Privilege Preflight EN - prompt check before sending to cloud AI

Philosophy

A prompt pasted into someone else's chatbot is a disclosure. Not "tool usage" - a disclosure.

No lawyer would fax a case file to a newspaper to get a second opinion on the drafting style. Yet the same lawyer will paste half a statement of claim into a free chatbot "just to polish the wording". The two acts differ less than it seems: the content leaves the firm and lands with a third party, on terms nobody read, with retention nobody controls, possibly on servers outside the EEA.

This skill does one thing: it holds the hand above the Enter key for the length of one check. It does not ban cloud AI - firms use it and will keep using it. It forces a conscious decision instead: what exactly leaves, to whom, on what terms, and what happens if it ever surfaces.

The verdict is banded, not binary. Most prompts are neither clean nor forbidden - they are redactable. That is why the middle band (CAUTION) ends with a redacted draft rather than a lecture.

The frame here is European: legal professional privilege as shaped by the Court of Justice of the EU, national professional secrecy regimes, GDPR, and the Trade Secrets Directive. US attorney-client privilege appears only as a comparative footnote, not as the operating framework.

When to use / What it does NOT do

Use it:

• before pasting client-matter content into an external AI chatbot,
• for a firm-wide prompt audit (retrospective: what people have been sending),
• as the skeleton of an internal AI usage policy - the SAFE/CAUTION/STOP bands translate directly into policy tiers,
• when a colleague asks "can I put this into the chatbot" - run the preflight instead of answering from gut feeling.

What it does NOT do (explicit negative scope):

• it does NOT send anything anywhere - verdict and draft stay on the machine,
• it does NOT perform the final redaction - it prepares a redacted version as a draft; a human reads it, corrects it and decides alone whether to send,
• it does NOT assess the legal merits of the prompt (other skills do that),
• it does NOT replace a GDPR impact assessment for deploying an AI tool in the firm - that is gdpr-dpia-en; the preflight checks a single piece of content, not a process,
• it does NOT give guarantees - a SAFE band means "no risk factor found", not "I vouch that no risk exists".

Legal bases (cite with a confidence tag)

Quote an article number only when it is certain. Otherwise describe the duty in words and mark it [TO VERIFY]. Never invent a citation.

• Legal professional privilege (LPP), EU law - settled CJEU case law: AM&S v Commission (Case 155/79) recognised LPP for communications with independent external lawyers in EU competition investigations; Akzo Nobel v Commission (Case C-550/07 P) confirmed that in-house counsel communications are NOT covered by LPP in EU Commission competition proceedings. Practical consequence: in-house teams pasting internal legal analysis into a cloud tool cannot assume even the baseline EU-level protection external counsel would have.
• National professional secrecy regimes - in most continental systems secrecy is the lawyer's own enforceable duty (adwokat, Rechtsanwalt, avocat, abogado), broader in scope than a common-law evidentiary privilege and typically unlimited in time. The exact statutory basis differs per jurisdiction - identify the user's regime and mark specifics [TO VERIFY] per country.
• GDPR - personal data of the client and of third parties inside a prompt is processing: definition of personal data (Art. 4(1)), the AI provider as a processor requiring a data processing agreement (Art. 28), transfers outside the EEA (Chapter V).
• Trade Secrets Directive (EU) 2016/943 - protection depends on "reasonable steps" to keep the information secret; pasting a client's trade secret into a public chatbot is an argument AGAINST reasonable steps and can weaken the client's own protection, independently of any privilege question.
• Disciplinary and liability exposure - breach of professional secrecy is a disciplinary offence under bar rules and may found civil liability towards the client; the concrete provision depends on the bar involved [TO VERIFY].
• Comparative footnote only: US attorney-client privilege and work-product doctrine raise a parallel waiver debate, but this skill does not use them as its framework.

The five assessment factors

Score each factor separately: CLEAN / CAUTION / CRITICAL.

(a) Client identifiability. Direct (company name, registration number, personal names, case reference) AND mosaic: the combination of industry, city, dispute amount and event date can point to one client even though no single element does. Mosaic test: would a local journalist with a search engine work out who this is?

(b) Facts under professional secrecy. Everything the lawyer learned in connection with providing legal assistance - including facts that look neutral (the mere fact that a client seeks advice on a given matter is itself covered).

(c) Litigation strategy / work-product. Planned pleas, assessment of the weaknesses of one's own position, negotiation tactics, internal notes on witness credibility. This is the most dangerous category - disclosure harms even after full pseudonymisation, because the value sits in the reasoning itself, not in the identity of the parties.

(d) Third-party personal data. Witnesses, the opposing party, family members, the client's employees. They chose no law firm and accepted no terms - the lawful basis for processing their data in a cloud AI tool is usually the weakest link.

(e) Where the prompt goes. The AI provider's terms: is prompt content used for model training, what is the retention period (and can it be switched off), where are the servers, is there a transfer outside the EEA and on what basis, is there a data processing agreement (Art. 28 GDPR), free tier or business tier (the terms can differ radically). If the user does not know - assume the worst variant and say so explicitly.

Workflow (step by step)

1. Content inventory

Break the prompt into elements: who is named (entities, persons), which facts, which figures and dates, which document fragments, whether it contains the lawyer's own reasoning (assessment, tactics), and where the user wants to send it (tool name and tier). No inventory, no assessment - "I roughly know what is in there" does not count.

2. Score the five factors

Each factor (a)-(e) gets CLEAN / CAUTION / CRITICAL plus one sentence of justification quoting the fragment that drives the score.

3. Banded verdict

The aggregation rule is mechanical:

• any factor CRITICAL -> STOP,
• factor (c) strategy/work-product at CAUTION or above -> STOP (redaction does not cure work-product - see the factor description),
• otherwise, at least one CAUTION -> CAUTION,
• all CLEAN -> SAFE.

4. Disclosure impact assessment

For CAUTION and STOP: two-three sentences on what concretely happens if the content surfaces - towards the client (lost trust, harm to the matter), towards the lawyer (disciplinary exposure, liability), towards third parties (GDPR claims). No scaremongering - a realistic scenario.

5. Redaction - draft (CAUTION only)

Prepare a redacted version of the prompt: pseudonymise entities and values with placeholders [CLIENT], [COUNTERPARTY], [PERSON-1], [AMOUNT], [DATE], [PLACE], [CASE-REF]; delete fragments unnecessary for the prompt's purpose (the cheapest redaction is deletion); re-run the mosaic test AFTER redaction - does the combination of what remains still point to the client. For STOP, produce no draft - a redacted litigation strategy is still a litigation strategy.

6. Alternatives (on STOP)

Always show a way forward, not only a prohibition:

• a local zero-cloud environment (data never leaves the firm's machine),
• a local model on the firm's own hardware,
• reformulating the question into an abstract one (ask about the rule, not the matter),
• doing the task without AI, if the stakes demand it.

7. Human gate

Present the result and stop. See the "Human gate" section.

Output format (literal template)

## Privilege preflight - <working name of the prompt>

Prompt purpose: <what the user wants to achieve by sending it>
Target tool: <name + tier (free/business) or "unknown - worst case assumed">

| Factor                               | Score     | Justification (content fragment)      |
|--------------------------------------|-----------|---------------------------------------|
| (a) Client identifiability           | CAUTION   | company name + city + industry        |
| (b) Facts under secrecy              | CAUTION   | course of negotiations described      |
| (c) Strategy / work-product          | CLEAN     | no tactical assessment in the text    |
| (d) Third-party personal data        | CAUTION   | witness named in full                 |
| (e) Provider terms                   | CRITICAL  | free tier, training on user content   |

VERDICT: STOP

Disclosure impact: <2-3 sentences, realistic scenario>

Recommendation: <on STOP - alternatives; on CAUTION - draft below; on SAFE - clear to send>

--- REDACTED VERSION (draft, CAUTION only - requires human approval) ---
<content with placeholders [CLIENT], [AMOUNT], [DATE]...>
--- END OF DRAFT ---

Mosaic check after redaction: <passed / failed + why>
The decision belongs to a human. This skill has sent nothing.

Human gate

The skill's output is a draft, not a decision. Nothing gets sent until an authorised human has read the verdict, the factor table and - on CAUTION - the entire redacted draft, line by line. The human approves, corrects or rejects; sending is always the human's own act, performed outside this skill.

The governance boundary is hard: the skill prepares, the human executes. This covers redaction too - an automatically inserted placeholder can miss the context (e.g. [AMOUNT] inside a contract quote where the amount is the very subject of the question). A draft nobody read is worthless and must never be treated as "already anonymised".

The SAFE band passes through the gate as well: the human sees the factor table and presses Enter personally. SAFE shortens the deliberation, it does not remove the responsibility.

Companion skills

• matematic-prompt-defense-pl - hardening of a system prompt against attacks; the preflight watches what leaves the firm, prompt-defense watches what can attack the firm's own AI. Two sides of the same hygiene.
• gdpr-dpia-en - data protection impact assessment for DEPLOYING an AI tool as a process; the preflight is a per-item check. If preflights for the same tool keep ending in CAUTION/STOP, that is the signal for a DPIA and a systemic decision, not for yet another round of redactions.
• doc-intel-contract-pl - when the content comes from a document: extraction with confidence gating and redaction candidates (PII with checksums) gives the preflight better input than raw copy-paste.
• legal-request-router-pl - routing of a legal task; the preflight can be its first stop before the router even picks a verification path.

Shared rules of the ai-governance plugin (AI governance)

These rules apply to every skill in this plugin, including where the skill itself is silent. They are copied into each skill, so they hold whether you install the whole plugin or a single skill.

These skills run regulatory triage for organisations deploying or building AI: EU AI Act classification and role mapping, NIS2 scope and obligations triage, and a privilege pre-flight check before legal content is sent to an external AI surface. Each ends in a draft for decision, not a finished act.

Rules

• Output is a draft for decision. A classification card, a scope assessment or a redacted prompt is a starting point for counsel / the compliance owner. A person approves and acts on it.
• Governance boundary - the outward act stays human. Registering an AI system, notifying a CSIRT or supervisory authority, filing a FRIA, sending anything to an external AI service - the skill prepares the draft, it does not perform the act.
• Regulation from the source, not from memory. Article references carry confidence tags; anything uncertain is marked for verification against EUR-Lex (eu-sparql-search / mcp-eu-compliance connectors) or the national transposition before it is relied on. National transposition status changes - always check it at time of use.
• Triage is not a conformity assessment. These skills classify, map and flag. A high-risk or GPAI finding routes to a human and a full assessment; it is never the end of the analysis.
• Not legal advice. The skills organise obligations and map them to provisions; they do not replace legal analysis of a specific matter.
• Confidentiality. System descriptions, incident details and prompt content are confidential - do not move them outside the agreed flow. These skills add no outbound channel of their own; what reaches your model is decided by your configuration (see https://github.com/matematicsolutions/awesome-matematic-skills-en/blob/main/TRUST.md).

Plugin scope

Regulatory triage for AI and cyber (AI Act, NIS2) plus prompt-level privilege hygiene. It does not verify citations or fetch sources of law - use verification-foundation and eu-law-sources for that. GDPR operations (DPIA, breach, DSAR) live in data-protection; the AI Act triage pairs with gdpr-dpia-en when a system processes personal data.