Reviewing Legal Privilege and Confidentiality Challenges in Enterprise Deployment of Large Language Models
Abstract
The rapid enterprise adoption of large language models has outpaced the legal frameworks designed to protect privileged communications and confidential information. This paper reviews the doctrinal, regulatory, and practical challenges that had emerged through 2025 as courts, bar associations, regulators, and insurers confronted the collision between generative AI tools and traditional confidentiality protections. It examines the unresolved state of U.S. attorney-client privilege and work-product doctrine as applied to AI-assisted material, reasoning by analogy from existing third-party-disclosure precedent in the absence of a definitive ruling on point, and extends the analysis to comparative developments in the United Kingdom, Canada, and Australia. It reviews evolving American Bar Association and state bar guidance on lawyers' ethical obligations, enterprise data governance responses including zero data retention architectures and the technical mechanics of data exposure through retrieval-augmented generation, and the growing problem of unsanctioned employee AI use. It further surveys industry- specific regulatory overlays in financial services, healthcare, and government contracting; workforce governance questions; the broader regulatory landscape of the GDPR, the EU AI Act, and the fragmented U.S. state AI law patchwork; the insurance and professional liability market's response to AI-related claims; and procedural developments in discovery practice. The paper closes with a practical risk mitigation framework and an assessment of open questions likely to shape this area going forward.
Keywords
attorney-client privilege; legal professional privilege; work product; large language models; enterprise AI governance; confidentiality; data protection; zero data retention; retrieval- augmented gene
References
Afrihyia, E., Akinse, S. G., & Ojukwu, P. U. (2024). Comparative governance of AI-driven healthcare management: Executive oversight, regulatory structures, and accountability in the United States and developing countries. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3087-3102. https://doi.org/10.62225/2583049X.2024.4.6.5920 Afrihyia, E., Akinse, S. G., & Ojukwu, P. U. (2025). Organizational readiness for generative AI integration in healthcare operations: Comparative management capabilities between the U.S. and low- and middle-income countries. Iconic Research and Engineering Journals, 8(10), 1673-1697. https://doi.org/10.64388/IREV8I10-1714670 Afrihyia, E., Ojukwu, P. U., & Akinse, S. G. (2024). Privacy-preserving health data governance models: A comparative review of blockchain and cryptographic strategies in U.S. and developing healthcare systems. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3071-3086. https://doi.org/10.62225/2583049X.2024.4.6.5919 Akintola, A. S., Fawehinmi, Y. O., Aiyenitaju, O., Chinemerem, B., & Emmanuella, O. (2025). Digital transformation in telehealth: A systematic review of user trust, privacy, and regulatory governance in AI-powered remote monitoring systems. Journal of Scientific Research and Reports, 31(11), 163-182. https://doi.org/10.9734/jsrr/2025/v31i113658 Alaska Bar Association, Ethics Opinion 2025-1 (2025). Aliliele, C., Mbonu, I. S., & Iwuanyanwu, U. (2024a). A conceptual framework for enterprise data sensitivity classification and regulatory traceability mechanisms. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3103-3124. https://doi.org/10.62225/2583049X.2024.4.6.5991 Aliliele, C., Mbonu, I. S., & Iwuanyanwu, U. (2024b). Advances in HIPAA compliant data architecture and secure analytics frameworks for community healthcare organizations. Shodhshauryam, International Scientific Refereed Research Journal, 7(2), 277-324. https://doi.org/10.32628/SHISRRJ2472163 Aliliele, C., Mbonu, I. S., Uzoka, E., & Iwuanyanwu, U. (2025b). Advances in data lakehouse governance architectures for enterprise data loss prevention and compliance assurance. Shodhshauryam, International Scientific Refereed Research Journal, 8(4), 171-213. https://doi.org/10.32628/SHISRRJ258474 American Bar Association, Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512: Generative Artificial Intelligence Tools (July 29, 2024). Annan, A. O. (2022). Data privacy governance models for cross-border digital platforms. International Journal of Multidisciplinary Research and Growth Evaluation, 3(6), 949- 964. Annan, A. O. (2023). Intellectual property ownership and authorship in AI-generated works. Gyanshauryam, International Scientific Refereed Research Journal, 6(3), 425-450. Annan, A. O. (2024). Algorithmic accountability and trade secret protection in artificial intelligence. Shodhshauryam, International Scientific Refereed Research Journal, 7(5), 315-347. Annan, A. O. (2025a). Automated decision-making and anti-discrimination compliance under U.S. law. International Journal of Advanced Multidisciplinary Research and Studies, 5(2), 2522-2540. E-ISSN 2579-051X Annan, A. O. (2025b). Cybersecurity compliance as a source of competitive advantage in technology markets. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 11(5), 456-487. Ashurst LLP, Quickguide: Privilege under English Law (2025). Atakpa, M. I., & Abolaji, T. O. (2022). A privacy-preserving data architecture model for regulated industry analytics under GDPR and HIPAA compliance. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 8(3), 781-808. https://doi.org/10.32628/CSEIT22558 Badmus, O., Dosunmu, A. A., & Anunagba, C. O. (2025). A governance framework for AI- assisted CRM workflows: Agentforce deployment, risk management, and organizational readiness in enterprise Salesforce environments. International Journal of Scientific Research in Humanities and Social Sciences, 2(1), 59-80. Badmus, O., Jooda, D., & Anunagba, C. O. (2024). A privacy-by-design framework for role-based security architecture in Salesforce environments handling sensitive personal data. International Journal of Advanced Multidisciplinary Research and Studies, 4(6), 3244- 3254. https://doi.org/10.62225/2583049X.2024.4.6.6243 Baker v Campbell (1983) 153 CLR 52 . Cobalt, Vector and Embedding Weaknesses: Vulnerabilities and Mitigations (2025). Colorado Artificial Intelligence Act, SB 24-205 (2024), as amended by SB 25B-004 (2025). The Commissioners for HM Revenue and Customs v Marc Gunnarsson [2025] UKUT 00247 . Da Silva Moore v. Publicis Groupe, 287 F.R.D. 182 (S.D.N.Y. 2012). D.C. Bar, Ethics Opinion 388 (April 2024). Executive Order, Ensuring a National Policy Framework for Artificial Intelligence (Dec. 11, 2025). Federal Court of Canada, Notice: The Use of Artificial Intelligence in Court Proceedings (May 7, 2024). Federal Rule of Evidence 502(d). Federal Rules of Civil Procedure, Rules 16, 26 (amendments effective Dec. 1, 2025). Financial Industry Regulatory Authority, Regulatory Notice 25-07 (April 14, 2025). Gupta, K. et al., Zero Data Retention in LLM-based Enterprise AI Assistants: A Comparative Study of Market Leading Agentic AI Products, arXiv:2510.11558 (2025). Hickman v. Taylor, 329 U.S. 495 (1947). Hussein v. Canada (Immigration, Refugees and Citizenship), 2025 FC 1060. IBM, Cost of a Data Breach Report 2025. In re OpenAI, Inc. Copyright Infringement Litigation, No. 25-MD-3143, 2025 WL 3468036 (S.D.N.Y. Dec. 2, 2025). International Legal Technology Association, Generative AI Best Practice Guide (Sept. 30, 2025). Kumuyi, O., Akeju, B., Uzoka, E., & Ozowara, D. E. (2023). Framework for blockchain-based cross-border data exchange and regulatory transparency. International Journal of Multidisciplinary Futuristic Development, 4(1), 99-113. Ladapo, O. O., Jooda, D., Dosunmu, A. A., & Abolaji, T. O. (2023b). Systematic literature review on security access control policies and techniques based on privacy requirements in a BYOD environment. International Journal of Advanced Multidisciplinary Research and Studies, 3(6), 2890-2904. https://doi.org/10.62225/2583049X.2023.3.6.6206 Law Society of England and Wales, Generative AI: The Essentials (Oct. 1, 2025). E-ISSN 2579-051X Mbonu, I. S., Aliliele, C., Iwuanyanwu, U., & Oluoha, O. M. (2018). A conceptual framework for legal and ethical risk modeling in enterprise data protection governance systems. Iconic Research and Engineering Journals, 2(2), 207-226. https://doi.org/10.64388/IREV2I2- 1714911 Mbonu, I. S., Aliliele, C., Uzoka, E., & Oluoha, O. M. (2019). A review of comparative data protection regulations and secure cloud implementation strategies across jurisdictions. Iconic Research and Engineering Journals, 2(9), 482-501. https://doi.org/10.64388/IREV2I9-1714912 Mbonu, I. S., Iwuanyanwu, U., Aliliele, C., & Uzoka, E. (2022a). A review of data protection impact assessment models in multi cloud financial infrastructure systems. International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 8(1), 589-623. https://doi.org/10.32628/CSEIT25442 National Association of Corporate Directors, 2025 Board Practices and Oversight Survey. Odejobi, O. D., Okonkwo, C. S., Ahiaeke Patrick, M. C., Okeke, O. T., & Mayo, W. (2025). AI- augmented secure software engineering: Leveraging deep learning for autonomous threat detection and mitigation. International Journal of Engineering and Modern Technology, 11(12), 101-121. https://doi.org/10.56201/ijemt..pg101.121 R (on the application of Ayinde) v London Borough of Haringey [2025] EWHC 1383 . Regulation (EU) 2016/679 (General Data Protection Regulation). Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), entered into force Aug. 1, 2024. State Bar of Texas, Professional Ethics Committee, Opinion 705 (Feb. 2025). Texas Responsible Artificial Intelligence Governance Act, H.B. 149 (2025).
More Articles from JOURNAL OF LAW AND GLOBAL POLICY
War of Terrorism in West Africa and the Sahel: A Legal Analysis of Correlation Between Armed Conflicts and Global Terrorism
Author: Emmanuel Mkpo, PhD
Data Sharing in Nigerian Genomics: Addressing Legal Fragmentation and Ethical Dilemmas
Author: Mary Udofia, LLB, BL, LLM, PhD, Esther Williams George, LLB, BL, LLM, PhD In view, Onyedikachi Chiagoziem Moore
International Trade Policies and Sustainable Environmental Governance in Nigeria: A Legal Appraisal
Author: Onua, C., Halliday, E.C., Chinda, R.G.
Whether a Situation of Armed Violence is an Armed Conflict Pursuant to International Humanitarian Law Criteria
Author: Muhammad Ibrahim Bukar, MGLP, AFHEA-UK, PhD
Critical Analysis of the Effective Enforcement of the Fundamental Principles of International Humanitarian Law
Author: Dr. Muhammad Ibrahim Bukar, M-GLP, AFHEA-UK, Ph.D