The risk is the file, the personal data, and the document you sign

Hong Kong has not yet had a reported case on whether typing a matter into a generative AI tool waives privilege. Stevenson, Wong & Co. recorded that in October 2026. The principles are older than the tools. Privilege covers communications made in confidence.

In January 2024 the Law Society of Hong Kong said that a great deal of legal data is confidential or privileged, and it warned about sending that data to a cloud service. Baker McKenzie’s Hong Kong note says that, on ordinary principles, privilege can be lost if the information is disclosed to the provider, and that the same act can break a duty of confidence. The Court of Final Appeal has said privilege protects lawyer-and-client communications made in confidence. That is the test in MK v Director of Legal Aid.

A tool that receives the advice is another party. Whether that is fatal will depend on the terms and the facts. A firm should not wait for the judgment before it decides where this week’s file is typed.

Client files, staff records and KYC packs are personal data under the Personal Data (Privacy) Ordinance. In March 2025 the Privacy Commissioner published a checklist for staff use of generative AI. It asks an organisation to name the tools that are allowed, to say what may be typed in, to say what the output may be used for, and to say how long it is kept. It also says a person must check the output.

A practice in which every lawyer picks a website has not done that. A practice that has one system, on its own machines, with access set by the firm and a record of what was done, can answer the checklist in sentences that match how the tool actually works.

If the file is processed on the firm’s own machines, it has not been disclosed to us and it has not been disclosed to a model provider. There is no outside copy for a vendor to retain, and no outside company to compel. That does not dispose of every privilege question a court might one day ask. It removes the disclosure those questions are about.

The same fact answers the client. Some engagement letters already say the documents are not to be given to a third-party tool. Others will ask, at the next panel review, where the firm’s AI runs. “On our own machines, and the vendor cannot see the file” is a sentence you can give once. “They promised not to train on it” is a sentence you then have to explain.

A tool can invent a case, or agree with a wrong premise, in prose that looks finished. In 2023 a New York court sanctioned lawyers in Mata v Avianca for filing authorities a chatbot had made up. Hong Kong has not had that reported incident. The duty is the same. The tool does not sign the document. The firm does. No contract moves that duty, including ours.

What we can do is make the check faster and harder to skip. Every answer is tied to the passage it came from, and the lawyer can open that passage in the source. Changes to a document come back as track changes, in the document’s own formatting, so the lawyer sees what moved and does not have to rebuild the paper to find out. The record shows what was asked, what the system used, and what changed.

A private system deals with disclosure by never receiving the file. It does not deal with a bad draft by signing it. That remains the lawyer’s work. The system should make that work visible, not hide it in a confident paragraph.