Does an AI Notetaker Waive Attorney-Client Privilege?

Short answer: using an AI notetaker does not automatically waive attorney-client privilege, but the wrong architecture and the wrong workflow can meaningfully increase the risk of waiver, disclosure, or discoverability. The question is not whether AI is allowed in a law practice — the ABA and state bars have made clear it is — but whether the specific tool you choose, and how you deploy it, is consistent with your duties under Model Rule 1.6, Rule 1.1 (competence), and Rule 5.3 (supervision of nonlawyer assistants).

This article walks through the current state of authority, the mechanics of how a cloud AI notetaker can create waiver exposure, and the risk-reduction steps a careful lawyer should take before pointing any transcription tool at a privileged conversation.

The core doctrine, in one paragraph

Attorney-client privilege attaches to a confidential communication between lawyer and client made for the purpose of legal advice. Confidentiality is the load-bearing element. A voluntary disclosure of a privileged communication to a third party — a person or, in the modern reading, a service — generally destroys the privilege as to that communication and can, in some jurisdictions and under some circumstances, produce subject-matter waiver over related communications. There is a well-established agency exception for necessary agents of the lawyer (interpreters, paralegals, experts, secretarial services), but the exception is not unlimited, and courts scrutinize whether the third party was reasonably necessary and bound to confidentiality.

The AI notetaker question is, at bottom, whether the vendor sitting in the middle of your privileged conversation is (a) a permitted agent under a properly scoped confidentiality regime, or (b) a third-party recipient that punctures confidentiality the moment audio leaves the room.

What the ABA and NYC Bar have actually said

ABA Formal Opinion 512 (July 2024) is the current benchmark. It addresses generative AI tools and confirms that lawyers may use them, but imposes concrete duties: understand the tool's data handling (competence under Rule 1.1), obtain informed client consent when confidential information will be input into a self-learning or third-party-hosted system, evaluate the vendor's confidentiality obligations, and supervise outputs under Rule 5.3. Opinion 512 is not a permission slip. It is a checklist that most consumer AI transcription products fail on their face.

NYC Bar Formal Opinion 2025-6 (December 2025) sharpens the point. It treats the choice of AI vendor as an ethical decision, not merely a procurement decision, and warns that using a tool that trains on client data, retains audio indefinitely, or lacks a meaningful confidentiality obligation is inconsistent with Rule 1.6. The opinion also underscores that generic click-through terms of service do not substitute for a data processing agreement or equivalent contractual protection.

Read together, these opinions do not ban AI notetakers. They require that the lawyer be able to answer three questions in writing: Where does the audio go? Who can see it? What are they contractually forbidden from doing with it?

Why cloud transcription creates waiver exposure

A typical cloud AI notetaker works like this: a bot joins the call (or the desktop app streams audio out), the audio is uploaded to the vendor's servers, a speech-to-text model transcribes it, a large language model summarizes it, and the resulting artifacts are stored — often on infrastructure operated by a further set of subprocessors. Each hop is a potential confidentiality problem:

• Transmission. Audio leaves the lawyer's device. Even encrypted in transit, it is being disclosed to an external processor.
• Storage. Recordings and transcripts sit on vendor infrastructure, often for extended retention windows, and are subject to subpoena, government legal process, insider access, and breach.
• Training. Some vendors reserve rights to use customer content to improve models. Opinion 512 flags this specifically.
• Subprocessors. Cloud transcription vendors typically use several downstream providers. Each is another entity with technical access to privileged material.
• Bot presence. When a visible AI bot joins a Zoom or Teams call, opposing counsel, adverse witnesses, or third parties on the call are on notice that a recording is being made and sent to an outside service — a fact that can be raised later on the record.

None of these facts, standing alone, determines waiver. But every one of them is a fact a court can weigh when deciding whether the communication remained confidential, and whether the vendor was a reasonably necessary agent of the lawyer or an ordinary third-party service provider.

The Heppner signal on third-party AI disclosure

United States v. Heppner (S.D.N.Y., February 2026, Judge Rakoff) is the case AI-vendor sales decks would prefer you not read. The court held that a litigant's chats with a public AI platform were not privileged, reasoning by analogy to the third-party doctrine: once the user voluntarily conveyed the content to an external service, the expectation of confidentiality collapsed. Heppner involved a party's own chats, not a lawyer's notetaker, so it is not directly on point for privilege between counsel and client. But the reasoning matters. Courts are increasingly willing to treat interactions with commercial AI services as disclosures to third parties, and to reject the assumption that a privacy policy is the same as a privilege-preserving relationship.

The Brewer v. Otter.ai litigation (2025) makes a related point on the wiretap and consent side: plaintiffs alleged that an AI notetaker's automatic recording and transcription created exposure under state two-party consent statutes and federal wiretap law. Whatever the ultimate merits, the case is a reminder that the risk surface of a cloud notetaker is not limited to privilege — it also includes recording-consent statutes that vary sharply by state.

The agency exception and why it is not a free pass

Defenders of cloud AI notetakers argue that vendors are simply the modern equivalent of a stenographer or transcription service, and therefore covered by the agency exception. That analogy has some force, but it has limits. Courts examining the agency exception typically look at whether the third party was engaged specifically by the lawyer, whether disclosure to that third party was reasonably necessary to the representation, whether the third party was bound by a meaningful confidentiality obligation, and whether the third party's own use of the material was constrained.

West Technology Group v. Sundstrom (D. Conn. 2024) is a useful reference point for how carefully courts parse the necessity and confidentiality prongs when a third party is in the room. A vendor whose standard terms permit model training, whose retention is indefinite, whose subprocessor list is long and shifting, and whose DPA is unavailable to solo and small-firm customers is a hard fit for the classical agent analogy.

A comparison of common notetaker architectures

A practical checklist before you point any AI at a privileged call

1. Read the DPA, not the marketing page. If the vendor will not sign a data processing agreement, that alone is disqualifying for privileged work under NYC Bar 2025-6's reasoning.
2. Confirm no-training terms in writing. Opinion 512 treats model training on client content as a distinct confidentiality problem.
3. Map the subprocessor list. Every subprocessor is a potential recipient. If the list is not published, ask.
4. Check the retention default. Indefinite retention of recordings and transcripts is a liability, not a feature.
5. Get client consent that is actually informed. The client should know what tool is being used, where the data goes, and what the retention is.
6. Comply with recording-consent law. Two-party consent states require the consent of every participant, not just the client. The Brewer exposure is real.
7. Label outputs. Mark AI-generated notes as privileged and confidential work product, and keep them inside the matter file, not in a general-purpose notes app.
8. Supervise. Rule 5.3 does not evaporate because the assistant is a model. Review outputs before they are relied on.

Frequently mischaracterized questions

"Isn't the vendor just like a court reporter?" Sometimes, but not automatically. A court reporter is engaged for a specific proceeding, is bound by professional rules, and does not train future products on the transcript. A consumer AI notetaker is a general-purpose commercial service. The analogy holds only where the contractual posture actually matches.

"Encryption in transit solves this." No. Encryption protects against interception. It does not change the fact that the vendor is a recipient of the plaintext once it arrives.

"Our vendor is SOC 2, so we're fine." SOC 2 is a security control attestation. It is not a privilege doctrine. It says nothing about waiver.

"We can just redact before sharing." Redaction after the fact does not un-disclose the material to the vendor. Waiver analysis looks at the original disclosure, not the downstream distribution.

How Basil approaches this

Basil is built on a simple architectural choice: audio, transcription, and summarization all run on-device, on the Apple Neural Engine. Nothing is uploaded. There is no Basil server that receives your meeting content, and no subprocessor chain to audit, because there is no external processor in the loop at all. For virtual meetings, Basil's Computer mode captures the call on your Mac without sending a bot into the room.

Waiver analysis is fact-specific, and no vendor can honestly promise a particular legal outcome. What an on-device architecture does do is remove the third-party recipient from the picture — which is the fact pattern Heppner, ABA 512, and NYC Bar 2025-6 are most concerned about. It is privilege-safe by architecture in the narrow, honest sense: there is no server to subpoena, and no vendor sitting between you and your client.

The general Basil app is available today with a 60-minute free monthly tier. The Basil for Law edition — with privilege attestation, consent log, matter organization, and Privileged & Confidential labeling — launches in August 2026 at $19/month for solos, with a 7-day trial. Basil signs DPAs and NDAs on request, though the more important point is that a DPA is a fallback control for architectures that need one.

For related reading, see our explainers on ABA Formal Opinion 512 for practicing lawyers and why on-device AI matters for law firms.

This article is for information only and is not legal advice.

Frequently asked questions

Does using an AI notetaker automatically waive attorney-client privilege?

No. Waiver depends on the facts, including whether the vendor is a reasonably necessary agent of the lawyer, whether confidentiality was preserved, and whether the client consented. But cloud notetakers that upload audio to third-party servers, use subprocessors, or reserve rights to train on content materially increase waiver risk under ABA Formal Opinion 512 and NYC Bar Formal Opinion 2025-6.

What does ABA Formal Opinion 512 require when using AI in client matters?

Opinion 512 requires that lawyers understand the tool's data handling (Rule 1.1 competence), protect confidentiality (Rule 1.6), obtain informed client consent when confidential information will be processed by a third-party or self-learning system, evaluate the vendor's confidentiality obligations, and supervise outputs under Rule 5.3.

Is on-device AI transcription safer for privileged conversations?

An on-device architecture removes the external vendor as a recipient of the audio and transcript, which addresses the core third-party disclosure concern raised in cases like United States v. Heppner. It reduces risk substantially but does not eliminate every consideration — client consent, recording-consent statutes, and supervision duties still apply.

What did United States v. Heppner hold about AI and privilege?

In Heppner (S.D.N.Y. Feb. 2026), Judge Rakoff held that a litigant's chats with a public AI platform were not privileged, reasoning by analogy to the third-party doctrine. The decision involved a party's own chats rather than a lawyer's notetaker, but its logic — that voluntary conveyance of content to an external AI service undermines confidentiality — is directly relevant to how courts may view cloud AI notetakers.

Do I need client consent to use an AI notetaker?

Under ABA Formal Opinion 512 and NYC Bar Formal Opinion 2025-6, informed client consent is expected when confidential information will be processed by a third-party or self-learning AI system. Consent should identify the tool, describe where the data goes, and address retention. Two-party consent states also require the consent of every meeting participant for the recording itself.

Is a signed DPA enough to make an AI notetaker safe for privileged work?

A data processing agreement with no-training terms and a defined subprocessor list is an important control, and NYC Bar 2025-6 effectively expects one for privileged work. But a DPA does not change the underlying fact that a third party is receiving the audio. It reduces risk; it does not eliminate the third-party disclosure surface the way an on-device architecture does.

Keep client conversations on your device

Basil transcribes and summarizes entirely on-device — no cloud, no bot, no server to subpoena. See Basil for Law → · Legal-tool reviews →

This article is for information only and is not legal advice.