Does an AI note taker put legal professional privilege at risk?

How privilege attaches in the first place

In the uniform evidence jurisdictions, client legal privilege is in Part 3.10, Division 1 of the Evidence Act 1995 (Cth), ss 117 to 126, and the matching State and Territory Acts. Two sections create it.

• Advice privilege, s 118. Evidence is not to be adduced if it would disclose a confidential communication between the client and a lawyer, or the contents of a confidential document prepared by the client, the lawyer or another person, for the dominant purpose of the lawyer providing legal advice to the client.
• Litigation privilege, s 119. The same protection for confidential communications, including with third parties, and confidential documents made for the dominant purpose of the client being provided with legal services relating to a proceeding that is on foot or anticipated.

Both sections turn on the word 'confidential'. Section 117 defines a confidential communication as one made in circumstances where the person who made it, or the person it was made to, was under an express or implied obligation not to disclose its contents. A confidential document is defined the same way, by reference to the person who prepared it or the person it was prepared for.

The Act's privilege provisions are framed around adducing evidence in a proceeding. Whether the Act or the common law governs earlier stages, such as discovery, subpoenas and regulators' notices, depends on the jurisdiction. The common law test is also dominant purpose (Esso Australia Resources Ltd v Commissioner of Taxation (1999) 201 CLR 49), and confidentiality is just as central. Our article on whether attendance notes are privileged covers how the test applies to the note itself.

How privilege is lost

Section 122 is the provision that matters for software. Privilege does not prevent evidence being adduced with the consent of the client (s 122(1)). Nor does it prevent evidence being adduced if the client has acted in a way that is inconsistent with objecting to its disclosure (s 122(2)). A client is taken to have done that if the client knowingly and voluntarily disclosed the substance of the evidence to another person (s 122(3)(a)).

Two parts of s 122 cut the other way and are often missed:

• Section 122(5)(a)(i). A client is not taken to have acted inconsistently merely because the substance of the evidence was disclosed 'in the course of making a confidential communication or preparing a confidential document'.
• Section 122(4). A disclosure by an employee or agent of the client or of the lawyer does not count as a knowing and voluntary disclosure unless that employee or agent was authorised to make it.

At common law the test is the one in Mann v Carnell (1999) 201 CLR 1. Waiver depends on whether the privilege holder's conduct is inconsistent with maintaining the confidentiality the privilege protects. The test is objective, and what the client intended does not decide it. The High Court also said in Glencore International AG v Commissioner of Taxation [2019] HCA 26 that privilege is an immunity from compelled disclosure. It does not give the client a right to restrain the use of privileged material that is already in someone else's hands.

Section 126 adds a knock-on risk. Where privilege is lost over one communication, a related communication or document can be adduced if it is reasonably necessary to understand the first.

Confidentiality is a separate duty

Privilege belongs to the client and is argued about in court. Confidentiality is the solicitor's own duty, in equity, in contract and under r 9 of the Australian Solicitors' Conduct Rules (ASCR). Rule 9.1 bars disclosing client confidential information to anyone outside the practice. Rule 9.1.2 carves out a person engaged by the practice to deliver or administer legal services for the client, and r 9.2.1 allows disclosure the client expressly or impliedly authorises. A tool can leave privilege intact and still put you in breach of r 9, and the reverse. Check both.

Applying the test to a third-party AI note taker

When a privileged call is transcribed and summarised by a vendor's software, the vendor and usually its AI provider handle the content. Whether that is conduct inconsistent with confidentiality depends on the terms they handle it under.

The argument that privilege survives runs like this. Firms give privileged material to typists, cloud hosts and document review platforms under confidentiality terms as a matter of routine. A vendor bound by contract not to disclose the content is under an 'express obligation not to disclose' in the language of s 117. Giving it the transcript so it can prepare a confidential file note looks like disclosure 'in the course of preparing a confidential document' under s 122(5)(a)(i). At common law, a limited disclosure for a limited purpose under an obligation of confidence is hard to call inconsistent with keeping the material confidential.

That is an argument. It has not been decided for AI tools. The AI selection and use checklist issued in February 2026 by the Queensland Law Society with the Law Institute of Victoria and five other law societies puts it plainly: the impact of using AI to process privileged communications 'is not clear'. It adds that using such material to train an AI system is arguably incompatible with an intention to keep it confidential.

On location, offshore storage does not by itself waive privilege. It adds two things to weigh. Under s 16C of the Privacy Act 1988 (Cth) a practice covered by the Act stays accountable for how an overseas recipient handles personal information. And data held in another country can be sought under that country's legal process.

What Australian courts have said so far

We are not aware of an Australian decision that decides whether a commercial AI tool under confidentiality terms affects privilege. There are judicial warnings about putting documents into AI programs, and they are worth reading for what they do and do not cover.

• Helmold & Mariya (No 2) [2025] FedCFamC1A 163 (12 September 2025). The Full Court of the Federal Circuit and Family Court said that input of documents arising out of the proceedings 'into a generative AI program which stores, collates and replicates data may waive privilege', and that these issues 'warrant extreme caution'. The comment was made in passing. The appeal was about parenting orders and a litigant's AI-generated citations.
• Mertz & Mertz (No 3) [2025] FedCFamC1A 222 (28 November 2025). The Full Court said there is a risk that entering draft documents into an AI program will breach s 114Q of the Family Law Act 1975 (Cth) or the Harman undertaking 'and/or give rise to a waiver of legal professional privilege'.
• Federal Court of Australia, GPN-AI (16 April 2026). Paragraph 4.13 warns that information given to a generally accessible Gen AI tool may become available to other people. A footnote says the guidance is directed particularly at open or public tools, and that the risks of inadvertent disclosure may be lower for tools that operate in closed or controlled environments.
• NSW Supreme Court, Practice Note SC Gen 23. Paragraph 7(e) lists, among the risks of Gen AI, the lack of adequate safeguards to preserve the confidentiality, privacy or legal professional privilege attaching to material submitted to a public Gen AI chatbot.

Read together, the courts distinguish public tools from closed ones and send you to the contract terms. None of it is a ruling on a note taker.

Overseas decisions (not binding in Australia)

Two 2026 decisions are being cited in Australian commentary. Both come from different privilege rules.

• United States v Heppner (United States District Court, Southern District of New York, opinion of 17 February 2026). Judge Rakoff held that about 31 documents a criminal defendant created with the publicly available AI platform Claude were not protected by attorney-client privilege or the work product doctrine. The defendant had used the tool on his own, without direction from his lawyers. The provider's privacy policy allowed it to collect inputs and outputs, train on them and disclose them to third parties, so there was no reasonable expectation of confidentiality. The opinion left room for a different result where a lawyer directs the client to use the tool, by reference to the US rule that protects communications with a lawyer's non-lawyer agent. The case is about a client using a consumer tool by himself. A firm's tool under a commercial contract was not before the court.
• R (Munir) v Secretary of State for the Home Department [2026] UKUT 81 (IAC). The UK Upper Tribunal said that uploading confidential documents into 'an open-source AI tool, such as ChatGPT' places the information in the public domain, breaches client confidentiality and waives legal privilege. It added that closed source tools that do not place information in the public domain, and it named Microsoft Copilot, are available for tasks such as summarising without those risks.

An Australian court may or may not find these persuasive. Both turned on the terms and nature of the tool, which is where the Australian test points as well.

Two risks firms overlook

More records to review

Privilege protects confidential communications made for the dominant purpose of legal advice or litigation. A transcript of a call with the other side, or a purely administrative call, may not be privileged at all. A tool that keeps a verbatim transcript or recording of every call creates documents that did not exist before, and each may have to be reviewed, and some produced, in discovery. Decide what you keep. See file notes as evidence.

The client's own AI use

The client holds the privilege, and the client can lose it. Lawcover's commentary on its Sample AI Policy (March 2026) says that when clients put their communications with you into an AI tool 'they may unwittingly waive their legal professional privilege', and suggests warning them. QLS has published a template, 'Warning to Clients - Client use of AI and Confidential Information' (April 2026), for the same reason.

Practical steps

1. Read the binding terms. Look for an express confidentiality obligation, a no-training term that covers the AI provider, named sub-processors, retention periods and deletion on termination. The website FAQ is not the contract.
2. Keep public and personal tools out. Name one approved tool in your AI policy and prohibit free or personal accounts for client matters. See our AI note taking policy template.
3. Prefer tools that create less. No new audio recording is better than a recording held by a third party. A short retention period for transcripts is better than indefinite storage.
4. Tell clients. Add a technology clause to your costs agreement or engagement letter. That supports authority under ASCR r 9.2.1. The regulators' wider expectations are in can lawyers use AI for file notes?
5. Warn clients about their own use. One paragraph in the engagement letter, repeated at the first meeting.
6. Turn the tool off when the stakes call for it. Settlement strategy, admissions, or material covered by a suppression order or the Harman undertaking can be noted by hand.
7. Record the assessment. Date it, file it with the policy, and re-check the vendor's terms each year.
8. Review every note. A solicitor who was on the call checks the draft before it becomes the record.

The second and fifth steps can be recorded on the file like this. The client and matter are invented.

Where CallNote sits on these factors

CallNote never records calls, never joins a meeting as a bot and never stores call audio, so it does not create a new recording of a privileged conversation. It turns a transcript your phone or meeting system already made into an attendance note. Data is hosted in Sydney (AWS ap-southeast-2), encrypted, and not used to train AI. The published note is sealed with a SHA-256 checksum and locked, with append-only amendments and an audit log.

Two things to weigh against that. The AI generation step currently runs through a US-based provider, with all-Australian processing on the roadmap, so content does leave Australia for that step. And we cannot tell you that using CallNote, or any tool, preserves privilege, because no Australian court has ruled on it. Ask us for the current terms, run the checklist in AI note takers for Australian law firms, and make the call for your own practice. More on how CallNote works for law firms.

Common questions