Can Law Firms Use AI for Contract Review Without Violating Privilege?

Law firms can use AI for contract review, but the biggest risk usually isn't attorney-client privilege in the courtroom sense. It's the confidentiality duty under ABA Model Rule 1.6, plus a detail many firms miss entirely: most contracts contain confidentiality obligations that run to the other side, so uploading a counterparty's draft to a public AI tool can breach the contract itself before you've even finished reviewing it.

Does attorney-client privilege even apply to contract review work?

Not in the way it applies to litigation strategy. Privilege protects confidential communications between a lawyer and client made for the purpose of legal advice, and work-product protection covers materials prepared in anticipation of litigation. A lot of contract review doesn't fit either category cleanly, since it's transactional work, not litigation prep. That doesn't mean confidentiality disappears. It means the operative rule is Model Rule 1.6, confidentiality of information relating to the representation, which is broader than privilege and applies whether or not litigation is on the table.

What does ABA Model Rule 1.6 actually require when a firm uses an AI tool?

ABA Formal Opinion 512, issued in 2024, treats AI vendors the same way a firm would treat any other third-party service provider handling client data. That means due diligence before adoption, not after: understanding how the vendor stores, retains, and potentially trains on submitted data, and documenting that review rather than taking a sales page's word for it. Guidance aimed at law firm AI ethics compliance recommends pushing for "zero data retention" contract terms specifically, where a vendor processes input but doesn't keep or reuse it afterward, and treating platforms without SOC 2 Type II or ISO 27001 certification with real caution before any confidential document goes near them.

Most state ethics opinions don't require a firm to get explicit client permission before using AI, as long as confidentiality is otherwise protected. A handful, including West Virginia, require it outright. Either way, disclosure matters most when AI use could affect scope, cost, or timeline, or when confidential information is going to leave the firm's control and reach a third party.

What's the risk that's specific to contract review, not litigation?

This is the part generic "AI and privilege" advice tends to skip. A lot of contracts define their own terms, or the information within them, as confidential, and that confidentiality obligation runs to the counterparty, not just your own client. A legal analysis of what not to feed AI tools put it directly: uploading a contract to an AI tool "can breach those contracts," and even partial use of protected content can count as a violation. Think about what a typical commercial agreement contains: intellectual property license terms, customer data, pricing, sometimes identifying information with its own regulatory protections. Pasting that into a public AI tool isn't just a confidentiality question for your own client. It's potentially an unauthorized disclosure to whoever built and operates that tool, which can trigger breach-of-contract claims from the other side of a deal your client didn't do anything else wrong in.

What should a law firm actually check before using AI for contract review?

A few specific questions separate a defensible AI contract-review workflow from a genuine ethics problem:

1. Does the vendor contract include zero data retention, or does the tool's default behavior let it store or train on submitted documents?
2. Has someone at the firm actually reviewed and documented the vendor's data handling, the way Formal Opinion 512 expects, rather than assuming a reputable name means reputable data practices?
3. Does the contract being reviewed contain confidentiality terms that extend to the counterparty, and if so, has anyone checked whether using this particular tool on this particular document would violate them?
4. Is every AI-generated summary, redline, or risk flag actually verified by a lawyer before it goes to a client or gets relied on, the same way any associate's first draft would be?
5. Is the firm billing for time genuinely spent, rather than billing full research or drafting rates for work AI did in seconds?

How does a firm-owned AI system change this calculation?

It removes the third-party disclosure problem entirely, which is the piece that creates most of the risk above. When the AI system runs on hardware the firm owns, inside the firm's own network, working only from documents the firm has approved, there's no outside vendor receiving a client's or counterparty's contract terms in the first place. That's the structure ForgeAI uses: on-premise deployment means contract review happens against your own document set without that content leaving the building, which sidesteps the "did we just disclose this to a third party" question that a consumer AI tool raises by design. You can see how that applies across regulated industries, law included, on ForgeAI's industries page (opens in a new tab).

On-premise deployment doesn't replace the rest of the checklist above. A firm still needs to verify AI output, bill accurately, and document its own diligence. It does remove the specific risk of a counterparty's confidential contract terms ending up on a vendor's server that nobody at the firm chose or vetted.

Using AI for contract review isn't the ethics problem by itself. Sending the wrong document to the wrong tool, without checking what that tool does with it, is. The firms handling this well treat every AI tool the same way they'd treat a new outside vendor touching client files: real diligence, documented, before the first document goes in.

Frequently asked questions

Is using AI for contract review automatically an ethics violation? No. The ethics problem comes from how a specific tool handles the data, not from using AI itself. A firm that's done proper vendor diligence, gotten appropriate consent where required, and verified the AI's output is on solid ethical ground.

Do I need my client's permission before using AI to review their contract? In most states, no, as long as confidentiality is otherwise protected, though a few states require it. Many firms disclose AI use anyway, especially when it affects cost or timeline or when data leaves the firm's control.

What about the other party's confidentiality, not just my client's? That's the risk most AI-and-privilege discussions skip. Many contracts make their own terms confidential as to both parties, so uploading a counterparty's draft to a public AI tool can breach that contract independent of anything involving your own client.

Does on-premise AI eliminate the need for vendor diligence? It changes what you're checking, not whether you check. There's no external vendor receiving the document, but a firm should still verify who can access the on-premise system internally and confirm the AI's output before relying on it.