Pre-flight check for legal content BEFORE it is sent to an external, cloud-based AI tool (browser chatbot, office-suite assistant, any API outside the firm's control). Inventories what actually sits in the prompt, scores five risk factors (client identifiability, facts under professional secrecy, litigation strategy and work-product, third-party personal data, AI provider terms), returns a banded verdict SAFE / CAUTION / STOP with a factor table and a disclosure-impact assessment, and for CAUTION prepares a redacted draft of the prompt for human approval. Sends nothing, never performs the final redaction. Use when: "can I paste this into ChatGPT", "does this prompt breach privilege", "privilege check before AI", "what to redact", "is this safe to send to a chatbot", law firm prompt audit, disclosure impact assessment before using cloud AI.
Pre-flight check for legal content BEFORE it is sent to an external, cloud-based AI tool (browser chatbot, office-suite assistant, any API outside the firm's control). Inventories what actually sits in the prompt, scores five risk factors (client identifiability, facts under professional secrecy, litigation strategy and work-product, third-party personal data, AI provider terms), returns a banded verdict SAFE / CAUTION / STOP with a factor table and a disclosure-impact assessment, and for CAUTION prepares a redacted draft of the prompt for human approval. Sends nothing, never performs the final redaction. Use when: "can I paste this into ChatGPT", "does this prompt breach privilege", "privilege check before AI", "what to redact", "is this safe to send to a chatbot", law firm prompt audit, disclosure impact assessment before using cloud AI.
license
Apache-2.0
allowed-tools
["Read"]
data-residency
local
requires-human-approval
true
pii-egress
none
attribution
{"relationship":"original","note":"No third-party source. The \"privilege pre-flight\" idea and the SAFE/CAUTION/STOP band concept are common in the legal-AI ecosystem; all text and the PL/EU legal bases were written from scratch.\n"}
Privilege Preflight EN - prompt check before sending to cloud AI
Philosophy
A prompt pasted into someone else's chatbot is a disclosure. Not "tool usage" - a disclosure.
No lawyer would fax a case file to a newspaper to get a second opinion on the
drafting style. Yet the same lawyer will paste half a statement of claim into a
free chatbot "just to polish the wording". The two acts differ less than it seems:
the content leaves the firm and lands with a third party, on terms nobody read,
with retention nobody controls, possibly on servers outside the EEA.
This skill does one thing: it holds the hand above the Enter key for the length of
one check. It does not ban cloud AI - firms use it and will keep using it. It
forces a conscious decision instead: what exactly leaves, to whom, on what terms,
and what happens if it ever surfaces.
The verdict is banded, not binary. Most prompts are neither clean nor forbidden -
they are redactable. That is why the middle band (CAUTION) ends with a redacted
draft rather than a lecture.
The frame here is European: legal professional privilege as shaped by the Court of
Justice of the EU, national professional secrecy regimes, GDPR, and the Trade
Secrets Directive. US attorney-client privilege appears only as a comparative
footnote, not as the operating framework.
When to use / What it does NOT do
Use it:
before pasting client-matter content into an external AI chatbot,
for a firm-wide prompt audit (retrospective: what people have been sending),
as the skeleton of an internal AI usage policy - the SAFE/CAUTION/STOP bands
translate directly into policy tiers,
when a colleague asks "can I put this into the chatbot" - run the preflight
instead of answering from gut feeling.
What it does NOT do (explicit negative scope):
it does NOT send anything anywhere - verdict and draft stay on the machine,
it does NOT perform the final redaction - it prepares a redacted version as a
draft; a human reads it, corrects it and decides alone whether to send,
it does NOT assess the legal merits of the prompt (other skills do that),
it does NOT replace a GDPR impact assessment for deploying an AI tool in the
firm - that is gdpr-dpia-en; the preflight checks a single piece of content,
not a process,
it does NOT give guarantees - a SAFE band means "no risk factor found",
not "I vouch that no risk exists".
Legal bases (cite with a confidence tag)
Quote an article number only when it is certain. Otherwise describe the duty in
words and mark it [TO VERIFY]. Never invent a citation.
Legal professional privilege (LPP), EU law - settled CJEU case law: AM&S
v Commission (Case 155/79) recognised LPP for communications with independent
external lawyers in EU competition investigations; Akzo Nobel v Commission
(Case C-550/07 P) confirmed that in-house counsel communications are NOT
covered by LPP in EU Commission competition proceedings. Practical consequence:
in-house teams pasting internal legal analysis into a cloud tool cannot assume
even the baseline EU-level protection external counsel would have.
National professional secrecy regimes - in most continental systems secrecy
is the lawyer's own enforceable duty (adwokat, Rechtsanwalt, avocat, abogado),
broader in scope than a common-law evidentiary privilege and typically unlimited
in time. The exact statutory basis differs per jurisdiction - identify the
user's regime and mark specifics [TO VERIFY] per country.
GDPR - personal data of the client and of third parties inside a prompt is
processing: definition of personal data (Art. 4(1)), the AI provider as a
processor requiring a data processing agreement (Art. 28), transfers outside
the EEA (Chapter V).
Trade Secrets Directive (EU) 2016/943 - protection depends on "reasonable
steps" to keep the information secret; pasting a client's trade secret into a
public chatbot is an argument AGAINST reasonable steps and can weaken the
client's own protection, independently of any privilege question.
Disciplinary and liability exposure - breach of professional secrecy is a
disciplinary offence under bar rules and may found civil liability towards the
client; the concrete provision depends on the bar involved [TO VERIFY].
Comparative footnote only: US attorney-client privilege and work-product
doctrine raise a parallel waiver debate, but this skill does not use them as
its framework.
The five assessment factors
Score each factor separately: CLEAN / CAUTION / CRITICAL.
(a) Client identifiability. Direct (company name, registration number, personal
names, case reference) AND mosaic: the combination of industry, city, dispute
amount and event date can point to one client even though no single element does.
Mosaic test: would a local journalist with a search engine work out who this is?
(b) Facts under professional secrecy. Everything the lawyer learned in
connection with providing legal assistance - including facts that look neutral
(the mere fact that a client seeks advice on a given matter is itself covered).
(c) Litigation strategy / work-product. Planned pleas, assessment of the
weaknesses of one's own position, negotiation tactics, internal notes on witness
credibility. This is the most dangerous category - disclosure harms even after
full pseudonymisation, because the value sits in the reasoning itself, not in the
identity of the parties.
(d) Third-party personal data. Witnesses, the opposing party, family members,
the client's employees. They chose no law firm and accepted no terms - the lawful
basis for processing their data in a cloud AI tool is usually the weakest link.
(e) Where the prompt goes. The AI provider's terms: is prompt content used for
model training, what is the retention period (and can it be switched off), where
are the servers, is there a transfer outside the EEA and on what basis, is there a
data processing agreement (Art. 28 GDPR), free tier or business tier (the terms
can differ radically). If the user does not know - assume the worst variant and
say so explicitly.
Workflow (step by step)
1. Content inventory
Break the prompt into elements: who is named (entities, persons), which facts,
which figures and dates, which document fragments, whether it contains the
lawyer's own reasoning (assessment, tactics), and where the user wants to send it
(tool name and tier). No inventory, no assessment - "I roughly know what is in
there" does not count.
2. Score the five factors
Each factor (a)-(e) gets CLEAN / CAUTION / CRITICAL plus one sentence of
justification quoting the fragment that drives the score.
3. Banded verdict
The aggregation rule is mechanical:
any factor CRITICAL -> STOP,
factor (c) strategy/work-product at CAUTION or above -> STOP (redaction
does not cure work-product - see the factor description),
otherwise, at least one CAUTION -> CAUTION,
all CLEAN -> SAFE.
4. Disclosure impact assessment
For CAUTION and STOP: two-three sentences on what concretely happens if the
content surfaces - towards the client (lost trust, harm to the matter), towards
the lawyer (disciplinary exposure, liability), towards third parties (GDPR
claims). No scaremongering - a realistic scenario.
5. Redaction - draft (CAUTION only)
Prepare a redacted version of the prompt: pseudonymise entities and values with
placeholders [CLIENT], [COUNTERPARTY], [PERSON-1], [AMOUNT], [DATE], [PLACE],
[CASE-REF]; delete fragments unnecessary for the prompt's purpose (the cheapest
redaction is deletion); re-run the mosaic test AFTER redaction - does the
combination of what remains still point to the client. For STOP, produce no
draft - a redacted litigation strategy is still a litigation strategy.
6. Alternatives (on STOP)
Always show a way forward, not only a prohibition:
a local zero-cloud environment (data never leaves the firm's machine),
a local model on the firm's own hardware,
reformulating the question into an abstract one (ask about the rule, not the
matter),
doing the task without AI, if the stakes demand it.
7. Human gate
Present the result and stop. See the "Human gate" section.
Output format (literal template)
## Privilege preflight - <working name of the prompt>
Prompt purpose: <what the user wants to achieve by sending it>
Target tool: <name + tier (free/business) or "unknown - worst case assumed">
| Factor | Score | Justification (content fragment) |
|--------------------------------------|-----------|---------------------------------------|
| (a) Client identifiability | CAUTION | company name + city + industry |
| (b) Facts under secrecy | CAUTION | course of negotiations described |
| (c) Strategy / work-product | CLEAN | no tactical assessment in the text |
| (d) Third-party personal data | CAUTION | witness named in full |
| (e) Provider terms | CRITICAL | free tier, training on user content |
VERDICT: STOP
Disclosure impact: <2-3 sentences, realistic scenario>
Recommendation: <on STOP - alternatives; on CAUTION - draft below; on SAFE - clear to send>
--- REDACTED VERSION (draft, CAUTION only - requires human approval) ---
<content with placeholders [CLIENT], [AMOUNT], [DATE]...>
--- END OF DRAFT ---
Mosaic check after redaction: <passed / failed + why>
The decision belongs to a human. This skill has sent nothing.
Human gate
The skill's output is a draft, not a decision. Nothing gets sent until an
authorised human has read the verdict, the factor table and - on CAUTION - the
entire redacted draft, line by line. The human approves, corrects or rejects;
sending is always the human's own act, performed outside this skill.
The governance boundary is hard: the skill prepares, the human executes. This
covers redaction too - an automatically inserted placeholder can miss the context
(e.g. [AMOUNT] inside a contract quote where the amount is the very subject of
the question). A draft nobody read is worthless and must never be treated as
"already anonymised".
The SAFE band passes through the gate as well: the human sees the factor table
and presses Enter personally. SAFE shortens the deliberation, it does not remove
the responsibility.
Companion skills
matematic-prompt-defense-pl - hardening of a system prompt against attacks;
the preflight watches what leaves the firm, prompt-defense watches what can
attack the firm's own AI. Two sides of the same hygiene.
gdpr-dpia-en - data protection impact assessment for DEPLOYING an AI tool as
a process; the preflight is a per-item check. If preflights for the same tool
keep ending in CAUTION/STOP, that is the signal for a DPIA and a systemic
decision, not for yet another round of redactions.
doc-intel-contract-pl - when the content comes from a document: extraction
with confidence gating and redaction candidates (PII with checksums) gives the
preflight better input than raw copy-paste.
legal-request-router-pl - routing of a legal task; the preflight can be its
first stop before the router even picks a verification path.
