Are Your Conversations with AI Shielded from Discovery? Courts Are Split

Whether a client’s prompts to a generative AI tool and the documents it produces are protected from disclosure depends on the case type, who claims protection, and whether counsel was involved. In United States v. Heppner, a New York federal judge ruled that a criminal defendant’s communications with an AI platform were protected by neither the attorney-client privilege nor the work product doctrine. Since then, federal courts in civil cases have reached a different result, holding that a party can assert work product protection over AI-assisted materials. The safest course for businesses and individuals remains the same: treat AI platforms as third parties and involve counsel before using them in connection with a legal matter.

Legal Framework: Attorney-Client Privilege and Work Product

Under well-established law, to qualify for attorney-client privilege, a communication must satisfy three elements:

• It must be between a client and an attorney;
• It must be made in confidence; and
• It must be for the purpose of obtaining or providing legal advice.

Meanwhile, the work product doctrine protects materials prepared in anticipation of litigation. In federal civil cases, Rule 26(b)(3) of the Federal Rules of Civil Procedure extends that protection to materials prepared by or for a party, not only by counsel. In the criminal context, courts have historically focused on shielding attorneys’ mental impressions and legal theories. As discussed below, that distinction has become central to how courts treat AI-generated materials.

Facts of United States v. Heppner

Generative artificial intelligence tools have become increasingly prevalent, while AI’s implications for the law remain in their infancy. In United States v. Heppner, Judge Jed S. Rakoff of the Southern District of New York considered a question of first impression: when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are those communications protected by the attorney-client privilege or the work product doctrine?

As detailed in court documents, a grand jury indicted Bradley Heppner on charges of securities fraud, wire fraud, conspiracy, making false statements to auditors, and falsifying corporate records. In connection with Heppner’s arrest on November 4, 2025, FBI agents seized numerous documents and electronic devices. The seized materials included approximately 31 documents memorializing communications Heppner had with the generative AI platform Claude, operated by Anthropic.

Following his indictment, Heppner’s counsel asserted privilege over the AI documents, arguing that (1) Heppner had inputted into Claude information he had learned from counsel; (2) Heppner had created the documents for the purpose of speaking with counsel to obtain legal advice; and (3) Heppner had subsequently shared the contents with counsel. Counsel conceded, however, that they did not direct Heppner to run the AI searches. The Government sought a ruling that the documents were protected by neither the attorney-client privilege nor the work product doctrine.

Court Rules Generative AI Communication Not Privileged

Judge Rakoff agreed, ruling that the AI documents were not protected. His decision did not create new law; it applied existing privilege precedent to AI technology.

Attorney-Client Privilege

Judge Rakoff first determined that the AI documents lacked key elements of the attorney-client privilege. He found:

• No attorney-client communication occurred: Claude is not an attorney, and communications with it do not create the human fiduciary relationship that privilege protects.
• No reasonable expectation of confidentiality existed: Heppner voluntarily shared information with a third-party AI platform whose privacy terms permit the use, retention, and potential disclosure of user inputs and outputs. Under these circumstances, there was no confidentiality, an essential component of privilege.
• The purpose was not to obtain legal advice from counsel: Although Heppner planned to share the AI results with his lawyer, the court emphasized that privilege hinges on actual confidential communication with counsel, not on later sharing. Planning to discuss one’s own notes with a lawyer does not satisfy the test.

Notably, Judge Rakoff left open whether AI used at counsel’s direction or under secure, enterprise protocols could qualify for privilege.

Work Product Doctrine

Judge Rakoff also rejected work product protection. Although Heppner claimed he generated the materials in anticipation of litigation, counsel expressly did not direct him to use the AI tool. Judge Rakoff stressed that, in this context, work product must stem from or be at the direction of counsel. Independent client research, even if litigation-related, did not qualify.

Civil Courts Reach a Different Result

Heppner made waves, but its reach is limited because it was a criminal case. In federal civil litigation, courts have declined to follow it. In Warner v. Gilbarco, Inc. (E.D. Mich. Feb. 10, 2026), the court allowed a plaintiff to assert work-product protection for materials created using AI. More recently, the District of Colorado addressed Heppner directly in Morgan v. V2X, Inc. (D. Colo. Mar. 30, 2026).

How Morgan Distinguished Heppner

Morgan is another formative case concerning discovery and generative AI. The immediate concern in Morgan was whether the pro se plaintiff could invoke Rule 26(b)(3) to shield his litigation-related AI work from disclosure. Magistrate Judge Maritza Dominguez Braswell addressed the recent Heppner decision at the outset, distinguishing it on two grounds: (1) Heppner was a criminal case, thus there was no work product protection for parties; and (2) the Heppner defendant’s independent AI use created a separation between client and counsel that simply does not exist when the litigant is pro se and therefore occupies both roles.

The first point follows from the text of Rule 26(b)(3), which, as noted above, protects materials prepared by or for a party. The second point is more nuanced: because this protection turns on whether a document was prepared “in anticipation of litigation,” a pro se party that must act as both party and an advocate is better positioned to make that claim, particularly “in the context of a pro se litigant’s use of AI to assist with their litigation preparation, the use of AI closely resembles the kind of confidential, strategy-laden iterative work product that Rule 26(b)(3) was designed to protect.” Morgan, at *5. The inverse scenario matters for represented parties: when a represented party decides to use AI, there may be more Heppner-style skepticism regarding whether the AI use was performed in connection with the litigation.

Does Using an AI Platform Waive Work Product Protection?

With those distinctions in place, the Court then addressed whether work product protections were waived by disclosing information to a third-party AI provider, which typically uses that information to help train its models. This is perhaps the most consequential portion of the opinion, as Judge Braswell took on the question for a new era, “when nearly all electronic interaction passes through third-party systems.” Id. at *4. Judge Braswell rejected the proposition that sending information to a commercial AI provider necessarily destroys every reasonable expectation of confidentiality or automatically waives work product protection. Warner rejected that argument as well, finding that it “would nullify work-product protection in nearly every modern drafting environment, a result no court has endorsed.” Warner, 820 F. Supp. 3d at 637. Judge Braswell agreed, finding that information given to these third-party electronic intermediaries does not mean the information has effectively been exposed to an adversary or that the user has surrendered an expectation of privacy.

Indeed, Judge Braswell suggested that the privacy argument may be especially strong for generative AI because these tools are not merely “passive” systems that return search results: they are designed to engage users iteratively, invite candid disclosures, and interact in a way that “feels genuine and intimate.” Id. at *5. A more recent New York state decision echoed that point and adopted that analysis, finding it “persuasive.” Assini v. Hayward, 2026 WL 1677232, at *3 (N.Y. Sup. Ct. June 4, 2026). The relevant waiver inquiry therefore remained whether disclosure was made to an adversary, or in circumstances substantially increasing the likelihood that the adversary would obtain the material, not merely whether a third-party technology provider technically received it. Still, others, like Judge Rakoff in Heppner, may view the waiver issue differently.

The Court’s Protective Order Language for AI

Finally, Judge Braswell turned to an AI-related protective order dispute concerning the use of AI with confidential information. This debate is playing out in boardrooms and law firms across the country as stakeholders weigh the benefits of AI against the cost of transmitting sensitive data to a wider array of sub-processors. In Morgan, Judge Braswell rejected both sides’ proposed language to address uploading confidential information to AI providers: the plaintiff’s “secure, closed-circuit” formulation focused too heavily on conventional cybersecurity, while the defendant’s proposal appeared to be so closely engineered around its own vendor arrangements that it became unnecessarily complex. The Court instead drafted a functional middle ground:

No party or authorized recipient may input, upload, or submit CONFIDENTIAL Information into any modern artificial intelligence platform, including any generative, analytical, or large language model-based tool (“AI”), unless the AI provider is contractually prohibited from: (1) storing or using inputs to train or improve its model; and (2) disclosing inputs to any third party except where such disclosure is essential to facilitating delivery of the service. Where disclosure to a third party is essential to service delivery, any such third party shall be bound by obligations no less protective than those required by this Order. In addition, the AI provider must contractually afford the party or authorized recipient the ability to remove or delete all CONFIDENTIAL information upon request. A party intending to use AI that it contends meets these requirements must retain written documentation of these contractual protections.

As Judge Braswell acknowledged, these requirements all but ruled out using confidential information with a consumer-level AI subscription. The plaintiff’s cavalier use of generative AI on confidential documents drew scrutiny, and the court ordered him to disclose every AI platform to which he had submitted confidential information.

No business or individual wants to justify their AI use to a judge. The practical steps below can help avoid that outcome.

Practical Considerations for Counsel and Clients

Taken together, these decisions confirm that while AI is novel, it remains subject to the longstanding principles governing confidentiality and privilege, and that the outcome may turn on whether the matter is civil or criminal and on who is claiming protection. Until the law settles, preserving privilege requires the same discipline always required when engaging third parties. Below are a few practical tips:

• AI Platforms Are Third Parties: If a client inputs confidential information into a consumer AI system, that input may constitute voluntary disclosure to a third party. Even later sharing the AI output with counsel does not retroactively create privilege.
• Consult Counsel Before Using AI in Legal Matters: Do not input facts, strategy discussions, legal advice, or investigation details into AI platforms without first consulting legal counsel. AI use directed by counsel stands on stronger footing than independent use.
• Implement Internal AI Policies: Companies should adopt clear policies governing employee use of generative AI tools, particularly for government investigations, internal investigations, litigation strategy, and regulatory inquiries.
• Coordinate AI Use Through Legal Departments: If AI tools are used in connection with legal matters, users should ensure counsel approves them, confirm appropriate confidentiality safeguards are in place, and avoid using consumer platforms for sensitive legal analysis.
• Review Your AI Vendor’s Contract Terms: Before using any AI platform with sensitive information, confirm that the provider is contractually prohibited from training on your inputs, limits disclosure to third parties, and allows you to delete your data on request. The protective order language in Morgan offers a useful checklist.
• Educate Leadership and Key Personnel: Executives and managers should understand that AI tools are not confidential legal advisors and may create discoverable records.

Key Takeaway

Generative AI can be a powerful productivity tool, but it should never replace confidential communications with counsel. Courts are still working out when AI-assisted materials are protected, and the answer currently differs between criminal and civil matters. Rather than rely on a favorable ruling, organizations should align their AI usage with established privilege principles. For guidance, don’t hesitate to contact us.