AI and privilege in England and Wales – how useful is the binary 'open' or 'closed' AI distinction?

The questions of whether and how lawyers' use of artificial intelligence (AI) tools, whether in-house or in private practice, affects legal professional privilege (LPP) remain largely untested in England and Wales. The only judicial consideration to date comes from the Upper Tribunal's Hamid decision in Munir v Secretary of State for the Home Department, which held that uploading confidential documents into an "open-source AI tool, such as ChatGPT" is akin to placing that information on the internet in the public domain, and therefore would breach client confidentiality and waive legal privilege.

The distinction drawn by the tribunal in Munir between open and closed AI tools is a useful indication of judicial thinking, but it risks being read as a binary rule: closed tools are acceptable to use, open tools are not. However, the technical reality of the tools available, their differing configurations and user preference optionality adds nuance to the picture.

Given that the English courts have not yet had to grapple with what exactly amounts to a closed tool or even whether the use of an open one always undermines confidentiality, lawyers should take a cautious approach to using AI and ensure they understand the technical specifications of any tools they do use to undertake legal work.

Further guidance from the court would be welcome and will no doubt be forthcoming as disputes arise. However, will the law be able to keep pace with technological advancement? Will the speed of development push the courts towards a simpler and stricter approach to confidentiality, and thus privilege (for example, analogous to patent law's treatment of novelty and prior public disclosure of an invention)? While these questions are outstanding, in-house legal teams should understand the tools they use and promptly put in place risk mitigation strategies.

Beyond the open v closed binary distinction

Confidentiality is the backbone of LPP, both to generate and to maintain protection. The circumstances in which the use of an AI tool may destroy the confidentiality that underpins privilege is not yet settled in England and Wales.

Whether privilege or confidentiality is actually put at risk depends less on a simplistic "open" or "closed" label and more on how a given tool is configured, what the provider's data handling and training terms actually say, and the user business's underlying practices to protect privilege (privilege hygiene). A tool being "closed" (as per the Upper Tribunal, not putting information into the public domain) does not mean that it is free of risk to privilege.

In August 2026, the Solicitors Regulation Authority (SRA) released a warning notice on the misuse of AI by solicitors and law firms, flagging the nuance and the need for careful case-by-case assessment in relation to the threats AI tools pose to confidentiality (and therefore privilege). It commented: "[b]oth free to use and paid for AI systems may pose risks to client confidentiality. Depending on the provider's terms, settings and technical architecture, information entered into AI systems may be stored, retained or used to improve the tool."

What types of tools exist?

Public or "open" AI tools

The Upper Tribunal, the HMCTS guidance for judicial office holders and its more recent position statement on judicial use of AI make clear that public or open AI tools are those that are freely accessible and consumer-facing, with the Upper Tribunal giving the example of ChatGPT.

On their face, these kinds of consumer-facing tools pose the most serious threat to confidentiality and by extension to privilege. Many of them train on user interactions by default, which may destroy confidentiality. However, some of these tools have changeable user preference settings. It is not yet clear whether altering these training or retention settings would be enough to preserve confidentiality.

The courts have not yet given a detailed assessment of these issues. It therefore remains unclear whether any and all interactions with a public AI tool destroy confidentiality and waive privilege outright, or whether the answer depends on the provider's settings and terms in each case. The latter approach would require an individual assessment of settings and terms in every privilege dispute.

Difficult decisions inevitably lie ahead for the courts in this area, but the safest approach is to assume that consumer-grade AI tools pose a serious risk to confidentiality, and therefore LPP, and no privileged material should be input into them, regardless of user settings. 

Enterprise tools

In-house lawyers looking to use AI in their legal work may encounter enterprise AI tools. Enterprise AI tools usually operate within an organisation's own environment (sometimes via private or public cloud hosting). They typically combine a large language model (LLM) with enterprise data retrieval, and are subject to an organisation's identity, access and data governance controls.

In theory, these tools are lower risk than public, open AI tools and can be compatible with privilege, but lower risk does not mean they pose no risk. The compatibility of their use with the protection of LPP will depend on how access, retention, searchability and training settings are configured, as well as the agreement in place with the service provider and any third-party hosting providers, and the user business's underlying privilege hygiene.

The SRA has particularly highlighted the risks of these kinds of tools. It stated that a business may have developed an in-house AI tool for its particular area of work but that the tool may not be "specifically designed for legal work". In-house lawyers were warned that they must consider whether their organisation's interests in the use of its AI system might conflict with their own duties and professional responsibilities.

Specialist legal AI tools

There is a growing range of AI tools built specifically for legal teams, with features such as matter-based workspaces, granular permissions and audit trails. However, "legal grade" branding does not automatically make a tool privilege-safe. 

The tools still require due diligence, and questions about confidentiality, data use and configuration must be asked. Internet-facing features, such as certain research modes, or broad workspace access permissions can undermine a tool's "closed" status, regardless of branding. That said, properly configured and used, it is difficult to see these tools posing a serious privilege risk. 

Agentic AI

Agentic AI agents are increasingly being deployed within organisations. True agentic AI systems operate autonomously or semi-autonomously across multiple systems, planning and executing sequences of steps, selecting tools, and adjusting their approach until a goal is met or they seek human input. Many "agentic AI" products available at present are not truly autonomous, but are simply agentic features bolted onto existing assistants. 

Agentic AI tools represent a more complex governance challenge than non-agentic tools. Their ability to operate autonomously across legal and operational functions could make it difficult to maintain the clear segregation that privilege protection requires. 

Agentic AI tools warrant careful assessment before being deployed in an in-house legal setting, where the risk of unintended sharing across legal and operational functions is acute. Where they are used, it will be critical to implement mandatory environment segregation and "human-in-the-loop" approval thresholds.

How to protect LPP when using AI tools

Avoid consumer-grade tools

The law of privilege has not changed, but AI poses new challenges to the existing concept. The first and most prudent practical step in-house lawyers can take to protect LPP is to avoid using consumer-grade, publicly available tools to interact with privileged material, regardless of user setting optionality. While there are open questions on the privilege consequences of using these kinds of tools, the safest approach is to avoid using them in a legal context until there is further clarity.

Due diligence on retention, training and access

Even with paid-for AI tools, whether an enterprise tool or a specialist legal AI tool, careful due diligence is critical. Businesses' technical teams are best placed to advise on the exact configuration of the AI tool, but this needs to be informed by appropriate legal advice, taking into account confidentiality and privilege risk considerations. 

Among other things, in-house lawyers should clearly understand certain issues about configuration, including: 

• Whether inputs and outputs can be retained or used by the AI service provider to train the underlying model or improve performance.
• Whether the service provider and any sub-contractors or intermediaries can access user data, under what circumstances, and whether they are bound by appropriate confidentiality obligations.
• Whether any internet-facing features of a tool allow direct access to the internet or whether any inputs are run across an index of the internet. 
• Whether the tool has a retention policy for user interactions and how that is configured.

Privilege hygiene

Privilege hygiene within businesses is now more important than ever. All staff, including those in non-legal functions, need to understand the basics of privilege, how it can be lost, and how AI magnifies the risks of privilege loss.

In practice, privilege hygiene means ensuring that legal teams have their own segregated workspaces, which are used appropriately, and that the configuration of any AI tools tracks this segregation. If access controls and workspace segregation are not properly configured, there is a risk of context leakage – that is, where AI tools reveal sensitive information to people who were never meant to see it. A permissions gap that has sat unnoticed for years could pose a major problem once an AI tool starts actively surfacing that information.

Legal questions from within the business should go to the human legal team, and business functions should avoid using AI tools to seek legal "advice". All legal communications both from the in-house legal team and external counsel should stay within the advice-seeking group.

Osborne Clarke comment

There has been limited judicial consideration in England and Wales of the impact of different types of AI tools on confidentiality and LPP. Thus far, the Upper Tribunal has drawn a binary distinction between open and closed tools. However, this does not reflect the technical nuance of the tools available on the market today (or in the future). We await a more nuanced analysis from the courts. Will use of open, consumer-grade tools always pose a risk to confidentiality and privilege? How will a tool's technical architecture and configuration affect the analysis?

Even in the absence of clear court guidance, in-house legal teams should still be proactively assessing the risk of their own use of AI and its use across the wider business. It is essential for risk mitigation that in-house legal teams consider these issues at an early stage, in collaboration with the technical teams responsible for configuring and rolling out AI tools within the business. 

In practice, this means in-house legal teams should:

• Put in place appropriate policies and training programmes for non-legal functions using AI and set clear parameters on acceptable use.

• Be clear about which AI tools they are using, and whether those tools are suitable for legal work.

• Remain alert to confidentiality and privilege risks when inputting information into AI tools, particularly where tools are not specifically designed or configured for legal use.

• Reflect on whether any internal pressure to adopt or expand AI usage sits comfortably with their lawyers' individual professional obligations under the SRA Principles and Code of Conduct.

Please get in touch with one of the experts below or your usual Osborne Clarke contact if you would like assistance regarding your business's use of AI or your AI roll-out strategy.