Publications
When AI Becomes the Third Party: Courts Divide Over Privilege and Work Product Protection
In United States v. Heppner, No. 25 Cr. 503 (JSR), 2026 U.S. Dist. LEXIS 32697 (S.D.N.Y. Feb. 17, 2026), the United States District Court for the Southern District of New York addressed a question of first impression: whether communications with a publicly available artificial intelligence platform, made in connection with a pending criminal investigation, are protected by the attorney-client privilege or the work-product doctrine.
The court answered “no.” The defendant, Bradley Heppner, used the generative AI platform Claude after receiving a grand jury subpoena and learning that he was a target of a federal investigation. He used the platform to prepare materials addressing possible charges, defenses and legal strategy, which he later shared with his attorneys. The court held that the communications were protected by neither the attorney-client privilege nor the work-product doctrine.
Attorney-Client Privilege
Under Second Circuit law, the attorney-client privilege protects communications that are: (1) between a client and an attorney; (2) intended to be, and actually kept, confidential; and (3) made for the purpose of obtaining or providing legal advice. United States v. Mejia, 655 F.3d 126, 132 (2d Cir. 2011).
The court found that Heppner’s communications with Claude failed these requirements. Claude was not an attorney, and discussing legal issues with a nonlawyer platform did not create an attorney-client relationship. The communications were also not confidential because Heppner voluntarily transmitted information to a third-party AI provider whose privacy policy permitted the collection and retention of user inputs and outputs and allowed certain disclosures to third parties.
The court further held that, even if Heppner entered information that he had originally received from counsel, any privilege was waived when he disclosed that information to the AI platform. The materials did not later become privileged merely because Heppner shared them with his attorneys.
Finally, Heppner’s counsel did not direct him to use Claude. Although Heppner claimed that he created the materials to assist later discussions with counsel, the court focused on the purpose of the communications when they were made. Heppner independently sought assistance from Claude, which the provider expressly disclaimed providing formal legal advice.
Work-Product Protection
The work-product doctrine generally protects materials prepared by or at the direction of counsel in anticipation of litigation and is intended to safeguard an attorney’s mental impressions, legal theories and litigation strategy.
Although Heppner created the documents while anticipating criminal charges, his attorneys did not direct him to use Claude. He acted independently, and the documents did not reflect counsel’s strategy when they were created. The fact that the materials may have later influenced counsel’s strategy was insufficient to establish work-product protection.
The court did leave open the possibility that a different analysis could apply where counsel directs the use of an AI system and the technology functions as an agent assisting counsel. However, the court did not decide whether an AI platform could qualify as such an agent.
Other Courts Take a Different Approach
Shortly before Heppner, a federal court in Michigan reached a different result in Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026). There, the court held that a pro se plaintiff’s use of ChatGPT to assist with litigation preparation was protected work product.
The Warner court emphasized that waiver of work-product protection differs from waiver of the attorney-client privilege. While disclosure to an ordinary third party may waive the attorney-client privilege, work product is generally waived only where disclosure is made to an adversary or in a manner that substantially increases the likelihood that an adversary will obtain the material. The court characterized ChatGPT as a tool rather than a person and concluded that compelling the plaintiff’s prompts and outputs would improperly expose her internal analysis and litigation thought process.
The District of Colorado followed a similar approach in Morgan v. V2X, Inc., 2026 U.S. Dist. LEXIS 67939 (D. Colo. Mar. 30, 2026). The court held that a pro se litigant could assert work-product protection over AI-assisted litigation preparation because Federal Rule of Civil Procedure 26(b)(3) protects materials prepared by or for a party, not only materials prepared by counsel.
The Morgan court distinguished Heppner because it arose in a criminal matter involving a represented defendant who acted independently of counsel. By contrast, a pro se litigant simultaneously acts as both party and advocate. The court nevertheless required the plaintiff to identify which AI tools he used and amended the protective order to restrict the use of confidential information in AI platforms lacking sufficient contractual protections.
A New York state court reached a similar result in Assini v. Hayward, 2026 NYLJ LEXIS 916 (Sup. Ct. Nassau Cty. June 4, 2026). The court quashed a subpoena directed to OpenAI seeking a pro se defendant’s prompts, inputs, outputs and AI-assisted legal research. Relying on Morgan, the court found that the materials could qualify for protection as materials prepared in anticipation of litigation under CPLR 3101(d). The court, nevertheless, directed the litigant to comply with New York’s rules governing the use of AI in litigation.
An Emerging Distinction
Read together, these decisions suggest that courts may distinguish between attorney-client privilege and work-product protection when evaluating AI-assisted materials.
The attorney-client privilege remains particularly vulnerable where confidential information is voluntarily entered into a publicly available AI platform. Because the platform is not an attorney and the information is disclosed to an outside provider, the traditional requirements of an attorney-client communication and confidentiality may be absent.
The work-product analysis may be more flexible. Warner, Morgan and Assini indicate that some courts may protect AI-assisted research, drafting and analysis where the materials reflect a litigant’s own mental impressions and were created in anticipation of litigation, particularly where the user is proceeding pro se. However, courts may still require disclosure of the tools used, impose protective-order restrictions, and enforce local AI rules.
Whether work-product protection will extend to a represented client using AI at counsel’s direction remains unresolved. The outcome may depend on who directed the work, the purpose of the AI use, whether the materials reflect counsel’s strategy, and whether the platform’s data practices create a meaningful risk of disclosure to an adversary.
Considerations for Attorneys Using AI
These decisions do not establish that every use of AI destroys privilege or that all AI-assisted materials are protected work products. Instead, they demonstrate that the analysis will depend on the nature of the protection asserted, the circumstances surrounding the AI use, and the forum where the case is heard.
Law firms should evaluate whether an AI provider retains prompts, uses customer information for model training or permits disclosure to vendors, regulators, law enforcement or litigants. Where confidential information is involved, firms should consider enterprise or internally controlled systems with contractual confidentiality protections, limited retention, restricted data use, and appropriate access controls.
Attorneys should also supervise AI-assisted litigation work and affirmatively direct its use where appropriate, rather than attempting to characterize a client’s independent AI activity as work product after the fact. Clients should be instructed not to enter attorney communications, case facts, witness information, or legal strategy into publicly available AI platforms without counsel’s approval.
Summary
Heppner, Warner, Morgan and Assini demonstrate that courts are beginning to apply traditional privilege and work-product principles differently depending on the context of the AI use. Heppner reflects a strict application of attorney-client privilege and work-product rules where a represented criminal defendant independently used a public AI platform. By contrast, Warner, Morgan and Assini reflect a greater willingness to protect the AI-assisted litigation preparation of pro se parties.
For the legal community, the developing decisions highlight the need for clear AI policies, careful review of vendor privacy practices and direct client education. When confidential or litigation-related information is involved, AI use should be attorney-directed, limited to secure systems, and structured to preserve confidentiality and attorney work product. Even where substantive materials may be protected, courts may still require transparency concerning the tools used and impose restrictions on how confidential information is processed.
Read more
