AI, privilege and the courts: cautious optimism and imperfect boundaries

The judiciary is already using AI

Sir Colin began with familiar points about generative AI. AI tools work probabilistically rather than deterministically. They are useful because they can respond in natural language, but they cannot be relied upon to produce the same answer in the same way every time.

He then gave a short overview of the current judicial approach to AI.

The guidance makes clear that judges are not prohibited from using AI. Whether to do so is a matter for the individual judge. But the limits are equally clear: judges remain personally responsible for everything that goes out in their name, and any use of AI must be confined to systems they know to be secure.

That distinction between public and secure systems ran through the speech. Sir Colin described two secure AI systems now available to the judiciary: a secure form of Microsoft Copilot and an in-house system developed through work involving the judiciary, HMCTS and the Ministry of Justice AI Unit. He also referred to Judicial College training, including training on deepfakes.

The examples he gave of judicial use of AI were practical rather than groundbreaking: transcription, anonymisation of judgments, checking draft judgments for internal inconsistency, and finding material in emails. The anonymisation example was particularly instructive. Sir Colin described AI identifying possible “jigsaw” identification risks – combinations of details that might reveal an individual’s identity even where obvious identifiers have been removed. That is a good example of AI’s value in legal work, by helping to spot patterns, links or inconsistencies that might otherwise be missed.

The privilege question

Sir Colin then moved to discuss the interesting question of privilege and AI use. He started from the fact that a person can ask an AI system a legal question and receive an answer that most people would recognise as legal advice.

A broken window

His example was deliberately mundane: a person asking AI whether they can sue a builder who broke a window while fixing a kitchen. The chatbot response identifies possible heads of claim, evidence, practical steps and routes to court. It may include caveats, and it may say it is not giving legal advice. But in substance, and to the person asking the question, it is doing something very close to giving legal advice.

With this example, Sir Colin’s speech invites us to consider a bigger question around the purpose of legal advice privilege, and whether lawyers should be careful about assuming that there is a special quality in legal advice simply because the words come from a lawyer. Some AI-generated material will be poor or wrong. But it is not safe to assume that all of it is poor, or that lawyer-produced material is uniquely valuable because of its source. Sir Colin made the same point in relation to litigants in person: AI is already helping some unrepresented parties present material to the court more clearly and coherently than they otherwise might have done. That creates volume and control problems, but it is also positive from an access to justice perspective.

AI legal advice and the boundaries of privilege

An important question is whether that sort of exchange is protected by privilege. Under the current law, the answer is unlikely to be yes.

Legal advice privilege in English law remains tied to communications with legal professionals. Sir Colin referred to R. (on the application of Prudential Plc) v Special Commissioner of Income Tax [2013] 2 A.C. 185, where the Supreme Court declined to extend common law legal advice privilege to advice from accountants, even where the advice concerned tax law.

So, AI can now produce something functionally close to legal advice (though with potential accuracy and reliability issues), but – in normal circumstances – without the protection of privilege. That puts pressure on the current test for privilege. If AI can produce material that looks like legal advice, should that advice be protected too?

Sir Colin declined to comment on the question, but this would be a big change to the law. Privilege is rooted in the lawyer-client relationship, professional responsibility and the administration of justice. But if AI becomes a main route through which individuals understand their rights, prepare claims and respond to litigation without the assistance of a human legal professional, the boundary between protected lawyer-client advice and unprotected AI-assisted legal guidance may become increasingly problematic.

Public systems and confidentiality

Sir Colin’s analysis of confidentiality was orthodox. Confidentiality is a prerequisite for privilege; even if one were prepared in principle to extend privilege to certain AI-assisted legal exchanges, confidentiality is a cornerstone of asserting privilege and so that argument becomes potentially more difficult where the user has put material into a public AI system.

There is a risk of overstating this. In the panel, Colin Passmore KC made the point that putting material into a public AI system does not necessarily mean that any ordinary person can find it. He drew an analogy with hacked privileged material placed online but not readily accessible in practice. Public AI inputs are not always “public” in the same sense as publishing a document on a website.

But the practical answer, repeatedly emphasised by Sir Colin and the other members of the panel, is that lawyers should not put client confidential or privileged material into public AI systems. The argument that the material is not in fact discoverable by others may be technically interesting, but it is not a risk-management strategy and one cannot be sure of maintaining privilege. The safer professional approach is to use secure, controlled systems where the confidentiality position is understood and recorded.

Lawyers using AI to give advice

Sir Colin’s provisional view was that, where a lawyer uses a secure AI system in the context of providing legal advice, he did not immediately see why privilege would be undermined.

Colin Passmore KC pushed the point further, noting that lawyers already use tools, databases, colleagues, trainees, counsel, document review platforms and other support systems to produce advice. He suggested that material put into secure AI systems should not be treated as some new category of unprivileged working paper. He also made a more policy-driven point. If parties start seeking disclosure of every AI artefact – prompts, outputs, iterations and testing of advice – courts could face a wave of satellite applications about material that will often add little. He suggested that the courts may need to take a firm line and require some special reason before that material becomes disclosable.

That argument has force, but it should not be overstated. Avoiding a “tsunami” of disclosure requests is a practical concern, not a complete answer as a matter of principle. The analysis should still start with the ordinary privilege questions. Why was the material created? Was it part of giving or receiving legal advice? Was it handled confidentially? Was it kept within the legal team or a controlled environment? See our previous article on the topic here.

What this means for legal teams

AI is becoming part of legal work, including judicial work. The core principles of legal professional privilege have not changed, and legal teams must proceed with Sir Colin’s “cautious optimism” in mind, being careful about confidentiality, verification, human responsibility and the judicious use of professional judgement. The challenge will be to ensure that workflows incorporate those principles, rather than hoping privilege can be rescued after the event.

In that context, legal and compliance teams should focus on five key takeaways emerging from Sir Colin’s speech and the CLLS panel discussion:

• Do not put client confidential or privileged material into public AI systems, whatever the apparent convenience.
• Secure AI systems should not, by themselves, undermine privilege where lawyers retain control and responsibility.
• Expect questions about prompts, outputs, drafts and iterations in future disclosure disputes and investigations.
• Build workflows that record the tool, terms, purpose, safeguards and supervising lawyer involved.
• Treat AI governance as a legal risk issue, not just an IT or innovation project.

Authored by Reuben Vandercruyssen and Lydia Savill.