The question conflates two different rules. One is an evidentiary doctrine about communications; the other is a professional duty about information. The second is the one you can act on today.
Key takeaways
Using a tool does not, in itself, do anything to privilege. Privilege attaches to communications between a client and their lawyer made for the purpose of giving or receiving legal advice; it is not a property of the software those communications happen to pass through. What can matter is disclosure to a third party — and whether a particular disclosure affects privilege is a legal question that turns on the facts, the arrangement with the provider and the purpose of the disclosure. It is not a question to settle from a vendor’s marketing page, and it is not a question this page can answer for your matter.
What you can act on today is the professional duty, which is wider, clearer and entirely in your control.
The conduct rules themselves draw the line. Commentary [2] to rule 3.3-1 of the Law Society of Ontario’s Rules of Professional Conduct states that the rule must be distinguished from the evidentiary rule of lawyer and client privilege, which is also a constitutionally protected right, concerning oral or documentary communications passing between the client and the lawyer, and that the ethical rule is wider and applies without regard to the nature or source of the information or the fact that others may share the knowledge. The BC Code says the same in the same words.
So the duty of confidentiality covers material that was never privileged, survives the retainer indefinitely, and is owed even to someone who consulted you and never became a client. Privilege is narrower in what it covers and stronger in what it does. A firm that keeps the wider duty properly will rarely find itself arguing about the narrower one.
Treadstone Law’s summary of what is protected from disclosure in Ontario litigation sets out the distinction between solicitor-client privilege — which belongs to the client, is nearly absolute and survives the end of the matter — and litigation privilege, which covers material created for the dominant purpose of anticipated or ongoing litigation and ends when the litigation does. Those are different doctrines with different lifespans, and an AI workflow can touch both.
In practice the exposure is rarely a doctrinal argument about waiver. It is more prosaic: an unapproved consumer account with no written commitments; a transcript of a privileged conversation stored in a system the firm cannot search or delete; an output that quietly incorporated another client’s material; a subprocessor nobody knew about. Each of those is a governance failure that a lawyer can prevent without ever resolving the underlying question of law.
The Office of the Privacy Commissioner’s principles for generative AI reach the same conclusion from the privacy side: safeguard information with measures commensurate to its sensitivity, maintain awareness of threats specific to these tools — prompt injection, model inversion and jailbreaking are named — and, where sensitive or confidential information must be entered into a prompt, only do so where authorised.
One reassurance worth having in writing. Section 11 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act provides that nothing in that Act requires legal counsel to disclose any communication that is subject to solicitor-client privilege or, in Quebec, the professional secrecy of legal counsel. That is a useful example of how Parliament treats the doctrine when it legislates around it, and a useful answer when a compliance tool asks for something a lawyer cannot hand over.
Accountants, consultants, engineers and brokers ask this question often, and the honest answer is that the privilege doctrine described above is about lawyer–client communications. What a non-legal professional usually has instead is a contractual and regulatory duty of confidence, which is real and enforceable but different in kind. Treadstone Law’s answer on remedies for breach of a confidentiality clause is the more relevant starting point, and its note on the difference between an NDA and a confidentiality clause is worth reading before assuming your engagement terms cover a processing arrangement.
A five-lawyer Ontario practice wants a drafting assistant. Rather than trying to resolve the doctrinal question, it does four things it can complete. It approves one tool and blocks the rest, so there is a single arrangement to describe. It obtains written commitments on training use, retention, subprocessors and deletion, and reflects them in the agreement. It sets a rule that instructions and advice are not pasted verbatim; the tool receives the draft document, not the conversation about it. And it writes to clients describing the arrangement in two sentences, which converts an implicit position into an explicit one.
Countable: matters where an unapproved tool was used, prompts containing verbatim client instructions, and clients who received the notice. If the doctrinal question is ever argued, the firm has a factual record to argue from — which is the practical objective.
This page is written for a firm that delivers work to a book of clients. If the question is really about the front desk — intake, scheduling, recall, reminders — that lives on the professional practice owners page. If it is about your own month-end, reconciliation and payables rather than client deliverables, that is accounting automation. The two overlap on tooling and almost never on risk.
Does using AI waive privilege?
Not as a general proposition, and anyone telling you it always does or never does is overstating. It is fact-specific, and it is a question for advice on your arrangement rather than for a checklist.
Does it help if the tool runs inside our own tenant?
It removes one set of facts from the analysis and makes the arrangement easier to describe. It does not make the question disappear.
Should we tell clients?
Most firms that have thought about it do, in two sentences. Rule 3.3-1 makes express or implied client authorisation the first exception to the duty, so a clear description is doing useful work as well as being courteous.
What about the transcript of a client call?
Treat it as the most sensitive artefact the workflow produces, because it is verbatim and it is a record of the conversation rather than a derived document. Decide its retention deliberately — see what to keep when AI drafts the file.
A 30-minute call is enough to tell you whether AI pays for itself here.
