Client AI-Use Ready Reckoner

A Lawfinity Friday resource for cross-border counsel

Watch in 1 minute video here

A recurring theme in our conversations with law firm clients this year has been frustration – not with AI itself, but with what clients do with it mid-matter. Lawyers describe clients arriving with AI-drafted question lists nobody understands, AI-generated summaries substituting for the underlying documents. More seriously, clients have been disclosing privileged material or unfiled inventions to public AI tools without realising what they’ve done.

Most of the commentary we’ve seen treats this as an etiquette problem. We think it’s better addressed as an onboarding gap. The risk isn’t that clients use AI but that different clients carry very different exposure depending on who they are and what kind of matter they’re in.

So this end of week, instead of a market note, we’re sharing a working document: a client-facing AI-use reckoner, organised by client type rather than by practice area, built to be handed to a client at the start of a matter rather than explained after something has already gone wrong. Print it, adapt it, put your own letterhead on it, if so. It’s yours to use.

Why this exists

Clients increasingly use AI tools, often just a general chat assistant, not anything legal-specific to understand, draft around, or second-guess advice during a live matter. Most of this is harmless. Some of it can permanently damage the client’s own position, in ways that are very hard to undo once discovered. This document exists to be handed to a client at the start of a matter, so the danger is flagged before it happens rather than diagnosed after.

Client Type 1: The Individual Inventor, Solo Founder, or Dev Shop

The Focus: Statutory novelty and trade secret protection.

Before a patent application is formally filed, describing an invention, its code, or its underlying logic to a public AI tool can constitute a public disclosure. The law doesn’t differentiate based on it being just to “help draft a summary”.  Depending on the jurisdiction, this can destroy the invention’s novelty and its patentability.

• Absolute novelty vs. grace periods: India and most European jurisdictions apply an absolute novelty standard, with no meaningful grace period for an inventor’s own prior disclosure. The US offers a narrow one-year inventor’s grace period, but relying on it does nothing to preserve rights in jurisdictions that don’t recognise an equivalent exception.
• Trade secret exposure: Separately from patentability, exposing proprietary code or process logic to a public AI tool can undermine the “reasonable steps to maintain secrecy” that trade secret protection typically depends on. This is a distinct legal basis from novelty, and can be lost independently of it.

Client Type 2: The Business Without In-House Counsel (SMEs & Family Businesses)

The Focus: The expectation of confidentiality, and cognitive contamination of the facts.

Without an internal legal function, teams frequently treat AI tools as a sounding board. They end up pasting in legal advice, or writing out “what really happened” to get a simpler explanation.

• Privilege risk: Attorney-client privilege generally depends on a reasonable expectation of confidentiality being maintained. Whether pasting privileged material into a public AI tool breaks that expectation is not yet fully settled across jurisdictions, but it is a live and serious risk. Some AI platforms’ terms of service permit review or training on user inputs, which weakens the confidentiality basis privilege relies on. Treat this as a real risk of waiver, not a theoretical one.
• The cognitive risk: Asking an AI tool to “summarise what happened” can subtly reshape a client’s own memory of events, smoothing over exactly the factual inconsistencies a lawyer needs to know about to represent them properly.

Client Type 3: The Corporate Client With Non-Legal Executives Involved

The Focus: Operational privilege leakage and informal admissions.

The GC understands privilege. The business, finance, or operations colleagues collaborating on the matter often treat AI tools simply as a productivity aid.

• An operations manager pasting an internal, matter-related email chain into an AI tool to “generate a quick update for the board” can create a discoverable record entirely outside the protected legal channel, even where the GC’s own files remain secure.
• AI-assisted internal memos can produce phrasing that reads as a considered admission of liability, even when never intended that way.

Client Type 4: The Cross-Border Joint Venture or Transnational Corporate Group

The Focus: Privilege does not travel uniformly across a group’s own footprint.

A corporate structure spanning multiple jurisdictions does not enjoy one uniform standard of legal protection. What is treated as privileged in one entity’s jurisdiction may not be treated the same way in another’s.

• Common law systems generally extend privilege to communications with in-house counsel, though the scope varies by jurisdiction. Some other jurisdictions and specific regulatory contexts (EU competition law is a well-known example) do not extend the same protection to in-house counsel communications. The precise position depends heavily on the jurisdiction and the specific regulatory or judicial context involved, and should not be assumed to be uniform across a group.
• A group-wide AI or data policy built for one jurisdiction’s compliance requirements does not automatically carry the same protective effect into another.

Client Type 5: The Litigation Client (During the Dispute/Discovery Window)

The Focus: The limits of litigation privilege and work-product protection.

Once a dispute is reasonably anticipated, the rules governing what counts as protected material become considerably stricter.

• Litigation privilege typically protects a document only where it was created for the dominant purpose of obtaining legal advice or conducting the litigation. A client using an AI tool, out of anxiety or impatience, to run an independent risk analysis or a pro-and-con settlement scenario may be creating material that fails that test. It is deemed independent business analysis rather than litigation-privileged work, and therefore discoverable.
• This risk is distinct from the general privilege-waiver risk described under Client Type 2.

Client Type 6: The Regulated Entity (FinTech, HealthTech, and Pharma)

The Focus: Statutory compliance risk, sitting alongside and independent of the underlying legal matter.

For organisations operating under sector-specific regulatory oversight, AI use during a matter can create exposure that has nothing to do with the matter itself.

• Inputting customer financial data, clinical trial data, or health information into an unvetted public AI tool can itself amount to an unauthorised third-party data transfer under frameworks such as GDPR, India’s DPDP Act, or the EU AI Act, depending on how the specific tool processes and retains data. This exposure is regulatory, not litigation-related, and can result in liability entirely separate from the outcome of the underlying matter.

A Note for Counsel Using This Document

This reckoner is deliberately organised by client type rather than by practice area, because the exposure a client creates through AI use tracks who they are and how they behave far more reliably than it tracks the subject matter of the dispute. A GC-run corporate client and an individual inventor filing their first patent face almost entirely different risks from the same underlying technology. Onboarding should be calibrated accordingly, not treated as a single boilerplate warning appended to a retainer letter.

This document is a general starting point, not jurisdiction-specific legal advice. Privilege doctrine, novelty standards, trade secret requirements, and data protection obligations vary by jurisdiction and evolve over time. Firms adapting this for their own clients should confirm the specific rules that apply to the jurisdiction and matter at hand before relying on it.