The Board’s Role in Understanding AI’s Impact on Attorney-Client Privilege

As artificial intelligence (AI) becomes more prevalent in the legal sector and corporate operations, its implications for attorney-client privilege should be a rising concern for board members. AI integration poses significant risks to the confidentiality of privileged communications and critical legal protection. A recent survey by the Association of Corporate Counsel (ACC) highlights that many in-house lawyers are concerned by AI’s potential to expose privileged information, with instances already arising that challenge legal and ethical boundaries.

Attorney-client privilege enables board members to seek and receive candid legal advice, which is crucial for informed decision-making and risk management. Because officers and board directors may inadvertently disclose privileged information, in-house counsel devote time and resources to protecting privileged information from the public. However, the advent of AI introduces complexities in maintaining this confidentiality, as AI systems can inadvertently access and disclose privileged information.

About Attorney-Client Privilege

Attorney-client privilege (or legal professional privilege) safeguards confidential communications between lawyers and their clients during the provision of legal advice. For board directors, this ensures that sensitive legal discussions regarding corporate governance, compliance, and strategic decision-making remain protected and cannot be disclosed or used against the organization in legal proceedings. This privilege is crucial for directors to seek and receive candid legal advice, which is essential for informed decision-making and risk management at the highest level of corporate leadership.

As stewards of an organization, it is imperative that board directors maintain a keen understanding of attorney-client privilege nuances and implications for corporate governance practices. This privilege specifically covers legal advice provided by the lawyer and does not extend to exchanges related to business strategy. Board directors should remain vigilant in distinguishing legal advice and business strategy in communications involving the Chief Legal Officer, General Counsel, or other legal advisors, who often provide both legal and strategic business advice.

This distinction is not merely a legal technicality but a fundamental aspect of corporate governance that affects how internal communications are documented and managed. In a world where information or disinformation can so easily be planted and promulgated, harming the reputation of individual officers and directors and the organization, it is prudent for boards to consider:

• How do we ensure communications that are intended to be privileged are clearly delineated as legal advice?
• Are we adequately training management on the importance of maintaining clear lines between legal and non-legal communications?
• How do we handle communications in jurisdictions where legal privilege does not extend to in-house counsel?

Moreover, the global landscape of privilege varies widely and has long been complex. While the majority of countries recognize some form of lawyer-client confidentiality, not all countries extend legal privilege protections to in-house counsel legal advice. Notably, 14 of the 30 countries in the European Economic Area do not recognize LPP for in-house counsel. This variation necessitates a strategic approach to how confidential communications are handled across different jurisdictions.

The advent of new technologies that facilitate data storage and management pose additional challenges to maintaining attorney-client privilege. Boards should provide oversight to ensure their organization is implementing robust data management systems capable of distinguishing and protecting privileged communications.

Navigating the complexities of attorney-client privilege is not merely about legal compliance but safeguarding the organization’s integrity and upholding the board’s fiduciary duties. The importance of prioritizing this understanding and ensuring it is embedded in the corporate governance framework should not be understated.

AI and Attorney-Client Privilege

AI is the latest and potentially most disruptive vector that stands to impact attorney-client privilege and presents a critical area of concern for board directors to address. AI represents a transformative technology with the potential to significantly affect legal frameworks, particularly the sanctity of attorney-client communications. The integration of AI into legal practices offers opportunities but also introduces risks that could undermine the confidentiality of sensitive communications.

Findings from a recent ACC study of over 450 in-house counsel across 27 countries underscores the urgency of this issue.

• 83% expressed concerns about AI’s potential to compromise attorney-client privilege.
• 34% reported they are very or extremely concerned about inadvertently disclosing privileged information when using AI tools.
• 49% believe generative AI poses the greatest risk to attorney-client privilege.
• 7% shared that they had already encountered situations where the use of AI has raised questions about attorney-client privilege and potential disclosure risk.

While there is concern about AI-related risks to preserving attorney-client privilege, forward looking in-house counsel are taking mitigation actions. 62% of in-house counsel have implemented employee training to make their teams aware of the risks of disclosure associated with AI and 59% use access controls. Other approaches include data anonymization and redaction, vendor due diligence, data encryption, and regular security audits.

These findings indicate that this is not simply a theoretical risk but a practical reality affecting global legal practices. In considering the long-term implications of AI, board directors should ask questions with respect to alignment with the organization’s legal practices:

• How are we assessing AI risks in relation to attorney-client privilege? What measures are in place to mitigate these risks?
• Are current policies sufficient to address new challenges posed by AI? How frequently are these policies reviewed and updated?
• What training is in place to ensure legal teams are equipped to handle AI tools without compromising sensitive information?
• What data security measures are in place to safeguard against breaches?
• How are we engaging with policymakers to shape the regulatory landscape around the use of AI in legal practices?

What Board Directors Need to Know

Attorney-client privilege is a right held by the client, not the attorney. It is the responsibility of both the client and the lawyer to protect it. Board directors should be aware they can waive this confidentiality, either intentionally or inadvertently, through the disclosure of privileged information.

When the client is an organization, an inadvertent disclosure by a director or officer will generally not be protected by attorney-client privilege. Under some circumstances, disclosure by employees below the management level may also risk waiving this protection. The CLO is well-positioned to provide guidance to boards in navigating these complexities. It is advisable that the CLO, board, and management communicate regularly to reinforce the importance of secure communications. For example, in-house counsel may:

• Conduct trainings for board directors, management, and employees on attorney-client privilege.
• Manage access to confidential information to prevent unauthorized disclosures.
• Structure communications to ensure privilege, such as limiting the number of recipients, separating legal advice from business strategy whenever possible, and marking documents with “Privileged” and “Confidential” labels. While labeling a document does not guarantee it is privileged, it is helpful to the legal team and fact finders to identify potentially privileged materials.

Boards and leadership teams should ensure deliberate use of AI and that it is meticulously reviewed to avoid inadvertently compromising this vital legal protection. Failure to maintain strict controls may unwittingly place the organization and its leaders in challenging situations.

By aligning AI strategies with long-term corporate goals and maintaining a vigilant stance on AI developments, boards may safeguard their organizations against potential legal vulnerabilities while capitalizing on the opportunities.

To receive exclusive corporate governance insights for board members and leaders, join the Nasdaq Center for Board Excellence.