The courts and the SRA have spent 2026 warning about what goes into AI tools, not only what comes out. If you run a business, that warning applies to you as well.
Most of what I’ve read this year about AI and legal work has been about fake case law. Lawyers ask a chatbot for authorities, get back cases that don’t exist, and end up explaining themselves to an unimpressed judge. It makes a good headline and it’s a real problem.
There’s a quieter issue sitting underneath it, though, and I think it affects far more businesses. This one is about what you hand over in the first place, before the AI has written a single word.
What the courts and regulators have said
Earlier this year the Upper Tribunal in the UK looked at a case where AI had been used to prepare legal work. Most of the judgment dealt with inaccurate citations, but the Tribunal went further. It said that putting client letters and Home Office correspondence into an open tool like ChatGPT amounts to placing that information in the public domain.
In August the Solicitors Regulation Authority picked that up in a formal warning notice. It said it had seen confidential client information being entered into public AI tools, and that doing so is likely to breach confidentiality. It also warned that legal professional privilege could be lost for good as a result.
The detail that caught my eye is that the SRA didn’t limit this to free tools. Paid ones can carry the same risk, depending on the provider’s terms, how the tool is set up and what happens to your data once it arrives.
The US has gone the same way. In February a federal judge in New York ruled that 31 documents a defendant had produced using a consumer AI chatbot weren’t privileged. He later passed them to his lawyers, and it made no difference. Once the information had gone to a third party, it couldn’t be taken back.
None of these decisions binds a court in Guernsey, Jersey or the Isle of Man. They do rest on old, well-understood principles about confidentiality and disclosure, though, and I wouldn’t bet on a local court taking a very different view.
Why this isn’t only a lawyers’ problem
You don’t need a practising certificate to owe someone a duty of confidence.
Think about the paperwork that crosses your desk in a normal month. Supplier agreements, client terms, NDAs, heads of terms for a deal. Nearly all of them include a confidentiality clause, and that clause usually spells out who you’re allowed to share the information with. Your own staff, normally. Your lawyers and accountants. Not a technology company in another jurisdiction.
Under most NDAs and service agreements, disclosure to a third party is what triggers a breach. An AI provider is a third party. Your customer signed a contract with you, not with whoever runs the chatbot.
So picture someone in your team pasting a customer’s draft agreement into a free AI tool and asking it to ‘flag anything risky’. They may have breached that customer’s confidentiality terms before the tool has produced a line. If the document has names, addresses or employee details in it, you’ve also got a data protection question to answer.
Almost always, nobody meant any harm. Someone was trying to save an hour on a busy afternoon.
What I’d suggest
- Treat public AI tools as outsiders. If you wouldn’t email the document to someone you’d never met, don’t paste it into a consumer chatbot.
- Read the confidentiality clause before you reach for AI. Check who counts as a permitted recipient. Some agreements allow disclosure to service providers who are themselves bound by confidentiality. Plenty don’t.
- Don’t assume paying for a tool makes it safe. Business and enterprise plans often promise not to train on your data, and that’s a genuine improvement. It still doesn’t make the provider a permitted recipient under somebody else’s NDA. Know the terms, where the data is processed and how long it’s kept.
- Strip it back. If you want help with the wording of a clause, give the tool that clause with the names, numbers and identifying detail taken out, not the whole document.
- Write it down for your team. A one-page AI policy that names approved tools and lists what must never go into them will do more than good intentions ever will.
- Look at your own contracts too. It’s worth addressing AI tools directly in the NDAs and confidentiality clauses you send out, so everyone knows where the line is.
- If it’s already happened, deal with it. Check the tool’s settings and history, write down what was shared and when, and get advice on whether anyone needs to be told.
Where that leaves us
I’m not arguing against using AI on contracts. Used carefully, it saves real time. But the question has moved on. It used to be ‘is the output right?’ Now it’s also ‘was I allowed to share the input?’ For regulated businesses, where confidentiality is an obligation rather than a courtesy, that second question may turn out to matter more.
I’d be interested to hear how others are handling this. Does your business have an AI policy yet, and does it cover what can and can’t be pasted in?
References
- Solicitors Regulation Authority, Misuse of AI: Warning notice, 17 August 2026.
- UK v Secretary of State for the Home Department [2026] UKUT 81 (IAC), para 21
- United States v Heppner, No. 25-cr-00503 (S.D.N.Y.), opinion of 17 February 2026
This article is general information and does not constitute legal advice. Speak to a qualified adviser about your own circumstances.