Your Prompt Has a Passport

The AI Risk Law Firms Aren't Talking About Louise Lipsker and Rob Cohen in the New York Law Journal An associate on deadline pastes a 300-page deposition and a stack of German contracts into her firm's AI tool. Minutes later she has a summary and a translation. She has also sent a German citizen's sworn testimony and a client's contracts onto servers she cannot locate, under access laws that are neither New York's nor Germany's, to a company her firm never retained. That scenario opens "LLMs: The New Foreign Intelligence Risk for Law Firms Nobody Is Discussing," a new New York Law Journal article by Harris St. Laurent LLP associate Louise Lipsker and partner Rob Cohen. Their argument: the profession's fixation on hallucinated citations and don't-paste-secrets guidance is crowding out a larger problem. Hosted models move a client's most sensitive information into infrastructure that several governments can lawfully open, and in some cases, one of them is adversarial to the client or its position. Lipsker and Cohen map the legal machinery that reaches data once it lands on that infrastructure. On the U.S. side: Section 702 of FISA and the incidental collection of communications involving U.S. persons; the 2024 Reforming Intelligence and Securing America Act, which broadened the class of "covered providers" to entities with mere access to the equipment where communications are stored or transit; and the CLOUD Act, which compels American providers to produce data wherever it sits, Dublin included. They also flag a live uncertainty: Section 702 lapsed on June 12, 2026, with collection continuing under existing FISC certifications while reauthorization remains unresolved. The same surveillance becomes the compliance problem from Europe. The authors trace the GDPR's transfer restrictions, "Schrems II, and the pending challenge to the EU-U.S. Data Privacy Framework in "Latombe v. Commission" noting that the Privacy and Civil Liberties Oversight Board, the body the European Commission relied on when it approved the framework, was left without a quorum in 2025. And walking away from U.S. providers offers no refuge: Article 7 of China's National Intelligence Law is a far less constrained regime. Then the harder question; what disclosure does to the protections themselves. Lipsker and Cohen examine how routing client information through AI tools can erode trade secret status under the Defend Trade Secrets Act and attorney-client privilege under the narrow agent exception of "United States v. Kovel". Their conclusion is that no new rulebook is required: competence, confidentiality, and client communication under the New York Rules of Professional Conduct already govern these choices, consistent with ABA Formal Opinion 512 and New York City Bar Formal Opinion 2024-5. "The solution is not to put the tools down," they write. "Instead, firms must ask the right question: whose sovereign reach does