What Lawyers Pasting Case Details Into ChatGPT Are Risking

Attorney working late on a laptop with an AI chatbot icon and a security warning symbol, illustrating law firm AI confidentiality risk

It’s 9 p.m., a filing is due in the morning, and an associate at your firm pastes a paragraph of settlement language into ChatGPT to tighten it up. It feels like using a really good thesaurus. But if that paragraph included a client’s name, dollar figures, or case strategy, your firm may have just created a law firm AI confidentiality problem — the kind a federal judge recently confirmed is a lot less private than it feels.

The Ruling That Changed the Conversation

In February 2026, U.S. District Judge Jed Rakoff in Manhattan ordered Bradley Heppner — the former chairman of bankrupt GWG Holdings, who is fighting federal securities and wire-fraud charges — to turn over approximately 31 documents he had created using the consumer version of Anthropic’s Claude while preparing his defense.

Heppner argued that his AI-assisted work should receive the same protections as his communications with his attorneys. Judge Rakoff disagreed, writing that no attorney-client relationship “does or could exist” between Heppner and the AI platform.

The ruling does not establish that every use of AI waives attorney-client privilege. But it highlights a serious issue for law firms: privilege depends heavily on confidentiality. Putting privileged or confidential client information into a third-party AI service — particularly a consumer service whose terms do not provide appropriate confidentiality protections — may jeopardize that confidentiality.

For attorneys, paralegals, and other law-firm employees, the lesson is straightforward: a chatbot may feel like a private workspace, but legally and technically, that assumption can be dangerous.

An important distinction: the AI tool in this case was Claude, not ChatGPT. And the decision doesn’t establish a blanket rule that applies to every AI platform. But the underlying concern isn’t unique to Claude. ChatGPT, Gemini, and other consumer AI services can raise similar confidentiality and privilege questions when employees share sensitive client information with them.

For law firms, the question isn’t simply whether employees are using AI. It’s whether the firm knows what they’re putting into it.

Why “Just This Once” Becomes a Habit

Shadow AI statistic showing 49% of employees use AI tools without their law firm employer's approval

This is where shadow AI enters the picture at your firm — the term for employees using AI tools that were never approved, reviewed, or even disclosed to firm leadership. Recent workplace research found that roughly half of employees use AI tools without their employer’s approval, and more than half of those default to free, consumer-grade accounts with none of the security protections a business plan would include. Nearly half say they’d feel uneasy telling their boss about it — not because anyone’s trying to cause harm, but because it’s faster, and nobody ever said not to.

But employee use of AI is only part of the risk. Businesses also need to understand what happens when AI applications are connected directly to Microsoft 365 and other business systems.

We wrote about this exact pattern back in June — see Your Employees Are Already Using AI. (Probably Right Now.) for the fuller picture. For a law firm, that “faster” habit is exactly how client confidentiality gets compromised without anyone intending it — and it’s rarely unique to one associate. Shadow AI in a law firm tends to spread quietly, one deadline at a time, until most of the team is doing it.

What This Actually Means for Your Firm

Consumer ChatGPT accounts — Free, Plus, Pro, even Team — are currently required to retain chat logs indefinitely under an unrelated court order (a New York Times lawsuit against OpenAI), including chats a user thought they’d deleted.
Shared ChatGPT conversation links can be indexed by Google, meaning a conversation someone assumed was private could, in theory, become searchable.
None of this requires a data breach or a hacker. It only requires someone treating an AI chatbot like a trusted colleague instead of a stranger on the internet.

We covered a simple, low-cost fix for exactly this kind of exposure in AI Data Privacy for Business: The $10 Upgrade That Protects Client Data. The short version: this is a law firm AI confidentiality risk hiding in plain sight at most small firms, not a hypothetical one — and it’s fixable without banning a tool your team actually finds useful.

The Good News: This Is a Fixable Problem

None of this means your team should stop using AI — used well, it saves real time on drafting and research. It means the firm needs three things most North Shore practices don’t have yet: a short, plain-English AI policy that spells out what’s okay to paste where; a business-grade AI tool (not the free consumer version) for anyone doing client-facing work; and a partner who’s already thought this through, so nobody on your team has to figure it out alone at 9 p.m. before a filing deadline.

That last part is where we come in. We’ve supported North Shore law firms since 1997, and a 24/7 Security Operations Center is already part of how we protect client data day to day — adding a clear AI policy and the right tools is a conversation, not a project.

Solving a law firm AI confidentiality risk doesn’t require banning AI — it requires a policy, the right tool, and a partner who’s already thought it through. If you’re not sure what your team is already pasting into ChatGPT, that’s a completely normal place to start. Reach out, and we’ll help you find out — and fix it — without the lecture.