Last week I wrote about a model disappearing overnight, and the lesson that was already true before it did. That piece ended on a question I want to stay with: what does the provider actually do with what you put in?
Most lawyers assume there is one answer to what "Claude" does with what you type into it, the way there is one answer for what Westlaw does. There is not. Behind that one name sit at least three products, on materially different terms for the three things a lawyer has to care about: whether the tool trains on your inputs, how long it keeps them, and what it takes for someone else to pull them back out.
You do not need to follow AI to know the rule here. It is one you already have: keep the client's confidences, and take reasonable steps to protect them in any tool you use on their matter. (Model Rule 1.6 for most lawyers; 37 C.F.R. 11.106 before the USPTO.) That duty does not ask whether you can write a good prompt. It asks whether you can say which of the three products you are using. Most lawyers cannot.
Three doors, not one product
The consumer app. Free, Pro, and Max - the website and the phone app, the convenient door most people walk through for a quick question. It trains on your inputs by default unless you turn that setting off, and turning it off is not absolute: content flagged for safety review, or anything you report through feedback, can still be used. Its privacy policy also permits the provider to share your data, including your prompts, with government authorities or law enforcement whenever it holds a good-faith belief that disclosure is reasonably necessary - to prevent serious harm, address illegal activity, or enforce its terms - none of which requires a subpoena or a court order. That kind of clause is ordinary in consumer technology, and it is not new. It becomes your problem the moment the conversation contains client material. This is the door with the weakest protection of the three, and it is the one lawyers reach for precisely because it is frictionless.
The business tiers. Team, Enterprise, and the API. These do not train on your inputs by default, they keep them for a short and defined window, and they are carved out of that good-faith disclosure clause - on this path, disclosure requires valid legal process. This is the floor a practicing lawyer should be standing on, not the consumer app.
The contract on top. Zero data retention, the strongest posture, available only on the business path and only by a separate signed agreement. It is not a setting you toggle. It is also narrower than its name suggests, in a way that traps careful people - which is its own piece, later in this series.
“I used Claude” is not an answer
The duty of technological competence does not ask whether you can write a good prompt. It asks whether you understand the tool well enough to protect a client while using it. Measured against that, “I used Claude” says nothing. “I used the enterprise API, which does not train on inputs, retains them briefly, and requires a subpoena before any disclosure” is an answer. The distance between those two sentences is the distance between a defensible workflow and a confidentiality exposure you did not know you had taken on.
The brand on the login screen is not the term that governs your client’s confidence. The access path is. Two lawyers can both say they “use Claude” and be standing in completely different legal postures - one training the model on a draft specification, the other on a contractual zero-retention path - and neither may know which one they are.
What to do this week
Find out, today, which door each AI tool in your practice actually uses. Not the brand. The door. Write it down per tool: consumer app, business tier, or contracted zero retention. If the honest answer for any sensitive work is “the consumer app,” move that work off it.
And if you or anyone you supervise uses the consumer app for client-adjacent tasks, read that disclosure clause and decide whether it is acceptable for the matter before the material goes in, not after. The duty to supervise does not pause because the tool is convenient.
This is the first in a short series on what these tools actually keep, and what it takes to get it back out. Next: why the federal ruling everyone is citing as proof that AI destroyed attorney-client privilege actually proves the opposite - and why the door the defendant walked through decided his case.
I am writing more about practicing law in the age of agentic AI - using these tools without surrendering judgment, privilege, or the duty of competence - at The Agentic Lawyer. www.theagenticlawyer.com
Educational only, not legal advice, and no attorney-client relationship is created. Views are my own. Attorney advertising in some jurisdictions.
Your best prompts are the ones you'd never bother typing.
The detailed ones. The ones with examples and edge cases. Wispr Flow lets you speak them instead — clean, structured, ready to paste into any AI tool. Free on Mac, Windows, and iPhone.