Some industries are forced to care about privacy. HIPAA does have some holes, but IT are extremely cautious. What that ultimately means is a contract that shifts liability to the vendor. And from what I understand legal is in danger of getting to a similar place because courts are ruling things shared with remote AI are not inherently protected by privilege (meaning they are discoverable).

And with things like Fable mandating data retention at Anthropic it makes things business records which US Federal Administrations have a history of obtaining without warrants and under mandatory gag orders like national security letters. They generally won't issue those directly to law firms (because they can and will fight), but IT companies generally comply quietly and have government contracts to think about.