Employee use of AI could put your legal position at risk

Tebogo Sibidla, Director in Werksmans Attorneys' Digital Media and Electronic Communications practice.

---

New research shows that 70% of employees admit to using AI to complete high-stakes or sensitive work, with 41% using it for legal and compliance issues. 

As AI becomes part of an organisation’s legal decision-making processes, it introduces a significant risk: by the time a lawyer gets involved in a matter, AI may have already influenced commercial decisions and affected the organisation’s legal position.

Many organisations have developed AI governance frameworks addressing cybersecurity, privacy, intellectual property, acceptable use and regulatory compliance. However, comparatively little attention has been given to how employee AI use can affect an organisation's legal position. 

By asking AI whether contracts can be terminated, uploading confidential contracts or correspondence to public AI platforms or asking it to recommend a litigation strategy, employees may unknowingly have done legal harm that may only become apparent much later.

This issue is no longer theoretical either. Recent judicial decisions demonstrate that courts are applying long-established legal principles of confidentiality, legal professional privilege, evidential integrity and professional accountability to the use of AI.

Historically, employees confronted with unfamiliar contractual provisions, regulatory obligations or employment issues would seek guidance from legal teams before taking significant decisions. Today, many employees consult AI first. This behavioural shift has important implications.

Legal advice is only as reliable as the information upon which it is based. If employees rely on AI to interpret contracts, summarise correspondence, identify legal issues or assess regulatory obligations before lawyers become involved, AI may shape both the decisions taken and the information presented to legal advisers.

AI systems may simplify complex legal questions, present tentative propositions with unwarranted confidence, overlook jurisdiction-specific requirements or fail to appreciate commercial context. 

They may identify certain risks while overlooking others, prioritise commercially attractive options over legally prudent ones, or incorrectly assume that legal principles from one jurisdiction apply elsewhere.

The objective should not be to prohibit employee use of AI, which is embedded in everyday business practice. Instead, businesses should look at where it can be used to support productivity, where legal review should remain mandatory, and where public AI platforms should not be used at all.

The way employees interact with AI may itself unintentionally alter the organisation's legal position.

Consider a transaction team negotiating a high-value acquisition where an employee uploads a draft share purchase agreement into a publicly available AI platform and asks whether the indemnity provisions are market standard. This scenario illustrates two significant governance risks. 

First, confidential commercial information may be disclosed to third-party AI providers, and organisations may have limited visibility over how uploaded information is stored, processed or used. Second, the use of public AI platforms may affect claims of confidentiality or legal professional privilege.

In United States v Heppner, a US federal court held that communications with publicly available AI platforms are not protected by attorney-client privilege, even where used to prepare a defence strategy or legal arguments in anticipation of litigation. 

Similarly, in Secretary of State for the Home Department v Hamid, the English High Court held that uploading client letters and Home Office decision letters to an open-source AI tool places that information in the public domain.

These decisions illustrate a broader lesson: public AI platforms should not be regarded as confidential. Organisations should distinguish between enterprise AI environments with appropriate contractual safeguards and publicly available systems whose treatment of uploaded information may differ significantly.

Many employees regard AI interactions as informal working notes or preliminary research. However, in litigation, regulatory investigations, competition inquiries, tax audits or shareholder disputes, these interactions may form part of the organisation's legal record.

Employees frequently ask AI to summarise witness interviews, prepare chronologies, analyse documentary evidence or draft investigation reports. Those outputs may create additional records subject to scrutiny in subsequent proceedings and may become embedded in board papers, regulatory submissions, internal memoranda, or legal instructions. 

Organisations may ultimately be required to explain not only the decisions taken, but also the role AI played in reaching them.

Discovery obligations extend beyond final documents to drafts, communications and other electronically stored information. Organisations should proceed on the basis that prompts, uploaded documents and AI-generated outputs relating to significant matters may one day require disclosure.

In Fortis Advisors LLC v Krafton Inc., AI communications became part of the evidence in the case while in Goodwin v Goodwin, the English High Court approached witness evidence with caution where draft witness statements had been uploaded to ChatGPT before being finalised. 

The case illustrates that AI-assisted drafting may affect the weight a court is prepared to attach to evidence where there are concerns that the statements no longer reflect the witness's own words. AI governance should therefore extend beyond acceptable-use policies to encompass document retention, records management and investigation protocols. 

Organisations should preserve original source documents, avoid relying exclusively on AI-generated summaries in significant matters and ensure legal advisers have access to primary evidence. In an era where AI interactions may become part of the legal record, preserving the integrity of that record is as important as preserving the underlying documents. 

Courts have also reinforced that responsibility for the accuracy of legal work remains with the human user, not the technology. AI may assist decision-making, but it does not replace professional judgment or diminish human accountability. 

For example, in Mavundla v MEC: Department of Co-operative Government and Traditional Affairs, KwaZulu-Natal and Others; Judge Elsje-Marie Bezuidenhout wrote in her judgment that “courts expect lawyers to bring a legally independent and questioning mind to bear on, especially, novel legal matters, and certainly not to merely repeat in parrot-fashion, the unverified research of a chatbot.” 

AI can influence your organisation's entire legal lifecycle, from negotiating contracts and pursuing acquisitions to responding to regulators, conducting investigations, managing compliance and resolving disputes.

The organisations that derive the greatest value from it are unlikely to be those that adopt AI the fastest. They will be those that recognise AI is changing how legal risk emerges within organisations.