As Artificial Intelligence (AI) becomes increasingly embedded in professional workflows, including legal practice, a fundamental question arises: does the use of AI affect, or even undermine, attorney-client confidentiality?
To answer this question, we must return to the first principles.
Confidentiality Under Indonesian Law
Law No. 18 of 2003 on Advocate imposes a clear obligation on advocates to maintain the confidentiality of all information obtained from clients in the course of their professional relationship. This is not merely an ethical expectation, it is a legal duty.
In practice, this principle is also reflected in evidentiary norms, where communications between an advocate and a client are generally protected from disclosure, provided that two key elements are present: (i) a valid advocate-client relationship; and (ii) a reasonable expectation of confidentiality.
Lessons from Foreign Case Law
A recent U.S. court decision, U.S. v. Heppner (S.D.N.Y. 2026), considered whether communications with a generative AI platform could be protected under attorney-client privilege, to wit the court held they were not.
Its reasoning was straightforward:
- The communication was not made with a licensed attorney; and
- There was no reasonable expectation of confidentiality, particularly because the information could be processed and disclosed by a third-party platform.
On pages 6-7 of the decision, the court further emphasised that users voluntarily disclose information to AI systems whose terms allow data collection, use, and potential sharing, thereby defeating any claims of confidentiality.
Testing the Logic Under Indonesian Law
When applied to Indonesian law, the same analytical structure holds.
- First, communication with AI is not communication with an advocate. As such, one of the core elements of confidentiality protection is absent from the outset.
- Second, the use of AI inherently involves third parties, whether in the form of service providers, cloud infrastructure, or data processing systems.
- Once information is disclosed to such systems, it becomes difficult to argue that it remains confidential in the legal sense.
In other words, the issue is not that AI “breaches” confidentiality. Rather, it is that the user may have already disclosed the information outside the protected advocate-client relationship.
The Illusion of Confidentiality
One of the most overlooked risks of generative AI is its ability to simulate private, human-like interaction. Its conversational tone, contextual awareness, and responsiveness can create the impression of a secure, advisory environment.
Legally however, this is a false equivalence. From a data governance perspective, any input into an AI system should be treated as a form of data processing and not a private consultation.
Implication for Law Practitioners and Organisations
AI is not going away. Its use in legal workflows, from drafting to research, is already widespread. However, without proper governance, its use may conflict with an advocate’s legal obligations, particularly in relation to confidentiality.
Key implications include:
- Client information entered into AI systems may constitute disclosure to third parties;
- Confidentiality protections may be lost at the point of disclosure; and
- The risk is not only legal, but reputational.
Key Takeaways
- Confidentiality under Indonesian law is a legal obligation, not merely an ethical one.
- Its protection depends on both the existence of an advocate-client relationship and the preservation of confidentiality.
- AI use may undermine confidentiality where third-party access or processing is involved.
- Foreign case law provides a useful analytical framework, even if not binding.
- Legal practitioners must critically assess how AI is used in practice, not just whether it is used.
Written by:
A.A.B.N.A. Surya Putra
Associate | Data protection and privacy consultant
RAH (the House of Legal Experts)
