As clients and lawyers increasingly turn to generative AI tools to enhance legal work, an important question arises: under what circumstances might the resulting materials remain protected, or lose the protections, of attorney-client privilege and the work product doctrine? This alert examines how some U.S. courts have begun to answer that question and identifies steps that clients should consider taking to reduce the risk that protections are not inadvertently lost.
Two recent U.S. federal court decisions illustrate how the use of AI can lead to different outcomes on privilege and work product. On 10 February 2026, the United States District Court for the Eastern District of Michigan in Warner v. Gilbarco, Inc. denied a motion to compel production of documents that a self-represented litigant had prepared using a public AI chatbot, finding that work product protection applied. A week later, on 17 February 2026, the United States District Court for the Southern District of New York in United States v. Heppner reached the opposite result, ordering a criminal defendant to produce documents he had generated using another public AI chatbot while seeking legal advice. Together, these decisions underscore that how a party engages with generative AI can determine whether privilege and work product protections survive.
Public AI chatbot use undermines privilege and work product protections
As a general rule, under U.S. law, parties may obtain discovery of any nonprivileged information that is relevant to a claim or defense and proportional to the needs of the case. Key limitations on discoverability include attorney-client privilege, which protects communications between a client and their attorney for the purpose of obtaining or providing legal advice, and the work product doctrine, which protects materials prepared by or at the behest of counsel in anticipation of litigation. These protections may also apply in the context of document production in international arbitration.
In United States v. Heppner,1 the United States District Court for the Southern District of New York held that documents a criminal defendant prepared by prompting an AI chatbot, in its publicly available consumer version, in connection with a pending criminal fraud investigation, were not protected by attorney-client privilege or the work product doctrine.
The Court observed that attorney-client privilege generally attaches to communications (i) between a client and their attorney, (ii) made in confidence, (iii) for the purpose of obtaining or providing legal advice. The Court determined that the defendant's AI documents failed to satisfy at least two, if not all three, of these elements.
- The defendant's AI documents were not the product of communication between a client and their attorney. The Court held that "all recognized privileges require, among other things, a trusting human relationship, such as, in the attorney-client context, a relationship with a licensed professional who owes fiduciary duties and is subject to discipline."2
- No privilege could be asserted because the communications were not confidential. The Court noted that the defendant communicated with the AI chatbot, whose privacy policy permits the collection of data from users' inputs and outputs and reserves the right to disclose such data to a host of third parties, including governmental regulatory authorities. The Court reasoned that users cannot expect privacy or confidentiality when sharing information with a public AI chatbot that retains their data in the ordinary course of its operations.3
- The Court concluded that the defendant did not communicate with the AI chatbot for the purpose of obtaining legal advice, as the AI chatbot "disclaims providing legal advice."4 The court added, however, that "[h]ad counsel directed Heppner to use [the AI chatbot], [the AI chatbot might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege."5
Accordingly, in Heppner, the communications between the defendant and the AI chatbot failed to satisfy the elements necessary to establish attorney-client privilege. The fact that the defendant later shared the results of his chatbot communications with his counsel did not retroactively "cloak" them with privilege.6
Turning to the work product doctrine, the Heppner Court determined that the defendant's AI documents were not prepared by or at the behest of counsel in anticipation of litigation or for trial, nor did they reflect defense counsel's litigation strategy.7 Because counsel had not directed the defendant to consult the AI chatbot, neither the defendant nor Claude could be considered agents of counsel.8 The AI documents were therefore not entitled to work product protection.
In Warner v. Gilbarco, Inc., the United States District Court for the Eastern District of Michigan denied a motion to compel the production of documents prepared by a self-represented litigant using an AI chatbot.9 As a self-represented litigant, the plaintiff acted as their own counsel and was entitled to assert work product protection over materials prepared for trial. The defendants argued that the plaintiff had waived this protection by sharing information with the AI chatbot, a third party. However, while disclosure to a third party outside of a protected relationship is sufficient to waive attorney-client privilege, work product protection is waived only by disclosure to an adversary or in a manner that makes it likely the materials will reach an adversary. Accordingly, the Court held that materials prepared by litigants using AI chatbots can receive work product protection where the traditional elements are satisfied and the materials are not disclosed to an adversary.10 This decision is consistent with other cases recognizing that legal research, searches, and queries conducted through search engines and legal research platforms by lawyers can constitute protected work product.
Controlled, confidential, counsel-directed AI use may preserve protections
While the Heppner and Warner decisions illustrate the risks of AI chatbot use, they also offer some guidance for preserving privilege and work product protections.
The reasoning in Heppner indicates that where a client uses an enterprise-grade AI platform that prohibits the retention and disclosure of user data to third parties, and does so at the direction of legal counsel, the resulting communications are more likely to satisfy the elements of the privilege analysis. Clients who wish to use AI chatbots for legal matters should therefore consider avoiding public AI chatbots and ensuring that any such use is undertaken in consultation with counsel. Clients may also want to implement internal policies governing when and how AI may be used for legal work, including guidance on platform selection, confidential data handling, and the role of legal counsel in overseeing AI-assisted work.
White & Case uses enterprise-grade AI platforms, including Atlas (the Firm's proprietary AI assistant) and Legora, that operate under strict security protocols and confidentiality controls, including prohibitions on the use of client data for training purposes and restrictions on data retention. These safeguards are designed to protect clients' confidential information and help ensure that materials produced with AI assistance remain confidential and protected.
Ernesto Torres (International Arbitration Fellow, White & Case) contributed to the development of this publication.
Further related insights:
- For an overview of how these principles apply under EU law, see our related alert 'Navigating legal professional privilege under EU law in the age of AI'
- For related considerations under English law, see our related alert 'Five things you should know about GenAI and Litigation'
- For related discussions of how AI tools intersect with privilege in the context of board meetings and corporate governance, see our earlier alerts, 'AI in the boardroom: Privilege and recording decisions' and 'When every word is recorded: AI meeting tools and the new governance risks'
1 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479 (SDNY Feb. 17, 2026).
2 See United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *2 (SDNY Feb. 17, 2026).
3 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *4 (SDNY Feb. 17, 2026) ("[T]he communications memorialized in the AI Documents were not confidential. This is not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent provides that Anthropic collects data on both users' 'inputs' and Claude's 'outputs,' that it uses such data to 'train' Claude, and that Anthropic reserves the right to disclose such data to a host of 'third parties,' including 'governmental regulatory authorities.'").
4 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *3 (SDNY Feb. 17, 2026) ("[B]ecause Heppner communicated with Claude of his own volition, what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude's outputs with counsel. And Claude disclaims providing legal advice.") (underlining in original).
5 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *3 (SDNY Feb. 17, 2026).
6 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *3 (SDNY Feb. 17, 2026) ("Moreover, even assuming that Heppner intended to share these communications with his counsel and eventually did so, it is black-letter law that non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel.").
7 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *3 (SDNY Feb. 17, 2026). ("The AI Documents do not merit protection under the work product doctrine because, even assuming, arguendo, that they were prepared in anticipation of litigation, In re Grand Jury Subpoenas, 318 F.3d at 383, they were nevertheless not prepared by or at the behest of counsel, id., nor did they reflect defense counsel's strategy, see Matter of Grand Jury Subpoenas, 959 F.2d at 1167.") (Internal quotations omitted).
8 United States v Heppner, 25 CR. 503 (JSR), 2026 WL 436479, at *3 (SDNY Feb. 17, 2026) ("Heppner's counsel confirmed that the AI Documents were prepared by the defendant on his own volition. . . . That means that Heppner was not acting as his counsel's agent when he communicated with Claude.") (Internal quotations omitted).
9 Warner v Gilbarco, Inc., 2:24-CV-12333, 2026 WL 373043, at *4 (ED Mich Feb. 10, 2026).
10 Warner v Gilbarco, Inc., 2:24-CV-12333, 2026 WL 373043, at *4 (ED Mich Feb. 10, 2026) ("Moreover, to the extent Defendants argue that Plaintiff waived the work-product protection by using ChatGPT, the work-product waiver has to be a waiver to an adversary or in a way likely to get in an adversary's hand.")
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2026 White & Case LLP
