Lawyers using AI transcription tools must verify vendor data policies before sharing privileged client conversations. The time saved by automated note-taking often obscures the technical risks involved in sending sensitive audio to third-party servers. Attorney-client privilege only functions if confidentiality is maintained. When it isn’t, the issue becomes not merely a data problem, but a privilege problem. Privilege problems are more difficult to reverse.
How the Audio is Handled After the Call
Different transcription tools handle audio in different ways. Some handle it locally and never send it anywhere, while most upload it to a server as soon as you finish recording. Then it is beyond your control. Before using a recording and transcription tool for talking to a client, it is worthwhile to find out whether the recording is actually stored somewhere or merely transcribed and thrown away. It also helps to know where the servers are located and whether your audio is crossing any borders that were not expected.
Related: Mastering the art of sticky notes
The most appropriate platform for having privileged conversations does not have to be the one with the greatest number of features; it should be the one that allows you to state exactly where your client’s words went, who had the possibility of reading them, and who could have read them.
Who Else Can See the Files
A transcript rarely remains within the company that is listed on the app. Instead, it goes through employees, contractors, and a small number of third-party subprocessors that most users never hear about. Each one is a door, and every door has to be locked. The vendor determines where it is sent, who is allowed to see it, and how long it is retained. Phone calls, which at first appear to be merely administrative, such as a simple check on scheduling, can soon turn into a proper status update within a few sentences.
Related: French court blocks Macron’s youth social media ban
Data Retention and Deletion
Even if a transcription platform has good security measures in place, it can still keep every transcript sent indefinitely, since the settings never included the option to delete. Before choosing a workflow, find out what the default retention period is, whether you can delete a transcript yourself, and if “deleted” really means that the transcript is permanently gone or merely hidden from view. You would not want to find this out in real time if a client calls tomorrow and asks to get rid of all traces of their consultation.
Using Data for Model Improvement
Many AI tools use customer data, in some form, to help improve their models. Many companies clearly state this in their terms of service. It does not by itself constitute a serious warning; it is a quite ordinary way in which products become better over time. The real issue is whether or not you knew this before uploading the privileged call and whether or not the plan chosen actually allows you to make a decision. Generally speaking, the enterprise and consumer versions deal with this in different ways, and the terms of service usually explain it more clearly than any sales discussion ever will.
Related: ICE detainee films worms in drinking water
While the temptation to rely on a tool that promises instant results is strong, the 2024 Formal Opinion 512 from the ABA makes it clear that attorneys must either understand the capabilities and risks of a particular tool themselves or arrange for someone else to do so. A transcription app with a simple interface is not exempt from this just because it seems easy to use. Attorneys must verify the security documentation available, including, for example, SOC 2 reports or summaries of penetration tests, not just marketing statements.
Most lawyers who use one of these transcription tools assess it the same way they would any other piece of software: by considering how accurate it is, how much it costs, and how much time it will save. Few read the data retention policy, and even fewer inquire about who else has access to the recording after it has left their laptop. Since 2012, Comment 8 to Model Rule 1.1 has made it part of a lawyer’s fundamental duty of competence to have a working understanding of the benefits and risks associated with the relevant technology.
