by external counsel) and the AI output. Below we examine hypothetical scenarios to illustrate when LPP may be maintained and when it may be lost based on existing EU law on LPP.

A. An employee of a company receives legal advice from a lawyer and then inputs the legal advice into an AI chatbot to summarise it.

May uploading the LPP protected information to an AI-chatbot lead to loss of LPP?

The original legal advice is protected by LPP assuming that the legal advice was obtained from an EEA-qualified external lawyer, not an in-house lawyer. Confidentiality is a key feature of LPP. Using privileged documents in an AI chatbot may compromise LPP protection if it undermines the confidentiality of the communication. This might be the case if a consumer-facing AI model is used where the provider can use the input and output freely, such as for training the model. This was indeed the conclusion in the recent judgment in USA v. Heppner, 7 which states that attorney-client privilege does not extend to documents prepared by a defendant using a consumer AI chatbot, even if those documents were subsequently sent to his lawyers. The court reasoned that the communications with the AI chatbot were not privileged when they took place, in particular because the AI chatbot's privacy policy specified that the provider collects the data on both user inputs and outputs and that this data is used to train the AI chatbot. The court further held that privilege does not attach automatically to non-privileged materials prepared by AI tools simply because they are sent to counsel.

In the same vein, the guidelines of the European Bars Federation issued in September 2024 state: "The attorney-client privilege remains crucial despite technological advancements, as the use of GenAI carries risks of improper processing or disclosure of client data. When using GenAI, it is essential to safeguard client confidentiality, taking all necessary precautions to protect client information. […]. To maintain professional confidentiality, ensure that GenAI systems have zero data retention policies and prohibit the use of any input data for purposes such as training AI models. Additionally, always verify that the GenAI systems you use have appropriate security measures in place" (Guideline 5).

Is the AI-generated summary of the legal advice protected by LPP?

EU case law has addressed analogous situations involving derivative documents in the context of human-created internal notes. LPP extends beyond the original written communication from external counsel to internal documents that do no more than report the text or content of those communications. 8

In principle, an AI-generated summary of a privileged legal advice document can be considered a derivative document that reports and condenses the content of a privileged communication. However, it is critical that the summary does not go beyond reproducing or distilling the substance of the privileged advice and that the confidential nature of the advice is preserved. By contrast, an AI-generated summary that goes beyond reproducing the content of the privileged information by adding analysis or non-privileged information may potentially not satisfy this requirement. The more the AI-generated summary modifies the original advice, the weaker the LPP claim over the summary becomes.

B. An employee asks a legal AI tool for legal advice on what the business should do based on certain facts. The employee then circulates the AI-generated advice to counsel.

Is the AI-generated response on legal issues legal advice within the meaning of EU law on LPP?

The LPP covers communications with an EEA-qualified external counsel. Based on case law, the meaning of the external counsel can be interpreted as a natural person enrolled with a Bar or Law Society, subject to professional ethical obligations, and not bound by a relationship of employment with the client. 9 A generative AI tool is not a lawyer as it does not satisfy these conditions. It follows that the LPP is unlikely to apply to the AI-generated legal advice.

Can you make the AI-generated response privileged by forwarding it to an external EEA-qualified counsel?

The answer to this question will depend on the facts of the case. Sending an AI-generated document to a lawyer does not, by itself, make that document privileged unless it can be demonstrated that such communication satisfies the conditions for claiming the LPP, i.e. it was made for the purpose of exercising the client's rights of defence or seeking or providing legal advice. In Akzo, the CJEU stated that "the mere fact that a document has been discussed with a lawyer is not sufficient to give it such protection". 10 Accordingly, merely forwarding an AI-generated output to external counsel just to be able to claim LPP protection, without any genuine engagement in the provision of legal advice, would be unlikely to attract privilege.

Consideration should also be given to whether the AI-generated output could qualify as a preparatory document. Where an employee can demonstrate that the AI tool guarantees confidentiality of the input and output and that the AI tool was used exclusively for the purpose of gathering and organising information in preparation of seeking legal advice from an external EEA-qualified lawyer, there may be a basis for claiming LPP over the AI-generated output as a preparatory document. However, where the employee's primary purpose in querying the AI tool was to obtain a standalone legal answer – rather than to prepare for a consultation with external counsel – LPP protection becomes unlikely.

What if an in-house lawyer, instead of a non-lawyer employee, asks the AI tool to assist in providing legal advice to the business?

Under EU law, in-house lawyers when giving legal advice to their employer cannot generate EU-level LPP protection for those communications. However, national law in some EU Member States is more generous to in-house lawyers. Several Member States (for example, France or Belgium) extend LPP protections to in-house lawyers under specific conditions provided in national law. These national protections operate independently of EU-level LPP and may provide meaningful protection for the in-house lawyer's communications – including, potentially, their AI-assisted work – in purely domestic proceedings. Outside of the EU, there are also jurisdictions extending the protection to in-house lawyers, e.g. UK or US.

Practical steps businesses can take to maintain LPP protection

Avoid supplying privileged documents to an AI tool without careful understanding of the tool's technical and security features. Uploading LPP-protected information to a consumer-facing AI model, or to a tool where the provider may use input and output data for training purposes, may undermine the confidentiality that underpins LPP. Only use an enterprise-grade AI tool operating within a secure technical environment and ensure that LPP materials are not accessed, stored or used for model training purposes. Verify that the AI system has zero data retention policies and appropriate security measures in place.
Label and mark all underlying LPP-protected documents as well as AI-generated output based on the privileged input as "Privileged & Confidential". This is particularly important for AI-generated summaries of privileged advice, and for AI-generated outputs that may be forwarded to external counsel as part of the process of seeking legal advice. Proper labelling increases the likelihood that such documents are recognised as LPP-protected in the event of unannounced inspections.
Be mindful of how the AI-generated output refers to privileged information that was inputted into the AI tool. Summaries reporting the content of legal advice may be privileged. The more the chatbot alters, paraphrases or supplements the advice with other information, the greater the likelihood that the LPP may be compromised.
Be mindful of AI-powered transcription tools when discussing sensitive legal matters. This is the case especially when an external EEA-qualified counsel is not on those calls.
Restrict circulation of AI-generated summaries or outputs derived from privileged materials.
Train employees on the risks of using AI tools in contexts involving sensitive or LPP information. 1 The Court of Justice of the European Union ("CJEU") first recognised the EU LPP in AM&S Europe, a competition law judgment of 1982. Since then, it has extended to all areas of EU law, such as in the field of taxation (see e.g. Case C-694/20, Orde van Vlaamse Balies and Others). 2 The European Economic Area (EEA) countries comprise the EU 27 Member States and Iceland, Liechtenstein and Norway. 3 Case C-155/79, AM & S v Commission, para. 35. 4 Case C-694/20, Orde van Vlaamse Balies and Others. 5 Case T-30/89, Hilti v Commission, para 18. 6 Joined cases Case T-125/03 and T-253/03, Akzo Nobel Chemicals and Akcros Chemicals v Commission, para. 123. 7 While this US case law is not binding under EU law, the underlying principles regarding the importance of confidentiality to the preservation of privilege are similar. 8 See above Hilti, para18, Akzo, para 112. 9 See above AM & S, para 42. 10 See above Akzo, para 123.

Other related White & Case publications that you may be interested in:

Send Print Report

Latest Posts

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
Attorney Advertising.