VEGA Compliance Consulting · Practitioner Survey

Have you personally read the terms of service or data-processing terms for the AI tools your team uses (Harvey, Claude, ChatGPT, Copilot, etc.)?

ABA Formal Opinion 512 places the burden on the lawyer to understand how a GAI (Generative Artificial Intelligence) tool handles data — boilerplate engagement-letter consent isn't enough. Reading the terms is step one.

Do you allow any AI agent or assistant to read, sort, draft, or act on your email inbox or document folders?

Inbox- and folder-connected agents see privileged correspondence by design. If that agent's provider can train on or retain that content, every privileged email it touches is potentially exposed.

Before turning on a workplace AI assistant (e.g., Microsoft Copilot), has your firm reviewed what that tool can already see across your email, Teams, OneDrive, and SharePoint?

Workplace AI assistants don't get separately granted access — they inherit whatever permissions already exist in the environment. Years of accumulated "permissions debt" (stale access from closed matters, departed staff, old project channels) becomes instantly queryable in natural language the moment the assistant goes live, including documents users technically have access to but were never meant to surface, like partner compensation memos or internal leadership deliberations.

An AI agent wired into your firm's inbox, calendar, and file share doesn't wait to be asked — it can surface years of matter files, expert communications, and consultant work product the moment someone points it at a broad question. Do you believe that kind of agentic access into the inboxes of your testifying experts and retained consultants is a potential privilege problem?

Do you require zero data retention (ZDR) from your AI provider before using it on client or case matters?

Most providers' default terms retain prompts (often days to weeks) for ‘safety’ screening by humans before deletion, separate from any training opt-in. ZDR agreements remove even that window.

If you don't require ZDR, what retention period are you comfortable accepting from a provider for prompts and outputs?

Standard consumer and even some enterprise tiers retain data for screening purposes before deletion, unless ZDR or an enterprise data processing addendum overrides it.

Does the possibility that a provider could be subpoenaed for your prompts and AI-generated documents concern you?

Would your AI usage change if you were litigating a matter involving violent or sexual conduct allegations?

Most providers apply heightened safety screening to content flagged as violent or sexual, which can mean longer retention or additional human-reviews of that material, threatening privilege.

Is your firm or team's AI use formally documented as counsel-directed (e.g., a written policy naming approved tools and instructing staff and clients accordingly)?

Post-Heppner, courts have signaled that counsel-directed use under a Kovel-type arrangement, on a platform with enforceable confidentiality, is a strong path to preserving privilege. Self-directed client use of consumer AI is the weakest.

Do you obtain informed client consent before using AI tools on that client's confidential information?

ABA Formal Opinion 512 speaks to a client’s adequate, informed consent and the lawyer’s explanation of the material risks of the specific AI use to the client.

If opposing counsel's expert ran your client's produced discovery through a consumer AI tool that trains on inputs by default, would you move to stop it — or is that just how document review works now?

What is your single biggest unresolved concern about AI and privilege right now?

This one's open-ended on purpose — pick the closest fit and use the comment field to add detail.

Comments

(Optional)