This is a Tautoru view, not a settled position.
The advice most often given to lawyers — never put privileged material into an AI tool, or you will waive privilege — is, with respect, imprecise, and it frightens practitioners away from tools they could use properly.
Privilege is not lost merely because confidential material passes through a third party's hands. In New Zealand, under section 65 of the Evidence Act 2006, a person waives privilege if that person (or anyone with their authority) "voluntarily produces or discloses, or consents to the production or disclosure of, any significant part of the privileged communication ... in circumstances that are inconsistent with a claim of confidentiality" (s 65(2)). Two things must therefore be present: a voluntary disclosure of a significant part, and circumstances inconsistent with confidentiality. Section 65(4) is explicit, too, that privilege is not waived where disclosure "occurred involuntarily or mistakenly or otherwise without the consent" of the person who holds it.
Entrusting material to a provider you have engaged to process it, under terms of confidence and for the limited purpose of doing your work, is not a circumstance inconsistent with a claim of confidentiality — no more than using an off-site document vault, a cloud document-management system, an e-discovery host or an IT contractor is. It is difficult to see how interacting with a secure chatbot, on terms that keep your inputs confidential, is "inconsistent with a claim of confidentiality" at all. On some plans the provider's staff may be able to review conversations; but the possibility that an unnamed third party in a foreign jurisdiction could look at your material is a long way from you voluntarily producing or disclosing a significant part of it in circumstances inconsistent with confidentiality. And were such a provider ever compelled by its own law to produce what it holds, that would be an involuntary disclosure made without your consent — the very thing section 65(4) says does not waive privilege. In B v Auckland District Law Society [2003] UKPC 38 the Privy Council confirmed that legal professional privilege is a fundamental right, and that disclosing material for a limited and specific purpose does not waive it. On orthodox principle there is no party to whom you are "waiving" when you use a confidential, no-training service.
What governs the decision is not waiver but three other things. First, your duty of confidence to the client (chapter 8 of the Conduct and Client Care Rules), which calls for the client's authority or adequate safeguards before their information goes to any third-party tool. Second, keeping the material confidential in fact: privilege protects confidential communications, so what matters is how good the vault is — which is why a plan that does not train on inputs, limits retention and controls access is a different proposition from a consumer account that may do none of those. Third, where the material is personal information, the Privacy Act's cross-border rule (IPP 12) may apply. A separate and genuinely unsettled risk is that a provider outside New Zealand may be compelled by its own law to produce what it holds — a loss of practical control, not a waiver.
This has not, as far as we are aware, been tested by the New Zealand courts. A United States court is sometimes cited for the opposite conclusion, but on a fair reading it does not support a blanket rule. In United States v Heppner (US District Court, Southern District of New York, 17 February 2026) a criminal defendant, acting without a lawyer, typed his defence ideas into a free, public AI tool whose own policy said it trained on his inputs and might hand them to third parties, including the government, and then sent the output to his counsel. The court held the material was not privileged. That is unremarkable: there was no lawyer-client communication for privilege to attach to in the first place, and no expectation of confidentiality in a public tool that says it will share your data. The decision says nothing about a lawyer entrusting existing privileged material to a secure, no-training service under terms of confidence — the court did not address confidential or enterprise tools at all — and it is a single first-instance decision, not an appellate ruling.
Two things follow for New Zealand. First, the parts of that reasoning that sweep more broadly — that putting anything into a third party's system forfeits confidentiality — reflect United States privilege doctrine, under which voluntary disclosure to almost any third party tends to waive privilege. Our test is different, and narrower: section 65(2) asks whether the disclosure was in circumstances inconsistent with a claim of confidentiality, and confidential use of a no-training service is not. Second, on its own facts Heppner fits the framework we set out, rather than contradicting it: a free, public, training-on-inputs tool is exactly the consumer setting we treat as unsafe, while a confidential, no-training plan is the different proposition the court never considered. We would expect a New Zealand court applying section 65 to take the view set out here, and a broader reading of Heppner should not, and we think would not, be followed.
Two points sharpen this in practice. Where the tool does not train on your inputs, we are confident that privilege is not waived: if privilege exists, a confidential channel that does not feed your material into the model is not the voluntary disclosure "in circumstances inconsistent with a claim of confidentiality" that section 65 requires. The harder question is usually the prior one — whether the material is privileged at all. Privilege attaches only to communications of a particular kind, made for the dominant purpose of obtaining or giving legal advice, or for litigation; whether a given document or piece of advice qualifies can turn on fine distinctions, and that is a matter for a qualified lawyer on the facts, not something this guide, or the tool, can decide for you.
Our view
Confidential use of a no-training tool does not waive privilege, and the profession is poorly served by advice that says it does. The real work is choosing a plan whose confidentiality you can stand behind, and meeting your duty of confidence to the client. How that applies to a particular matter is a question for your own judgment, on your own facts.