Privilege Is an
Architecture Decision.

Discovery is where a law practice’s most sensitive material concentrates. Client communications, litigation strategy, work product, the documents a matter actually turns on — all of it piles up in one reviewable corpus. And review is exactly the task the profession is now handing to AI, because AI is genuinely good at it: summarize this deposition, find every document that discusses the indemnification clause, build a chronology from these ten thousand emails.

The capability is real. The question almost nobody asks before uploading is architectural: where does the document go when you press enter?

For most AI tools the answer is: to a third party. The document leaves the firm’s custody, transits the public internet, and is processed on infrastructure the firm does not control, under terms of service the firm did not draft — terms that may permit the vendor to retain prompts, log outputs, have humans review flagged content, or use interactions to improve the service. Each of those is a copy of privileged material, held by a non-lawyer third party, outside the firm’s control and subject to that vendor’s breach exposure and legal process.

Privilege survives on confidentiality — and confidentiality has a supply chain

Attorney-client privilege is not a property of a document; it is a property of how the document has been kept. It attaches to confidential communications and it is famously fragile: voluntary disclosure to an outside party can waive it, and a client who does not take reasonable steps to keep a communication confidential can lose the protection entirely.

The profession has been circling this. The ABA’s Formal Opinion 512 on generative AI (2024) told lawyers what careful readers already suspected: the duties of competence and confidentiality apply with full force to these tools, and a lawyer may need informed client consent before putting client information into an AI system — precisely because of the risk that the information is disclosed to, retained by, or learned from by someone who is not the client’s lawyer. State bar working groups, including in Texas, have issued the same directional guidance: understand where the data goes before you send it.

Now be honest about the legal posture, because honesty is the point of this series: no court has squarely held that routine use of a commercial cloud AI tool waives privilege. Reasonable-efforts standards have historically tolerated third-party service providers under proper confidentiality agreements — that is how cloud e-discovery platforms already operate. But "a court probably wouldn’t find waiver" is a strange load-bearing wall for the most privileged material a firm holds, and the terms, retention behavior, and training practices of AI vendors are both harder to pin down and faster-moving than a hosting contract. Nobody wants to be the test case. The cheapest way to win that argument is to never have to make it.

// the shape of the claim

You cannot waive privilege to a vendor the document never reached.

The architectural answer: the model comes to the documents

The entire risk category above comes from one design choice: moving privileged documents to where the model lives. Invert it. Bring the model to where the documents live.

That is the design we build to. An air-gapped document-intelligence appliance: a retrieval-augmented system — the same architecture the cloud tools use — running entirely on hardware the firm owns, inside the firm’s walls. Documents are indexed locally. Inference runs locally, on local hardware, with no external API calls. The system operates with the network cable unplugged, which is not a metaphor but the acceptance test. Nothing about a matter — not a document, not a query, not an embedding — leaves the building.

What that buys, concretely:

• No third-party disclosure to analyze. The waiver question above does not get harder under AI, because the AI never becomes a third party holding your client’s communications. The confidentiality story is the same one the firm already tells about its file room.
• No vendor retention, no vendor training, no vendor subpoena surface. There are no prompt logs on someone else’s servers to retain, breach, or compel. The only copies that exist are the ones the firm decides to keep, under the firm’s own retention policy.
• An answerable audit trail. When a client — or a court — asks “what touched this document?”, the answer is a local log on firm hardware, not a request to a vendor’s trust portal. Every retrieval and every generated answer can be traced to the specific source documents it drew from, which is also what makes the output checkable.
• The economics of unlimited use. With no per-token metering, the marginal cost of asking is zero — which changes how thoroughly a small firm can afford to interrogate a large corpus.

The honest limits (because elite means honest)

An air-gap solves the confidentiality problem. It does not solve every problem, and a vendor who implies otherwise should worry you.

• Local models do not fix hallucination. A language model running on your own hardware can still make things up — the sanctions cases over fabricated citations were about unverified output, not about where the model ran. This is why retrieval-grounded answers with visible source citations matter, and why nothing this system produces is a substitute for attorney review. The lawyer signs the filing, not the appliance.
• Frontier cloud models are more capable, today. A well-tuned local model is excellent at grounded retrieval, summarization, and first-pass review over a defined corpus. It is not the strongest general reasoner money can rent. The trade is deliberate: for privileged material, we take the model that never sees the internet over the model that lives on it.
• Architecture is necessary, not sufficient. An air-gapped appliance inside a firm with sloppy access control is a fast local copy of your worst problem. Confidentiality still requires the boring disciplines — access scoped by matter, screens honored, logs reviewed, retention enforced. The appliance makes those disciplines enforceable on hardware you control; it does not perform them for you.
• This is an engineering argument, not legal advice. Whether a given workflow satisfies a given jurisdiction’s reasonable-efforts standard is a question for the firm’s own ethics counsel. What engineering can do is remove entire categories of exposure from the analysis — and that is what this architecture does.

The question to ask any AI vendor

Every legal-AI pitch deck says “secure” and “private.” One question sorts the claims: “Does it work with the network cable unplugged?” If the answer is no, then somewhere there is a third party processing your client’s privileged communications, and everything else in the deck is a description of how much you trust them. That may be a trust worth extending for public material. For the privileged core of a practice, we think the defensible answer is the one that requires no trust at all — because the document never left.

That is the same conviction that runs through everything we build: systems whose confidentiality story is physics and custody, not promises — and whose outputs come with the evidence to check them.

— Meta Strawman, Argus Dynamics