Your AI Passed the Bar Exam. Your Supervision Controls Didn’t.

Your AI passed the bar exam. Your governance didn’t. That was the title of my session at AI Gov World in Las Vegas today, and the argument behind it is simple. A model can be competent at legal work and still leave the lawyer who deployed it exposed on privilege, confidentiality, and supervision. 

A federal judge in Manhattan has already shown what that exposure looks like. In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York held that a defendant’s conversations with a public AI chatbot were not privileged and that the documents he built with it were not work product. The chatbot is not a lawyer, its privacy policy allowed collection and disclosure of user inputs, and the defendant was not seeking legal advice when he typed. His counsel had not directed the use either. 

The ruling is narrow, and the court acknowledged that a tool used at counsel’s direction might be analyzed differently. That opening is where every legal department now lives. I was not the only speaker circling it. The agenda around my session asks what meaningful human oversight looks like compared with passive review, how to verify the human intent behind an agent’s action, and how to govern non-human identities. Nobody on that program is debating whether the tools work. They are asking who answers when the tools fail. 

Lawyers keep asking whether the AI is privileged. That is the wrong question. A tool cannot hold a privilege. The question is whether your use of it destroyed the confidentiality the privilege depends on, and that gets decided by conduct, contracts, and records long before a court ever sees it. 

Consumer terms are where it breaks first. A platform free to use and disclose what you feed it looks like a third party in the room. Enterprise terms with written confidentiality commitments, no training on your inputs, and controlled retention keep the argument available. They do not guarantee it, and I would be wary of anyone who says they do. 

The exposure also runs deeper than the model provider. Many departments have papered that layer reasonably well. The harder layer is everyone built on top of it: the legal-tech vendor wrapping someone else’s model, and the vendors you signed years ago that have quietly added AI features since. Which model, who writes the system prompt, where your data goes, what happens at termination. Most contracts never asked. 

The usual answer is a policy. A memo, circulated and acknowledged, about tools everyone already uses. Ban those tools and the use simply moves to personal phones, where there are no logs and no terms. 

ABA Formal Opinion 512 put the duties in plain view in July 2024. Competence under Rule 1.1, confidentiality under Rule 1.6, supervision under Rules 5.1 and 5.3, with the supervisory logic extended to third-party AI providers. It also requires informed consent, and boilerplate in an engagement letter does not count, before client information goes into a self-learning tool. A policy is the paperwork for those duties. It does not discharge them. 

Courts have started measuring the gap. In Whiting v. City of Athens, decided in March, the Sixth Circuit found over two dozen fake citations and misrepresentations of fact in two lawyers’ appellate filings, called that count conservative, and ordered each lawyer to pay $15,000 on top of the appellees’ fees and double costs. The court asked whether generative AI was involved. Counsel did not answer. A judge, a regulator, or a client reviewing your outside-counsel guidelines will ask how the work was produced and who checked it, and silence is a poor answer. 

Your agents are not employees. An employee is named, badged, trained, and watched, and tells you when something feels wrong. An agent often runs on a shared API key, works through thousands of records without pause, and never says it is out of its depth. The liability still lands on the humans. 

So start with people, not software. Put the department at a whiteboard, map the workstreams, and write down your positions, your fallbacks, and the reasons behind them. This is uncomfortable, because it is where you learn that two of your lawyers have been negotiating the same clause in opposite directions. It is also the one part of an AI deployment you cannot delegate. 

Then build supervision as controls. Bind every agent to a named human authorizer. No shared keys, no service accounts nobody owns. Limit each agent to the data its task requires, and fence privileged material off by default. Make access time-bound instead of standing, and name the person authorized to pull the kill switch. Log which agent touched which record, under whose authority, in a form you can export when someone asks. The duties those controls answer, including client confidentiality under Model Rule 1.6 and supervisory responsibility under Rules 5.1 and 5.3, are addressed in the ABA’s Formal Opinion 512 on generative AI, alongside the privilege questions that arise when agents touch client data. 

If you cannot reconstruct what happened afterward, you were not supervising. You were hoping. 

Treat prompts as documents, because they are. Every question created a record. Decide what your retention schedule says about it, how legal hold reaches it, and whether your protective orders bind the provider not to train on it or disclose it. Document that the work was prepared by or at the direction of counsel, since that element fails first. Then ask your outside counsel whether they are using AI on your matters right now. If you cannot answer, your guidelines probably say nothing. 

I ended my session with five questions nobody can answer yet. Does enterprise deployment cure the privilege problem, or have we agreed among ourselves that it does because the alternative is inconvenient? If AI does the first-year’s work, who trains the lawyer who replaces you in twenty years? I do not have clean answers, and I distrust anyone who claims to. 

The model may have passed the bar exam. Only the lawyers around it can protect the privilege. 

Author Bio 

Camilo Artiga-Purcell is the General Counsel at Kiteworks, where he leads the legal function and speaks and writes on AI governance and attorney supervision duties. Learn more at kiteworks.com.