Privilege and confidentiality in generative AI workflows

• URL: http://arxiv.org/abs/2607.05479v1
• Date: Mon, 06 Jul 2026 14:38:58 GMT
• Title: Privilege and confidentiality in generative AI workflows
• Abstract summary: Generative AI (GenAI) systems store and process client data in three distinct ways.<n>Each mode creates different and often counter-intuitive risks to confidentiality and legal professional privilege.<n>This article aims to help legal services professionals understand salient data leakage risks in GenAI systems.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Generative AI (GenAI) systems store and process client data in three distinct ways: in the model's parameters through training and memorisation, in the context window during a live session, and in knowledge databases for retrieval-augmented generation (RAG). Each mode creates different and often counter-intuitive risks to confidentiality and legal professional privilege, and each calls for specific governance responses. Drawing on the first English and American decisions to address privilege and generative AI, UK and Munir v Secretary of State for the Home Department and United States v Heppner, on the orthodox privilege authorities against which those decisions must be read, and on recent computer science research, we explain the three modes of data storage and processing in terms accessible to practitioners and analyse the legal consequences of each. We then situate the analysis within the regulatory framework governing solicitors in England and Wales and within the ordinary principles of professional negligence, arguing that the standard of effective information governance (and with it the benchmark against which negligence and misconduct will be measured) is changing. Although we write primarily for SRA-regulated practitioners, our data-governance analysis is framed to extend to any jurisdiction in which the protection of privilege or professional secrecy depends on demonstrable confidentiality. The ultimate aim of this article is to help legal services professionals understand salient data leakage risks in GenAI systems and thereby facilitate a more responsible deployment of GenAI on client data and other sensitive material.

Related papers

• The AI Legal Specialist: A Juridically Autonomous Professional Profile for AI Governance [0.0]
  The rapid global expansion of artificial intelligence regulation has generated a demand for legal expertise dedicated to AI.<n>This paper argues that none of adaptive responses adequately covers the professional space opened by the emerging global AI regulatory landscape.<n>A distinct professional profile is required: the AI Legal Specialist operating at the intersection of legal interpretation and AI governance.
  arXiv  Detail & Related papers  (2026-05-07T05:59:13Z)
• Governance and Regulation of Artificial Intelligence in Developing Countries: A Case Study of Nigeria [0.0]
  This study examines the perception of legal professionals on the governance of AI in developing countries, using Nigeria as a case study.<n>Data were collected through 27 semi-structured interviews with legal practitioners in Nigeria.<n>Findings showed that there were concerns about data privacy risks and the lack of enforceable legal frameworks.
  arXiv  Detail & Related papers  (2026-04-07T16:16:05Z)
• Security, privacy, and agentic AI in a regulatory view: From definitions and distinctions to provisions and reflections [53.468443050795344]
  The rapid proliferation of artificial intelligence (AI) technologies has led to a dynamic regulatory landscape.<n>As AI paradigms shift towards greater autonomy, specifically in the form of agentic AI, it becomes increasingly challenging to articulate regulatory stipulations.<n>This paper reviews the evolving European Union (EU) AI regulatory provisions via analyzing 24 relevant documents published between 2024 and 2025.
  arXiv  Detail & Related papers  (2026-03-19T13:50:52Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• Trade-Offs in Deploying Legal AI: Insights from a Public Opinion Study to Guide AI Risk Management [3.7782691747398913]
  Generative AI tools are increasingly used for legal tasks.<n>The EU mandates risk assessment and audits before market introduction for some use cases.<n>Other use cases do not fall under the AI Acts' high-risk classifications.
  arXiv  Detail & Related papers  (2026-02-10T10:32:40Z)
• Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies [57.521647436515785]
  We define frontier AI auditing as rigorous third-party verification of frontier AI developers' safety and security claims.<n>We introduce AI Assurance Levels (AAL-1 to AAL-4), ranging from time-bounded system audits to continuous, deception-resilient verification.
  arXiv  Detail & Related papers  (2026-01-16T18:44:09Z)
• Concerning the Responsible Use of AI in the US Criminal Justice System [5.5215545294476485]
  Piece advocates for clear explanations of AI's data, logic, and limitations.<n>Calls for periodic audits to address bias and maintain accountability in AI systems.
  arXiv  Detail & Related papers  (2025-05-30T20:33:42Z)
• The explanation dialogues: an expert focus study to understand requirements towards explanations within the GDPR [47.06917254695738]
  We present the Explanation Dialogues, an expert focus study to uncover the expectations, reasoning, and understanding of legal experts and practitioners towards XAI.<n>The study consists of an online questionnaire and follow-up interviews, and is centered around a use-case in the credit domain.<n>We find that the presented explanations are hard to understand and lack information, and discuss issues that can arise from the different interests of the data controller and subject.
  arXiv  Detail & Related papers  (2025-01-09T15:50:02Z)
• Distributed Machine Learning and the Semblance of Trust [66.1227776348216]
  Federated Learning (FL) allows the data owner to maintain data governance and perform model training locally without having to share their data. FL and related techniques are often described as privacy-preserving. We explain why this term is not appropriate and outline the risks associated with over-reliance on protocols that were not designed with formal definitions of privacy in mind.
  arXiv  Detail & Related papers  (2021-12-21T08:44:05Z)
• Trustworthy AI [75.99046162669997]
  Brittleness to minor adversarial changes in the input data, ability to explain the decisions, address the bias in their training data, are some of the most prominent limitations. We propose the tutorial on Trustworthy AI to address six critical issues in enhancing user and public trust in AI systems.
  arXiv  Detail & Related papers  (2020-11-02T20:04:18Z)
• Response to Office of the Privacy Commissioner of Canada Consultation Proposals pertaining to amendments to PIPEDA relative to Artificial Intelligence [0.0]
  The Montreal AI Ethics Institute (MAIEI) was invited by the Office of the Privacy Commissioner of Canada (OPCC) to provide comments. The present document includes MAIEI comments and recommendations in writing.
  arXiv  Detail & Related papers  (2020-06-12T09:20:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.