Chat, Is This Conversation Privileged?

As artificial intelligence (“AI”) and generative AI (“GenAI”) tools become increasingly integrated into daily operations across industries, the legal industry is rapidly adapting. Law firms and companies of all sizes are implementing AI into their workflows. But adopting new technology brings its own new set of risks—most notably, the potential waiver of attorney-client privilege and work product protections when using AI tools.

Until recently, the legal industry was largely in the dark on whether the use of these tools could waive such protections. However, two recent decisions, United States v. Heppner and Warner v. Gilbarco, Inc., provide critical insight on how courts may treat the intersection between the attorney-client privilege and work product doctrine with prompts (“inputs”) submitted to GenAI tools, the corresponding outputs, and their associated data. This alert analyzes two recent decisions and offers practical considerations for practitioners, companies, and other AI users navigating privilege and confidentiality concerns in light of these developments.

On February 17, 2026, Judge Jed S. Rakoff of the Southern District of New York granted the government’s motion in United States v. Heppner,¹ concluding that submitting prompts to GenAI tools could waive privilege because GenAI was a third party outside the privilege. The court noted that the GenAI-generated materials were not created at the direction of counsel, and transmitting this material to counsel after the fact did not retroactively render it privileged or otherwise protected work product.

Conversely, on February 10, 2026, Judge Anthony P. Patti of the Eastern District of Michigan denied the defendant’s motion to compel discovery in Warner v. Gilbarco, Inc.,² holding that (i) prompts entered into GenAI tools were created in anticipation of litigation and remained protected under the work product doctrine; and (ii) GenAI and other AI programs were mere tools, not persons.

Attorney-Client Privilege and the Work Product Doctrine: What’s the Difference?

Attorney-client privilege protects confidential communications between a lawyer and client—that are made for the purpose of seeking or providing legal advice—from disclosure in most legal proceedings.³ This privilege can be waived by disclosing protected confidential communications to any third party.⁴

By contrast, the work product doctrine protects materials prepared in anticipation of litigation by or for a party or its representative.⁵ This protection covers internal analyses, strategy documents, and attorney notes.⁶ Unlike the attorney-client privilege, the work product protection is not absolute and may be overcome if the party seeking such protected material shows substantial need and undue hardship.⁷ Waiver of the work product doctrine occurs when materials are disclosed only to an adversary (or in a manner that increases the likelihood of such disclosure).

Both the attorney-client and work product protections can also be waived under the “sword and shield” fairness doctrine (“the fairness doctrine”)—which prohibits a party from using protected material affirmatively and at the same time withholding other related information.⁸

The GenAI Landscape Before Heppner and Warner

Although these principles are well established, courts have applied them inconsistently in the context of modern technology. Indeed, the few courts that have previously addressed GenAI in this context have held that AI prompts and outputs crafted by counsel may qualify for varying degrees of work product protection depending on the extent to which they reveal legal strategy or mental impressions, while also cautioning that reliance on such materials in pleadings or motion practice may invite waiver. Others have taken a broader view, suggesting that even partial use of AI-generated content across discovery—including deposition testimony—may trigger waiver.⁹ Most of these pre-existing decisions, however, arise in cases involving GenAI companies as parties.¹⁰ The Heppner and Warner decisions are uniquely positioned to be the starting point for courts grappling with similar issues of privilege, work product, and waiver may arise in the context of using GenAI tools for legal strategy.

United States v. Heppner

In Heppner,¹¹ the defendant produced a privilege log listing numerous AI-generated analyses described as conveying facts to counsel “for the purpose of…obtain[ing] legal advice” during pre-trial litigation.¹² The government moved to compel production, arguing the materials were neither privileged nor work product. The court agreed.

Addressing attorney-client privilege first, the court held that none of the AI-generated materials were protected because the defendant failed to satisfy the required privilege elements.¹³ Specifically, the court found that the AI-generated reports did not constitute communications with counsel because the AI tool was not an attorney, and privilege requires a “trusting human relationship.”¹⁴ The court further noted that the defendant did not act at counsel’s suggestion or direction when he used the AI tool, and that the AI tool’s third-party platform collected and could disclose user data according to the platform’s privacy policy—eliminating confidentiality.¹⁵

The court next considered the work product doctrine, emphasizing that even if the reports were prepared in anticipation of litigation, they were created independently created by the defendant and did not reflect counsel’s mental impressions or legal strategy. The court implied that the inputs did not reveal legal thought processes, and that merely providing them to counsel was insufficient to invoke protection.¹⁶ The court determined that, because the party created the documents on his own volition, defense counsel’s admission that the reports only “affected” rather than “reflected” their legal strategy was dispositive in finding the documents were not protected by the work product doctrine.¹⁷

Warner v. Gilbarco, Inc.

In Warner,¹⁸ a case brought by a pro se plaintiff, the court denied the defendants’ request to compel production of “all documents and information concerning [plaintiff’s] use of third-party AI tools in connection with th[e] lawsuit” and held that the materials were protected as attorney work product.¹⁹

According to the court, because “ChatGPT (and other generative AI programs) are tools, not persons,” the plaintiff had not waived work product protection because there was no disclosure to an adversary or in a manner likely to reach an adversary.²⁰ The court also noted that because the plaintiff was a pro se litigant, they have a right to assert work product protections over material they generated.²¹

Key Takeaways and Practical Considerations

The Heppner and Warner decisions help establish the starting goal posts for how protections intersect with AI. For instance, the Heppner decision underscores the (i) potential need for counsel involvement in AI-generated materials for privilege or work product protection; and (ii) critical distinction between materials that merely “affect” versus “reflect” legal strategy. The Warner decision demonstrates that the use of third-party AI tools does not automatically trigger waiver of privilege or work product protections. Both cases serve as warnings that litigants using AI for legal purposes should remain mindful of privacy policies and data-sharing terms, as these may influence confidentiality or privilege considerations.

As additional opinions concerning the intersection of attorney-client privilege or work product and GenAI are published, businesses and litigants should consider:

• Avoiding any upload of confidential materials in open GenAI tools or even closed subscription-based tools if they have web search functionality enabled.
• Including in prompts an instruction that the output include designations of attorney-client privilege and/or work product (as applicable) (e.g., “Prepared at the request of counsel” or “Prepared in anticipation of litigation”). This might help to later minimize the risk of downstream waiver should the inputs and outputs later be subject to collection, review, or production in litigation. Still, it should be noted that the case law in this area is developing.
• Exercising caution and information governance controls when using GenAI for legal purposes, particularly given the risk of potential downstream waiver if privileged or work product material is contained in GenAI inputs or outputs and not clearly demarcated as such.
• Being mindful of potentially unintended consequence of using GenAI for litigation purposes without appropriate safeguards and precautions—namely, the potential for thorny conflict issues to arise should GenAI materials prepared for or shared with counsel later be deemed not privileged and used by an adversary at trial.
• Maintaining robust and accurate privilege log entries that state or defend the basis for attorney-client privilege or work product. E.g., “analysis prepared in anticipation of litigation conveying facts to counsel for the purpose of obtaining legal advice.”
• Staying up to date on rapidly evolving developments in privilege case law as applied to GenAI artifacts.
• Potentially implementing company-wide trainings focusing on the interaction between privilege, attorney-client privilege, and GenAI tools. Such training should emphasize the:
  • differences between openly available GenAI tools and privately hosted iterations;
  • kinds of information that should be excluded from entry into GenAI software;
  • importance of privacy policies connected to each GenAI tool; and
  • need for adding tags to prompts such as “analysis prepared in anticipation of litigation conveying facts to counsel for the purpose of obtaining legal advice.”