ChatGPT and Legal Professional Privilege: what every UK solicitor must know before using AI

Pasting a confidential client contract into ChatGPT to get a quick analysis. Uploading a witness statement into Claude to prepare for a hearing. Thousands of UK solicitors do this every day without realising the serious legal and professional risks they are taking. This article sets out the rules that apply, the real risks, and the only genuinely compliant approach.

1. Legal Professional Privilege: an absolute protection

Legal Professional Privilege (LPP) is one of the most fundamental protections in English law. It encompasses both legal advice privilege — covering confidential communications between a lawyer and client made for the purpose of giving or receiving legal advice — and litigation privilege, covering communications made for the dominant purpose of litigation that is reasonably anticipated.

LPP is not merely a procedural rule. It is a substantive right that belongs to the client, recognised by the Supreme Court as a fundamental human right under Article 8 ECHR (privacy) in cases such as R (Prudential plc) v Special Commissioner of Income Tax [2013] UKSC 1.

2. What happens when you upload a document to ChatGPT

When you upload a document to ChatGPT, Claude, Gemini or any other cloud AI service, the following happens technically:

• The document is transmitted in clear to servers outside your firm — typically in the United States
• The data is processed by the provider's systems and may be accessed by their employees for safety review, quality control or model improvement
• Depending on the terms of service, data may be used for training future models (unless you have opted out, and opt-outs are not always reliable)
• Those US servers are subject to the US Cloud Act — American authorities can compel production of data held by US companies worldwide, without notifying the data subject
• You have no visibility or control over what happens to the data once it leaves your network

3. What the SRA says

The Solicitors Regulation Authority has been explicit about the risks. Its Warning Notices on Shadow AI (2025) identify specific obligations under the SRA Code of Conduct 2019:

• Paragraph 6.3: you must keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents
• Paragraph 6.4: you must not use confidential information for the benefit of anyone other than the client
• The SRA notes that uploading client files to unapproved third-party AI tools may breach both paragraphs, regardless of the tool's privacy policy
• The SRA specifically states that "hosted in the UK" is not a sufficient safeguard — UK-hosted cloud services may still be subject to extraterritorial legal demands

4. The professional consequences

SRA disciplinary proceedings

Breach of confidentiality obligations under the SRA Code of Conduct can result in disciplinary action ranging from a reprimand or fine to suspension or strike-off. The SRA has signalled it will treat Shadow AI violations seriously, particularly where client data has been exposed without consent.

Civil liability to clients

If a client suffers loss as a result of a privilege waiver caused by a solicitor uploading their documents to a cloud AI — for example, if the opposing party successfully argues that privilege has been waived over a key document — the solicitor's exposure to a negligence claim is significant. Professional indemnity insurance may not cover deliberate or reckless breaches of confidentiality.

Client relationship damage

Beyond legal consequences, the loss of a client's trust following a confidentiality breach is irreversible in most cases. In sectors where confidentiality is paramount — M&A, criminal defence, family law, immigration — a single incident can destroy a practice's reputation.

5. The highest-risk situations in daily practice

• Pasting contract clauses or entire agreements into ChatGPT for analysis or drafting suggestions
• Uploading witness statements, expert reports or counsel's opinions into any cloud AI
• Using Microsoft Copilot with a tenant that processes data outside your firm's control
• Sending case files through cloud translation tools (Google Translate, DeepL) for foreign-language documents
• Storing matter files on personal cloud storage (Google Drive, Dropbox) without appropriate data processing agreements
• Using any AI tool through a personal account rather than a firm-approved, data-protected configuration

6. The only genuinely compliant approach

There is only one way to use AI with confidential client files without risking LPP waiver: ensure that processing takes place entirely within your firm, on hardware you physically control, with no data leaving your network at any point.

This is precisely the architecture of LegisBox: the AI is installed on-premises, on dedicated hardware in your firm. Your clients' documents never leave your network — not for analysis, not for storage, not for model improvement. The internet connection is used only to retrieve updates to public law sources (BAILII, legislation.gov.uk, Find Case Law) — never client data.