AI scribe for lawyers privilege: why audio path decides the risk

By Kyle Nelson, Founder, Fazit

For lawyers, an AI scribe threatens privilege when client audio, transcripts, prompts, logs, or summaries go to a third-party service that stores, shares, trains on, or can be asked to produce them. Pick a workflow where call content stays on the lawyer's Mac, no bot joins, transcription runs locally, and no call audio is written to disk; consent and professional-conduct duties still sit with the lawyer running the call.

By Fazit's founder, not a lawyer. This article isn't legal advice, and consent and professional-conduct duties apply to the person running the call.

What is the privilege risk with an AI scribe for lawyers?

The privilege risk starts before the note exists. It starts when the lawyer allows a third-party system to receive the client conversation.

The New York City Bar's Formal Opinion 2025-6 says attorneys must safeguard records of client communications to preserve confidentiality and privilege under Rule 1.6 when using AI recording, transcription, or summarization tools. The American Bar Association says, in its discussion of ABA Model Rule 1.6, that lawyers must protect all client-related information, including preventing inadvertent or unauthorized access.

That maps directly onto a normal working day. A litigation partner takes a 45-minute intake call with a founder who describes a threatened claim, the board's internal disagreement, and the company's settlement range. If an AI scribe sends that audio to a vendor for transcription, the privilege analysis now includes the vendor's storage, access controls, training terms, retention period, logs, summaries, and deletion process.

WilmerHale's March 2026 client alert says AI can increase the risk of losing legal professional privilege through hidden routes to waiver, especially when tools run by default and transmit data to third-party providers. The American Arbitration Association's March 2026 discussion says AI recording platforms can jeopardize attorney-client privilege if conversations are stored, shared, or used for model training by third-party vendors.

The exposed object is no longer a lawyer's memory of the call; it can be an audio file, transcript, summary, prompt log, or other derivative artifact outside the firm.

Is an AI scribe for lawyers privileged if a vendor processes the call?

You shouldn't assume that vendor processing is harmless because the call was lawful or consensual. Consent to record and preservation of privilege are separate questions.

Goodwin's April 2026 alert says AI transcription tools can raise attorney-client privilege and confidentiality risks because they may transmit data to third-party providers. CMS says uploading privileged materials into a consumer-grade AI service is likely to be treated as disclosure inconsistent with maintaining confidentiality and therefore risks waiving privilege.

There is also a newer warning sign from AI use outside the meeting-scribe context. Harvard Law Review's March 2026 post on United States v. Heppner says the court found no reasonable expectation of confidentiality in the defendant's communications with Claude because it was a third-party AI platform. JD Supra reported that documents generated by the criminal defendant using Anthropic's Claude were not protected by attorney-client privilege or work-product protection.

That case doesn't decide every AI scribe question. It does give lawyers a concrete fact pattern to take seriously: a person used an AI system, the system was a third-party platform, and the court treated that use as inconsistent with confidentiality. Picture an associate pasting a privileged client-call transcript into a general AI chat to draft a chronology; the privilege argument now has to explain the disclosure to the AI service.

A lawyer who wants the privilege fight to stay simple should avoid creating a third-party AI custody trail for the client conversation.

What should lawyers ask before using an AI notetaker?

Before a Tuesday call with a prospective client, the review should be short enough to run in five minutes and strict enough to stop the wrong tool. The Boston Bar Association says lawyers must address consent, security, confidentiality and privilege, and client file retention before using AI notetakers and transcribers. It also says lawyers should ensure AI notetaker inputs and outputs are retained on their own devices or clouds and are not disclosed to third parties.

Use this as the pre-call checklist:

  • Does a bot join the meeting as a participant?
  • Does the tool send call audio to a vendor, subprocessor, or speech-to-text API?
  • Is any call audio written to disk during or after the call?
  • Where is the transcript stored?
  • Where are prompts, logs, summaries, and other derivative artifacts stored?
  • Is the vendor allowed to use call content for model training?
  • What is the retention period for audio, transcripts, prompts, logs, and summaries?
  • Is the data location addressed in the engagement letter or data processing agreement?
  • Has the client received any notice or consent required for the call?
  • Does the final note land in the client file under the lawyer's own retention policy?

WilmerHale recommends that engagement letters or data processing agreements address data location, retention periods, no-training commitments, and protection of prompts, logs, summaries, and other derivative artifacts. It also recommends that no lawyer-client communications be recorded where possible, and that transcripts and recordings be stored on company systems instead of the recording application itself.

If the vendor can't answer where prompts, logs, summaries, and retained transcripts live, the lawyer can't finish the privilege review.

How does on-device AI transcription change the privilege analysis?

On-device transcription changes the fact pattern. The client-call content does not need to pass through a vendor to become a note.

Fazit's public architecture statement says Fazit is a native macOS menubar app for 1:1 client calls. Capture is bot-free: a Core Audio process tap reads the call app's output and the microphone directly, so nothing joins the meeting and no other participant sees a notetaker. Transcription runs on the Mac using Parakeet via CoreML, and note generation runs through a local model on localhost. The output is a plain Markdown file written into a folder of the user's Obsidian vault or Apple Notes.

The audio handling is the part I care about most. Fazit's source statement says audio is never written to disk. It exists only in a fixed-size RAM ring buffer with no write API and is destroyed on every exit path, including errors. Every note records audio_retained: false in its frontmatter.

For a lawyer running a 1:1 Zoom consultation, that means the workflow can produce a note without a bot, without cloud transcription, without a vendor database copy of the note, and without a call-audio file. The comparison in On-device vs. cloud AI notetakers covers the same distinction across products, and Does transcription store audio in 2026? explains why transcription doesn't require retained audio.

Privilege review questionVendor cloud AI scribeFazit on Mac
Who receives call content for transcription?A third-party service may receive itTranscription runs on the Mac
Does a bot appear in the meeting?Some tools use meeting botsNo bot joins
Is call audio written to disk by Fazit?Vendor design decidesNo
Where is the finished note stored?Often in a vendor account or appPlain Markdown in the user's Obsidian vault, or Apple Notes
Is there a Fazit database holding a copy?Vendor design decidesNo

Fazit makes no SOC 2, HIPAA, maturity, or scale claim; the claim is narrower and architectural: call audio and note content do not leave the device for note generation, while account, licensing, updates, and optional product analytics are a separate lane.

Every Fazit note records audio_retained: false.

Does bot-free protect lawyer privilege?

Bot-free answers one question: does another visible participant join the meeting? It does not answer where the audio goes.

That distinction matters in legal work. A lawyer may see that no Otter-style bot entered the Zoom room and assume the client conversation stayed private. The tool may still stream microphone and system audio to a vendor cloud or third-party speech service. Bot-free is not the same as private makes that distinction because the market has started using bot-free as a privacy shortcut.

The Granola lawsuit shows why the bot-free label needs discipline. The post on Chamberlain v. Granola explains that a proposed class action filed on 30 July 2026 in the Northern District of California alleges that the absence of a bot left other participants with no way to know a recording was running. The case is a complaint, not a court finding, and the consent question applies to every bot-free notetaker, including ours.

For a lawyer, the safe sequence is plain. Give the required notice, get any required consent, use a tool whose audio path you understand, and keep the client-file artifact under your own control. A hidden bot-free recorder can still create the thing privilege lawyers least want: a durable transcript held by someone else.

Bot-free says nothing about whether client audio streamed to a vendor cloud.

What should an AI scribe for lawyers write to the client file?

The output should be the artifact the lawyer actually wants to keep. Usually that is a session note, not a call recording.

The Boston Bar Association guidance says lawyers should address client file retention before using AI notetakers and transcribers. WilmerHale recommends avoiding recordings of lawyer-client communications where possible. Those two points fit the daily workflow better than an archive of raw audio.

After a client call, a lawyer may need a dated note with the client name, the legal issue, the agreed next step, and the deadline owner. Fazit's repository README says the finished note can include a summary, key moments, action items with owners, a paste-ready follow-up email, and a You: and Them: transcript. The note is written as Markdown into <vault>/Fazit/ in the user's Obsidian vault.

That matters because the file lives in the lawyer's own note system. Obsidian meeting notes should be files, not rows in a vendor's database explains the file-based version of this argument. For privilege review, the point is more direct: the client file should not depend on a vendor's transcript database.

There is no Fazit database holding a copy.

How I would choose an AI scribe for a privileged call

My opinion is simple: for a privileged 1:1 call, choose the tool with the shortest custody chain for call content. If the call audio has to leave the lawyer's machine to create a note, I would treat that as a privilege review item before using it with a client.

The deeper lawyer-specific version is in AI notetakers for lawyers, which frames cloud transcription as a third-party disclosure risk that invites waiver arguments and creates a discoverable record. The litigation angle is covered in The AI notetaker legal risk nobody priced in, including the risk that a transcript becomes evidence in a later dispute.

I would also separate consent from architecture. A California client call, a German client call, and a cross-border call can raise different notice and consent duties. Fazit's architecture reduces vendor exposure and audio-file exposure; it does not give the lawyer permission to ignore consent, engagement-letter terms, court orders, professional-conduct rules, or client instructions.

The source material for Fazit says California CIPA is all-party and Germany's §201 StGB is criminal.

Sources