Attorney-client privilege generally protects confidential communications between lawyer and client for legal advice. Work-product protection covers materials prepared in anticipation of litigation, typically by or for counsel. AI raises a simple question for both: was confidentiality kept, and who directed the work?
The risk
If privileged material is shared with a third party in a way that isn't confidential, privilege can be waived. A consumer AI tool whose terms allow the provider to train on, review or disclose your data looks a lot like that third party.
The first court answer
In United States v. Heppner (S.D.N.Y., February 2026), Judge Jed Rakoff held that documents a criminal defendant created with the consumer version of an AI tool, to prepare his defence before indictment, were protected by neither privilege nor work product. The court's reasons:
- the AI is not a lawyer, so the exchange was not a lawyer-client communication;
- the tool's terms allowed the provider to use prompts for training and to disclose data, so there was no reasonable expectation of confidentiality;
- the defendant acted on his own, not at counsel's direction, which defeated work product.
The court suggested the analysis could differ where counsel directs the use, for example under a Kovel-type arrangement, and where the tool keeps data confidential.
Practical protections
- Use enterprise tools with no-training, confidentiality and limited-retention terms for privileged work.
- Use AI at the direction of counsel on privileged matters, and record that direction.
- Label AI-assisted work product and limit access to the matter team.
- Tell business colleagues not to "ask the AI" about legal problems in consumer tools; it may create discoverable, unprivileged documents.
- Consider privilege in AI logs: prompts and outputs are stored somewhere and may be discoverable.