I. INTRODUCTION
- Generative AI is no longer a technological novelty. It has moved from the margins of experimentation into everyday decision-making. For many individuals and businesses, the first step now in understanding a problem is to ask a generative AI tool: What does this mean? What are my options? What should I do next? This may happen before a lawyer is consulted, before a dispute is formally escalated, before documents are preserved, or before a party even knows whether it is facing prospective litigation. The result is that generative AI is increasingly becoming the first layer of enquiry in commercial, regulatory and legal decision-making.
- The legal system cannot ignore this reality. Courts, lawyers, and regulators must now adapt established legal principles to the fact that generative AI is being used in ways that resemble research, drafting, strategy testing, factual analysis and early legal triage. This does not necessarily mean that old doctrines must be discarded. But it does mean that those doctrines will now be tested against new factual patterns: prompts, outputs, AI-generated summaries, account settings, model logs, user histories, and platform terms. Each of these may contain confidential facts, legal strategy, counsel’s mental impressions, or a party’s attempt to understand its legal position.
- One such doctrine on which courts have already opined is privilege. Privilege has traditionally been built around human relationships and recognised legal functions: lawyer and client, counsel and agent, litigation preparation, confidentiality, and professional accountability. Generative AI complicates each of these assumptions. Is an AI tool merely software, like a word processor? Is it a third party? Can it ever be treated as an agent of counsel? Does uploading privileged material into a public AI platform waive confidentiality? Are prompts and outputs discoverable? Should the law eventually recognise a new category of AI privilege?
- This alert considers how courts have begun to answer these questions by examining recent US decisions and one UK decision dealing with privilege, work product protection, confidentiality, and generative AI.
- In this case, the issue of privilege over AI-generated documents arose in the context of a criminal prosecution against Heppner concerning alleged securities fraud, wire fraud, conspiracy, making false statements to auditors, and falsifying corporate records. Before the indictment, Heppner had received a grand jury subpoena relating to these charges. Knowing that he was a target of the investigation, he used Claude, Anthropic’s generative AI platform, to generate documents relating to the investigation and his potential defence. The dispute arose when the FBI, while executing a search warrant at Heppner’s home, seized electronic devices and materials that included these Claude-generated documents. In exchanges with the government through his counsel, Heppner asserted privilege over these documents.
- The question that the Court answered was whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, the AI user’s communications are protected by attorney-client privilege or the work-product doctrine?
- Heppner made the following arguments:
- The Claude documents were connected to his attorney-client relationship because they contained information he had learned from counsel and were prepared after he had communicated with his lawyers.
- Documents were created for the purpose of speaking with his counsel to obtain legal advice, and the contents of these documents were shared with his counsel.
- Even if the documents were not protected by attorney-client privilege, they were protected by the work product doctrine because they were created after he knew he was a target of a criminal investigation and therefore were prepared in anticipation of litigation.
- The Court began by applying established principles: (i) attorney-client privilege protects confidential communications between a client and his attorney, (ii) that are intended to be, and in fact were, kept confidential, (iii) for the purpose of obtaining or providing legal advice. Privilege is narrowly construed because it withholds relevant evidence from the truth-seeking process. Applying these principles, the Court rejected Heppner’s claim for the following reasons.
- First, the AI documents are communications between Heppner and Claude, not between Heppner and his attorney. Claude is not an attorney. In the absence of an attorney-client relationship, the discussion of legal issues between two non-attorneys is not protected by attorney-client privilege.
- The Court also addressed the analogy between generative AI and ordinary software. It mentioned that some commentators argue that whether Claude is an attorney is irrelevant because a user’s AI inputs, rather than being communications, are more akin to the use of other internet-based software, such as cloud-based word processing applications. The Court held that this analogy cut against privilege rather than in favour of it. Recognised privileges require, among other things, a “trusting human relationship”. In the attorney-client context, that means a relationship with a licensed professional who owes fiduciary duties and is subject to discipline. Claude did not have those attributes.
- Second, the Court then considered confidentiality. The Court examined Anthropic’s privacy policy and noted that Anthropic could use data collected from user inputs and Claude outputs to train the Claude, and reserved the right to disclose information to third parties, including governmental authorities. On that basis, the Court held that Heppner could have had no “reasonable expectation of confidentiality in his communications” with Claude. The Claude documents are not like confidential notes that a client prepares with the intent of sharing them with an attorney, because Heppner first shared the equivalent of his notes with a third party, Claude.
- Third, the Court then turned to the purpose. This was the point that came closest to Heppner’s case. He argued that he used Claude for the express purpose of talking to counsel. But since Heppner communicated with Claude of his own volition, and not at the suggestion or direction of his counsel, what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude’s outputs with his counsel. Further, Claude disclaims providing legal advice. The government asked Claude whether it could give legal advice – it expressly noted that it is not a lawyer and cannot provide formal legal advice or recommendations. Rather, it recommended that a user consult with a qualified attorney.
- The Court also rejected the argument that the documents became privileged because Heppner later shared them with counsel. The Court’s reasoning was straightforward – a document that is not privileged when created does not become privileged merely because it is later transmitted to a lawyer.
- Lastly, the Court addressed the work product doctrine. The Court described the work product doctrine as distinct from the attorney-client privilege. It protects an attorney’s mental processes and materials prepared by or at counsel’s direction in anticipation of litigation or trial. However, it is not construed expansively. Where the materials were not prepared by counsel or counsel’s agents, protection will apply only if disclosure would create a real, not speculative, risk of exposing counsel’s thought processes. It held that the Claude documents were not prepared by counsel. They were not prepared at counsel’s direction. Nor did they reflect counsel’s mental impressions or litigation strategy when created. They were generated by Heppner on his own initiative. The Court therefore held that the work product doctrine did not protect them.
- The significance of Heppner lies in this sequence. The Court did not hold that AI use is inherently incompatible with privilege. It held that privilege cannot be assumed merely because a person uses AI for legal-adjacent thinking. The ordinary requirements still have to be established: a lawyer-client communication, confidentiality, legal advice purpose, and, for work product, counsel-directed litigation preparation. On the facts before the Court, each of those links was missing.
- Importantly, the Court left open a different possibility. It noted that if Heppner had used Claude at counsel’s suggestion or direction, there may have been an argument that Claude functioned like a trained professional acting as counsel’s agent. That observation is significant. It suggests that Heppner is not necessarily a decision that AI can never sit within a privileged legal workflow. It is a decision that, on these facts, the privileged landscape was absent: no counsel instruction, no supervision, and no confidential environment. Future clients and counsel may attempt to distinguish Heppner by arguing that an AI tool used on counsel’s instructions was not a substitute lawyer or independent third party, but an instrument or agent through which counsel’s legal work was carried out.
- Here, the issue arose in a civil employment dispute before the United States District Court for the Eastern District of Michigan. The plaintiff was appearing pro se. During the litigation, she used ChatGPT in preparing her case. The defendants brought several discovery motions. For present purposes, two motions are relevant. First, the defendants sought production of “all documents and information” concerning the plaintiff’s use of third-party AI tools in connection with the lawsuit. Second, they sought to overrule the plaintiff’s attorney-client privilege and work product objections to AI-related material, or alternatively, require her to provide a privilege log. They argued that any attorney-client privilege or work product protection had been waived because of her use of ChatGPT.
- The Court rejected the defendants’ motion for production of all documents and information concerning the plaintiff’s use of third-party AI tools. It held that what the defendants were seeking was the plaintiff’s “internal analysis and mental impressions”, rather than existing discoverable documents or evidence. The Court further noted that, as a general rule, a party may not discover documents and tangible things prepared in anticipation of litigation or for trial by another party or its representative.
- The Court then held that, even if the AI-related materials were otherwise discoverable, they were protected by the work product doctrine. It also rejected the waiver argument. The Court noted that attorney-client privilege may generally be waived by voluntary disclosure to a third person, but work product protection is different. Work product waiver ordinarily requires disclosure to an adversary or disclosure in a manner likely to place the material in an adversary’s hands. The Court held that ChatGPT and other generative AI programs are “tools, not persons”, even if administrators may exist somewhere in the background. On that basis, using ChatGPT did not amount to a waiver of work product protection.
- The Court also refused to require a privilege log for the AI-related material. Its reasoning followed from the same point: the request was not directed at ordinary discoverable material, but at the plaintiff’s thought process. The Court characterised the defendants’ attempt to obtain this material as speculative and a “fishing expedition”.
- The significance of Warner lies in the contrast with Heppner. In Heppner, the defendant was represented by counsel and sought to protect his Claude exchanges by connecting them to his attorney-client relationship and counsel’s work product. The Court therefore examined whether the use of Claude was confidential, counsel-directed, or capable of being treated as part of counsel’s legal work. In Warner, by contrast, the plaintiff was appearing pro se. The Court was therefore not concerned with whether ChatGPT had been used on counsel’s instructions or as counsel’s agent. The relevant question was whether the plaintiff’s own AI-assisted litigation preparation reflected her internal analysis and mental impressions. The Court held that it did, and treated the material as protected work product.
- Here, the issue arose in an employment discrimination case before the United States District Court for the District of Colorado. The plaintiff was appearing pro se. Both parties used AI in connection with their litigation work, but they disagreed on how AI should or should not be used in connection with the confidential information as defined in their then-existing protective order.
- V2X sought two forms of relief. First, it asked the Court to amend the protective order to include AI-specific restrictions. Second, it asked the Court to compel Morgan to disclose the identity of the AI tool he was using, so that V2X could assess whether its confidential information was adequately protected.
- Morgan did not oppose the amendment of the protective order altogether. Instead, he proposed a competing language. However, he opposed disclosing the AI tool he was using. His argument was that the specific software, research platforms and analytical tools chosen by a litigant to review discovery, synthesise information and prepare for trial fell within the work-product doctrine. Morgan also argued that restricting his use of AI tools would create an unfair “technological gap” between a pro se litigant and a corporate defendant represented by counsel with access to its own AI and cloud-based systems.
- The Court framed the dispute around two questions: first, to what extent work product protection applies to a pro se litigant’s use of AI; and second, to what extent a protective order should expressly restrict the use of AI.
- On the first question, the Court, upon analysis of relevant rules of the Federal Rules of Civil Procedure, held that while attorneys and other representatives receive additional heightened protection under this Rule, a party’s own mental impressions are nevertheless protected. It further held that the importance of applying these protections to pro se litigants is magnified in the context of AI, one of the most powerful knowledge tools ever to become available to the masses. This is because pro se litigants are forced to act as both as a party and an advocate, simultaneously.
- The Court distinguished Heppner on two grounds. First, Heppner was a criminal matter, whereas Morgan was a civil case governed by Rule 26(b)(3), which protects the work product of a party, not merely counsel. Second, in Heppner, there was a gap between the party and the attorney because the defendant had acted apart from his lawyer. In the pro se context, the Court held that a gap does not exist because a pro se litigant is simultaneously the party and the advocate.
- The Court also followed the reasoning in Warner. It accepted that AI systems such as ChatGPT, Claude, Gemini and others may collect user data for training and other purposes. But it did not treat that fact as automatically eliminating privacy expectations or waiving work product protection. The Court reasoned that modern electronic interactions often pass through third-party systems and that intermediary access does not, by itself, extinguish all expectations of privacy. It further noted that even if AI use technically discloses information to a third party, it is unlikely that the information will reach an adversary absent a legal process. On that basis, the Court held that AI interactions do not automatically compromise work product protection.
- It also held that while the substance of a pro se litigant’s AI-assisted litigation preparation may attract work product protection, Morgan had not shown that merely identifying the AI tool itself would reveal his mental impressions or legal strategy. The Court therefore required him to disclose the name of any AI tool he had used in connection with confidential information. V2X needed that information to assess whether confidential information had been compromised.
- On the second question, the Court amended the protective order to address AI use. It did not simply accept either party’s proposed language. Instead, it crafted its own AI-specific provision. The amended order provided that no party or authorised recipient may input, upload or submit confidential information into any modern AI platform, including generative, analytical or large language model-based tools, unless the AI provider is contractually prohibited from storing or using inputs to train or improve the model, and from disclosing inputs to third parties except where necessary for service delivery. Where such disclosure is necessary, the third party must be bound by obligations no less protective than the order. The AI provider must also contractually allow removal or deletion of confidential information on request, and a party intending to use such AI must retain written documentation of the contractual protections.
- The Court also explained the practical effect of the amended order: Morgan could not upload, input or submit confidential information into mainstream AI tools unless the required safeguards were satisfied. The Court acknowledged that this may place the pro se plaintiff at a relative disadvantage, but held that it could not ignore the real risks associated with compromising confidentiality.
- The significance of Morgan lies in how it reads Heppner and Warner together. Like Warner, it recognises that a pro se litigant’s AI-assisted litigation work may be protected as work product because it may reflect the litigant’s own mental impressions and preparation. Unlike Heppner, the Court was not asking whether AI had been used at counsel’s direction, because Morgan had no counsel. But Morgan also shows that work product protection does not answer every AI question. The identity of the AI tool may still have to be disclosed where confidential information is involved, and the opposing party needs to assess whether the protective order has been compromised.
- Here, the plaintiffs were authors who alleged that OpenAI had used their copyrighted works to train ChatGPT and that ChatGPT could generate outputs summarising their books. As part of their case, the plaintiffs had referred to certain ChatGPT prompts and outputs that supported their allegations. OpenAI then sought broader discovery of the plaintiffs’ ChatGPT testing, including prompts and outputs that did not reproduce, summarise, or otherwise support the plaintiffs’ claims.
- The discovery dispute first went against the plaintiffs. The magistrate judge ordered production of OpenAI account information for the individuals who used ChatGPT to investigate the claims, the prompts and outputs for the plaintiffs’ pre-suit testing of ChatGPT, including negative or non-supportive testing, and documentation of the testing process. The plaintiffs sought relief from that order before the district judge.
- The plaintiffs’ case was that the undisclosed prompts and negative test results were protected by the work product doctrine. They argued that the prompts were not merely factual testing data, but reflected counsel’s choices about how to interrogate ChatGPT in order to assess and support the copyright claims. OpenAI’s position was that the material was discoverable because the plaintiffs had relied on some prompt-output pairs in their pleading, and the broader testing history was necessary to test those allegations.
- The district judge granted the plaintiffs’ motion for relief. The Court held that the earlier production order had misapplied work product law. It reasoned that the ChatGPT prompts were “queries crafted by counsel” and contained counsel’s “mental impressions and opinions” about how to interrogate ChatGPT in an effort to vindicate the plaintiffs’ copyright claims. The Court therefore treated the prompts as opinion work product, not merely factual material.
- The Court also addressed waiver. It accepted that the plaintiffs had to disclose the prompts, outputs and account settings used for the positive testing results referred to in the complaint. However, it refused to extend that waiver to all negative testing results and documentation of the testing process. The Court noted that defendants had not shown that counsel’s mental impressions were at issue or that there was a compelling need for the material.
- The significance of Tremblay is that it treats AI prompts as potentially more than inputs into a machine. Where prompts are crafted by counsel as part of a legal investigation, they may disclose counsel’s theory of the case, testing strategy, and judgment about what matters.
- In the UK, this issue arose before the Upper Tribunal, Immigration and Asylum Chamber, in its “Hamid jurisdiction”. The Hamid jurisdiction refers to the court’s or tribunal’s power to supervise the conduct of legal representatives appearing before it and, where necessary, refer professional misconduct or serious professional failings to the relevant regulator. The judgment dealt with two proceedings. While the broader decision concerned AI hallucinations, false authorities and supervision duties, the privilege issue appears to have arisen materially only in the first matter.
- The Tribunal considered the matter against the background of the recent decision in R (Ayinde) v London Borough of Haringey, where the Court had addressed the use of AI-generated or suspected AI-generated false authorities in court filings. In Ayinde, the Court warned that legal representatives remain responsible for checking the accuracy of authorities and submissions placed before the court, even if AI tools were involved. The Upper Tribunal in this case referred to this authority while considering the professional consequences of AI use and inadequate supervision.
- For present purposes, the important issue is narrow: what happens to confidentiality and legal professional privilege when confidential client material is uploaded into an open-source AI tool. In the first matter, confidential client documents, including client letters and decision letters, had been put into ChatGPT for summarisation. The Tribunal observed that putting client letters and decision letters into an open-source AI tool such as ChatGPT is equivalent to placing that information on the internet in the public domain. On that basis, it stated that such conduct breached client confidentiality and waived legal privilege.
- This case appears to be the first English court or tribunal decision to directly address the implications for legal professional privilege where confidential or privileged material is uploaded into AI tools. The Tribunal’s observation on privilege appears to have been made in fairly broad and conclusory terms. The Tribunal appears to have treated uploading material into ChatGPT as equivalent to placing it in the public domain, without really engaging with how different AI platforms work, what their terms say, whether training is enabled, whether data is retained, or whether the tool is an enterprise/closed deployment. On the other hand, the US decisions have attempted a more granular analysis: AI as a tool, waiver to an adversary, LLM training/data-retention concerns, counsel-supervised use, and prompts as mental impressions/work product. This makes the Tribunal’s decision important but not the final word on how privilege applies across different AI platforms.
- The emerging jurisprudence suggests that courts are not discarding established privilege principles merely because generative AI has entered legal and commercial decision-making. Rather, they are testing those principles against new factual patterns: prompts, outputs, AI-generated summaries, platform terms, user histories and the movement of confidential information through AI systems. This is where the difficulty lies. Privilege was built around human relationships and recognised legal functions — lawyer and client, counsel and agent, litigation preparation, confidentiality and professional accountability. Generative AI unsettles each of these assumptions because it can operate as software, third-party infrastructure, drafting assistant, research tool, or, in some circumstances, a counsel-supervised instrument. For now, AI is new, but privilege is not. The open question is whether existing doctrines can remain stable as legal enquiry increasingly moves through machine-mediated systems, or whether courts will eventually be asked to recognise a more tailored framework for AI-assisted legal work.
Author: Lakshay Arora & Prateek Bagaria
[1] United States of America v. Bradley Heppner Case1:25-cr-00503-JSR (17 February 2026)
[2] Sohyon Warner v. Gilbarco, Inc., (d/b/a Gilbarco Veeder-Root), and Vontier Corporation Case No. 2:24-cv-12333 (10 February 2026)
[3] Archie Morgan v. V2X, Inc., Civil Action No. 25-cv-01991-SKC-MDB (30 March 2026)
[4] Paul Tremblay, et al., v. Open AI Inc., et al. 2024 WL 3748003 (8 August 2024)
[5] UK (anonymity order made) v SoS for the Home Department & R (on the application of Munir) v. SoS for the Home Department [2026] UKUT 00081 (IAC)