Identifying data
UK tribunal: client documents in an open AI tool breach confidentiality
The UK Upper Tribunal has said that uploading confidential client documents to an open AI tool such as ChatGPT breaches confidentiality and waives legal privilege. The ruling became public in February 2026.
In autumn 2025 the Immigration and Asylum Chamber of the UK Upper Tribunal examined two law firms whose filings had cited court decisions that do not exist. The three-judge panel's decision was promulgated on 17 November 2025, and the legal press reported on it in February 2026.
One solicitor had cited a fictitious case in an application for permission to appeal. He said his best guess was that he had used the AI mode of Google search, and accepted that he should have checked. He said he had not used ChatGPT to draft the grounds, but he had used it for something else: he had uploaded emails he had written to clients explaining Home Office decisions, to improve them, and the Home Office decision letters themselves, to summarise them for the clients.
The tribunal said that uploading confidential documents to an open AI tool such as ChatGPT places them on the internet in the public domain, breaching client confidentiality and waiving legal privilege. Such conduct may warrant referral to the regulator, and should in any event be referred to the Information Commissioner's Office. The tribunal contrasted this with closed tools that do not place information in the public domain, naming Microsoft Copilot as one that can be used for tasks such as summarising.
The solicitor accepted that this was a data breach and said he would inform the clients concerned and his regulators.
What can we learn from it?
In the tribunal's eyes, a client document uploaded to an open AI tool is a document made public. Yet the ruling drew a distinction: it set apart closed tools that do not place information in the public domain, naming them as usable for tasks such as summarising. The line, then, is not AI use but the choice of tool. Confiella sends only reviewed, pseudonymised text to an EU regional endpoint; whether that is enough in a particular matter is for the lawyer to judge. Decide in advance which tool you work with, and know where it sends the data.
Sources
- The National Archives, Find Case Law: [2026] UKUT 81 (IAC) – AI hallucinations; supervision; Hamid
- Legal Futures: Solicitor faces probe after putting client documents into ChatGPT
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]