Imagine a paralegal, clerk, or junior associate uploads a confidential document related to a client into ChatGPT. It could be a legal opinion, or just a summarisation task of an earlier meeting. The whole exercise probably takes about thirty seconds. With the click of a mouse button, legal privilege flies out the window. Just like that.

Gone permanently. Not suspended. Not contingent on whether anyone at the AI company reads it. Gone, by operation of law, at the moment of upload.

That is one of the findings in Munir v Secretary of State for the Home Department [2026] UKUT 81 (IAC), published by the UK Upper Tribunal on 17 November 2025. It has been circulating in English legal commentary since February. Most NZ managing partners have not read it — which is entirely understandable, because reading every Upper Tribunal immigration decision is not a reasonable professional expectation.

This one is different, though. This one potentially affects your practising certificate.

And before you reach for the 'that's UK law' defence — you are correct, it is not binding here. But since 2024, New Zealand courts have had to deal with multiple AI filing blunders across the Supreme Court, High Court, Employment Court, and Employment Relations Authority. How international courts are responding to this problem is being watched carefully. Munir is the most significant response yet.

What the case is actually about

Munir is not primarily a privilege case. It is a case about hallucinated citations, supervision failures, and the professional obligations that follow from both.

The Tribunal heard two matters together. In the first, a legal adviser submitted grounds of appeal containing a case that does not exist — Horleston v SSHD — with a citation that belongs to an unrelated equal pay matter. After investigation, he concluded the most likely explanation was inadvertent use of Google's AI search function. In the second, grounds for judicial review contained four fictitious authorities, drafted by a junior fee earner who had been inadequately supervised. The COLP (Compliance Officer for Legal Practice) of the firm was referred to the SRA.

The Tribunal describes what happens when a judge encounters an unfamiliar citation and goes looking for it: a "fool's errand," conducted at public expense, at the cost of other judicial business, and ultimately at the cost of the very clients those lawyers were supposed to be protecting.

Alongside its findings on those specific matters, the Tribunal made clear and general statements on two questions it had not previously addressed directly. Both matter for NZ legal practice.

The privilege finding

The first general statement: uploading confidential documents into a public AI tool — the Tribunal's words are "open source AI tool, such as ChatGPT" — places that material in the public domain. The consequence is a breach of client confidentiality and a waiver of legal privilege.

Privilege depends on confidentiality. The moment confidential material enters the public domain, the confidentiality is gone. And once privilege is waived through voluntary disclosure, it cannot be recovered. There is no mechanism to re-privilege material that has left your control. The intent is irrelevant. The act is the thing.

This is the first time an English court has stated this directly in relation to AI platforms. The implication is plain: a single misstep can have irreversible consequences.

The Tribunal also stated the converse — and this is the finding most commentary has failed to develop. Closed AI tools that do not place information in the public domain are available for exactly these tasks without the same risk. The Tribunal names Microsoft Copilot specifically as an example of an acceptable tool for document summarisation.

The case does not say stop using AI. It says stop using it wrong. That distinction matters more than the warning.

Closer to home, in QTR v BXD [2025] NZERA 716 — an Employment Relations Authority decision issued in November 2025 — the Authority found that an employee breached a confidentiality clause when he uploaded confidential information to an AI platform that retains and uses data for training. Significantly, the Authority drew the same line as the UK Tribunal: the problem was not the AI tool itself, but its public, data-retaining architecture. Closed tools used appropriately were not prohibited. This is now principle in both jurisdictions.

The hallucination problem is already inside NZ courts

New Zealand courts have not been waiting for international direction. They have been dealing with AI-generated fictitious citations since late 2024.

Six NZ cases have been documented since November 2024, spanning the Supreme Court, High Court, Employment Court, and Employment Relations Authority:

Six cases across five jurisdictions in sixteen months. That is not an emerging trend. That is an established pattern.

There is, however, a critical nuance in every one of these cases: the party relying on AI-generated content was self-represented. Not a solicitor. A litigant in person, navigating proceedings without professional assistance. NZ courts have responded with measured warnings and gentle reminders — appropriate for the circumstances, reflecting the different accountability standard that applies to lay people in legal proceedings.

The December 2023 guidelines issued by the Courts of New Zealand for lawyers are clear on the professional standard. Lawyers must take all reasonable steps to ensure the accuracy of information, including legal citations, provided to a court or tribunal. The guidelines explicitly warn that GenAI tools may make up fictitious cases, citations or quotes, or refer to legislation, articles or legal texts that do not exist.

NZ has had the framework in place for over two years. What it has not yet seen is a solicitor — as opposed to a self-represented litigant — tested against it. Munir shows what happens when that test arrives.

The statement of truth obligation — and why this is only the beginning

The second general statement from the Tribunal is arguably more significant in the long run, because it is procedural rather than advisory. Guidelines can be ignored. A signed statement of truth cannot.

The claim form used to initiate judicial review in the Upper Tribunal has been amended. Legal representatives must now confirm, by a signed statement of truth, three things before filing:

First, that every cited authority exists.

Second, that the case can be located using the citation provided.

Third, that the case supports the proposition of law for which it is cited.

A legal representative who signs that statement in a matter containing false citations should, the Tribunal says, ordinarily expect referral to their regulatory body.

Read that again slowly. It is not enough that the legal proposition is sound. It is not enough that some case, somewhere, might support it. The specific case named, the specific citation given, and the specific proposition it is said to establish must all be verified before a qualified professional puts their name to the filing.

This is what the verification obligation looks like when it becomes procedurally embedded rather than merely expected. The Tribunal created it because the expectation alone was not working. The Upper Tribunal had seen, in the latter half of 2025 alone, a "considerable increase" in fictitious citations appearing in statutory appeals and judicial review applications.

NZ courts have issued guidelines. They have issued warnings. The statement of truth mechanism is the logical next step — the procedural consequence that converts a professional expectation into a signed, enforceable obligation. It is coming here. The question is whether NZ practitioners will be ready for it or surprised by it.

The architectural question most firms are not asking

The Tribunal's distinction between public and closed AI tools is not about which AI product sits on a fee earner's desktop. It is about what happens to the data after they hit send.

Public platforms — free-tier ChatGPT, free-tier Claude, consumer AI tools generally — process input on shared infrastructure without contractual protections governing what the provider can do with your data. When a client file enters that environment, it has left your control. The Tribunal's reasoning, and the ERA's reasoning in QTR v BXD, applies directly.

Closed tools work differently. Enterprise and Teams tiers of the same AI products come with contractual data handling commitments, Data Processing Agreements, and processing within defined environments. Microsoft Copilot for M365, if your firm is already in the Microsoft ecosystem, processes within your own tenant. Local AI models running entirely on your own hardware send nothing anywhere.

The AI is the same. The architecture is different. The legal outcome is different.

Most firms that have not addressed this believe they have a policy that covers it. The SRA thematic review published last December found that only one of thirty-six CLPs could accurately describe their firm's AI obligations. One. Policies and architecture are different things, and the gap between them is where liability lives.

Three steps that do not require a consultant or a capital budget

Audit the tools actually in use — not the approved list, the tools fee earners are actually reaching for. Speed and familiarity drive tool selection more than policy does.

Separate tasks by data sensitivity. Privileged client material and confidential correspondence require closed-tool architecture. Research and drafting assistance can operate under frontier AI with appropriate enterprise terms. The same AI platform often offers both — the question is which subscription the firm is on and whether the data handling terms have been read.

Verify before you file. Every citation, every proposition, every case name confirmed against a primary source before it goes anywhere near a filing. Not as a new burden — as the standard that was always expected, is now in NZ court guidelines, and is being procedurally enforced in England.

— · —

The Tribunal did not say stop using AI. It said stop using it wrong.

NZ courts have already seen what wrong looks like. Six times in sixteen months, from self-represented parties who did not know better. Munir shows what the response looks like when it is a solicitor who should have.

Firms that read it that way will build practices that are more efficient and more defensible than those that abandon AI entirely out of caution. Firms that file it under 'UK law, not our problem' are making a decision they may be asked to account for sooner than they expect.