This is the ninth installment in the Year in Governance Series from the In-House Subcommittee of the ABA Business Law Section’s Corporate Governance Committee. Each month, the series will share key tips on a different corporate governance topic. To get involved in the Corporate Governance Committee, please visit the committee’s webpage.
A message from Kathy Jaffari: “As Chair of the Corporate Governance Committee, I would like to extend my sincere appreciation to the authors for this publication. The Corporate Governance Committee has ongoing opportunities for writing and volunteering with various projects, whether it’s an article you want to publish or a CLE that you want to present. Our Committee is dedicated to helping you promote informative resources for corporate governance practitioners. You may contact me at [email protected] to get involved.”
The attorney‑client privilege—a cornerstone of sound governance—allows for candid legal advice, but it can be waived through common missteps, and small missteps can waive protection for the entire board of directors. These ten tips offer practical advice to preserve the privilege.
- Master the fundamentals. Broadly, a communication is privileged if it seeks or provides legal advice and is maintained as confidential. It is the content of the communication that matters, not the label: copying in-house counsel on a purely business email chain and marking it “Privileged” does not make it so. Remember that the privilege belongs to the corporation, not individual directors—a distinction that becomes critical during investigations or when the interests of directors (individually or as a group) diverge from those of the company.
- Wear multiple hats, but—preferably—not at the same time. In-house counsel who also have business roles routinely offer business, not legal, advice. That business advice is not protected by the attorney-client privilege. Sometimes counsel’s advice is “mixed” because the business and legal advice are intertwined. If litigation ensues, you will need to examine each communication to categorize it as business, or legal, or mixed advice. When the board is seeking legal advice from in-house counsel who has dual roles, it should be made clear—at the meeting and in the minutes—and the transition into seeking legal advice should be expressly memorialized. As for documents, separate the legal and business documents to the extent possible. If the documents have mixed content, try to separate and label the legal sections. This will make it easier to identify—and, later, protect—privileged information.
- Protect the privilege when drafting minutes. Board meeting minutes should record that legal advice was received on a particular topic but need not summarize the substance of that advice. For executive sessions where legal matters are discussed with counsel present, keep a separate set of privileged minutes prepared by counsel. These privileged legal minutes should be maintained by counsel, follow retention policies, and be redacted before they are shared outside the privilege circle, such as with auditors. Recordings for board and committee meetings are strongly discouraged, but if audio or video recordings are created, they should be destroyed right away: the minutes are the sole official record, making it much easier to isolate and protect the privilege.
- Manage digital communications. To maintain confidentiality, you must demonstrate an intent to maintain privacy. But many directors use employer-provided email accounts, personal email accounts, and other informal channels of communication that undermine any expectation of privacy and jeopardize privilege. Explicitly discourage substantive texting by directors, as text messages are discoverable in litigation. The ideal approach is for directors to use a secure board portal for all substantive communications. Another option is to issue company-hosted email accounts for directors and have them use only those accounts for all substantive communications. Alternatively, directors can also use a dedicated, secure personal account exclusively for board work. It may help to remind directors how litigation typically proceeds: that is, the collection and review of all emails and text messages and then a review for relevance. This reality check may help focus the directors’ minds on following these protocols.
- Admit only necessary third parties. Third parties generally waive privilege unless their presence is necessary to provide or receive legal advice. For example, counsel advising about the propriety of insurance reserves may need an actuary present to explain the underlying analysis. When third parties are essential to effective communication, have counsel state why their presence is needed to obtain legal advice, and ensure counsel states this rationale on the record for inclusion in the minutes. To the extent possible, engage and direct the third parties through outside counsel. If the third party is not essential for the legal advice—e.g., bankers, public relations personnel, board observers, etc.—excuse them and memorialize that action in the minutes.
- Treat AI tools as potential third parties. Boards should establish clear protocols for using new technologies, including artificial intelligence (“AI”). To begin, a board should use only enterprise-grade technology with verified confidentiality protections. Turn off auto-recording on collaboration platforms, and for executive sessions discussing legal matters, consider avoiding AI transcription entirely: handwritten notes still work just fine. If the company uses AI to summarize or analyze large volumes of materials (such as board books), ensure that the tools used have been vetted for confidentiality, cybersecurity, and the appropriate data-use restrictions.
- Insulate Special Committee investigations. When a Special Committee is formed, that committee—not the full board—becomes the “client” for purposes of the investigation. It is helpful to have separate counsel for the Special Committee run the process, provide the relevant Upjohn warnings, and report substantive findings only to unconflicted directors. Any advisors (e.g., forensic accountants, bankers) engaged for the Special Committee should be retained by counsel for a defined legal purpose, with committee counsel controlling the distribution of drafts and materials. Resist sharing detailed findings with conflicted directors or the full board: such disclosure can waive the privilege. And be clear about this approach when the Special Committee is formed.
- Navigate cross-border investigation challenges. Attorney-client privilege rules may be different internationally. For example, in European Union competition matters, communications with in‑house counsel are not privileged. You should therefore default to local outside counsel and keep sensitive cross‑border advice in counsel‑controlled channels. Before sending any board materials to regulators, coordinate with counsel and assume that the voluntary disclosure of privileged materials risks broader waiver in subsequent litigation. When cooperating, prioritize facts and nonprivileged documents, and avoid waivers unless there is a deliberate, board‑approved strategy.
- Treat the privilege like it matters. Treat privilege as you would any other governance risk: educate new directors during onboarding and re-educate current directors. Train directors and key executives on the fundamentals: legal versus business boundaries, proper use of the board portal, and communication protocols. Use clear subject lines like “Privileged & Confidential—Request for Legal Advice re [topic],” but use the labels appropriately. Also, consider having your outside counsel assess your privilege practices as they would in litigation, and conduct annual privilege audits to review practices and identify vulnerabilities.
- Prepare for privilege challenges. Even if the board follows each of these tips, privilege may be challenged in litigation or inadvertently waived. Establish clear protocols now: designate who is empowered to waive privilege (typically only the board or authorized officers), document your privilege procedures, and maintain a privilege log for sensitive matters. Understand the consequences of waiver (including deliberate waivers), which can extend beyond a single document to the entire subject matter. When litigation looms, do not wait to implement a legal hold, and seek a Rule 502(d) order to protect against inadvertent waiver. By implementing these protocols, you can create a culture that minimizes risk and preserves the attorney-client privilege.
The views expressed in this article are solely those of the authors and not their respective employers, firms or clients.
