Build vs Buy Law-Firm AI: The 3 Privilege Tiers (2026)

The one thing that is no longer a differentiator

Every vendor in this market now says "we don't train on your data." That used to be the headline. In 2026 it is table stakes. Anthropic, OpenAI, and Google all commit, on their commercial tiers, that inputs and outputs are not used to train models by default. So if a sales rep leads with "we never train on your data," they have told you nothing that separates them from anyone else.

The questions that actually separate the options are narrower:

• Retention. Is the content stored after the response, and for how long? Zero Data Retention means nothing is kept at rest once the answer comes back.
• BAA. Can you get a Business Associate Agreement, if you handle protected health information alongside legal matters?
• Residency. Which region and which legal jurisdiction does inference run in?
• Ownership. Do you own the integration and the audit trail, or rent them?
• Cost model. Per token with no floor, or per seat with a minimum?

And one legal point sits underneath all of it. In United States v. Heppner (S.D.N.Y., February 2026), a federal court held that a defendant's chats with a consumer AI tool were not protected by attorney-client privilege. The defense against that ruling is the same in Tier 2 and Tier 3: contractual no-training plus Zero Data Retention plus a BAA. Only Tier 1 sidesteps the question, because there is no third party to disclose to. Keep that in mind as you read: a packaged legal product is not categorically safer than a model you call yourself. It runs the same legal analysis, just out of your sight.

Tier 1: Self-hosted open-weight

Run an open model (Llama, Mistral, Qwen, DeepSeek) on firm hardware or inside a cloud account the firm controls, using a local runner like Ollama, LM Studio, or vLLM. No third-party processor ever touches the matter. That is the only configuration where "nothing leaves" is literally true, and it removes the third-party disclosure question from the privilege analysis entirely.

Cost. A small firm can start around $5,000 to $7,000 for a Mac Studio class machine. There is no per-token bill and no BAA to sign, because there is no third party. Serious throughput costs more in hardware and engineering.

Tradeoff. Open-weight models trail the frontier on hard reasoning, and someone has to own the deployment, updates, and uptime. For most firms that operations burden is the real cost, not the hardware.

Fit. Firms with the strongest confidentiality posture, or a specific class of matter that cannot tolerate any external processor. We wrote the full deployment guide in the Privilege Stack post.

Tier 2: A commercial frontier model under ZDR and a BAA

This is the practical default, and where most of the confusion lives. The important thing to understand is that the model brand barely matters. Claude, GPT, and Gemini all offer the same shape: a frontier model, reached through an API, that does not train on the data, supports retention controls, and comes with a BAA. The right pick is usually whichever cloud the firm already lives in.

For a lot of firms, Azure OpenAI is the smoothest path, because the BAA is part of the standard Microsoft agreement and most firms already sit inside a Microsoft 365 tenancy. A Google Workspace firm has the same easy on-ramp through Vertex AI. The point is to choose by procurement reality, not by which model demoed best.

One detail that catches firms out: Zero Data Retention is not a single checkbox across these clouds. On Azure OpenAI the default is 30-day abuse-monitoring retention, and true ZDR requires the Modified Abuse Monitoring exception, which is approval-gated and only on an Enterprise Agreement or Microsoft Customer Agreement, not pay-as-you-go. On Vertex AI, turning on Google Search grounding forces a 30-day retention window, so privileged work should avoid grounding or accept the retention. On Bedrock, retention is configurable and has to be set to none, with model-provider isolation meaning the third-party model provider never sees your prompts. Verify the setting is actually off before you rely on it.

Whatever the model, the integration pattern is the same: reach the matter data through the practice-management API (Clio, MyCase, Filevine) using a connector, not by pasting into a chat window, and log every action for ABA Opinion 512. The content is still processed by the model, but under these terms it is not used for training and, under Zero Data Retention, not stored after the response. For the plan-level detail on where consumer terms bite, see Claude Zero Data Retention: Team vs API.

Cost. Per token, pay as you go, no seat minimum. This is the reason Tier 2 usually beats the packaged products on price for a small firm. One caveat worth knowing: Claude Enterprise, which bundles ZDR plus a BAA in a single click, carries roughly a 70-seat minimum at about $20 per seat per month before usage. For a 12-attorney firm that is a five-figure floor for a guarantee the API gives you with no floor at all.

Tier 3: A packaged legal AI product

Harvey, CoCounsel, Clio Duo, Lexis+ AI, Spellbook. These are the fastest to adopt because someone else built the workflows. The tradeoff is that you rent the capability and you do not control the data path.

Here is the part the demos skip. All three ship the matter to third-party AI infrastructure, and none offer a local or on-premise option. So they sit on the same privilege footing as Tier 2: contractual no-training, encryption, defended by an enterprise agreement. They are not a higher tier of safety. What you give up versus building your own Tier 2 integration is ownership of the workflow, an audit trail you can inspect, and the per-seat economics. You are often paying a premium to have someone resell you a model, frequently the same GPT-4 you could call yourself under your own BAA.

How to choose

Run three questions in order.

1. Can any third party touch this data at all? If the answer for some matters is a hard no, those matters go to Tier 1. You can route by sensitivity; a firm does not have to pick one tier for everything.

2. What cloud is the firm already in? That answers the Tier 2 model question for you. Microsoft 365 points to Azure OpenAI, Google Workspace to Vertex AI, AWS to Bedrock, and a firm with no strong preference to the Claude or OpenAI API directly. The BAA and the data residency come with the tenancy you already pay for.

3. Do you want to own the integration or rent it? If owning it (full source, an auditable path, no per-seat fee on the custom layer) is worth a build, Tier 2 with a connector you own beats a Tier 3 subscription on both control and three-year cost. If you would rather pay a subscription and never think about it, and the seat math works, Tier 3 is a legitimate choice.

For most small and mid-size firms the honest recommendation is Tier 2: a commercial frontier model under Zero Data Retention with a BAA, reached through a connector you own, with the model chosen by your existing cloud. Self-host the matters that demand it. Treat the packaged products as a convenience purchase, not a compliance upgrade.