Privilege, Work Product, and AI: A 2026 Doctrinal Map#
TL;DR
- The doctrine has not changed. Hickman, Upjohn, and Kovel still control. The federal cases reshaping AI discovery are applying existing elements to a new artifact, not inventing new law.
- Heppner’s privilege holding is contested. Its work product holding is not. The Harvard Law Review and a Wall Street Journal op-ed both argue Judge Rakoff misapplied privilege doctrine. Neither seriously challenges the work product holding.
- The Heppner / Gilbarco split is really about characterization. Consumer AI looks more like a Google search than a word processor — and the terms of service settle the question. The same model deployed locally would fall on the other side of the line.
- Waiver cuts both ways. Producing favorable AI prompts while withholding the rest triggers subject-matter waiver. Concord Music held that selective disclosure of attorney-directed prompts cost the plaintiffs the protection over related work.
- Tell your clients now, not after. Anything typed into a consumer AI tool should be treated as a contemporaneous record someone else owns. Engagement letters need updating this quarter.
Federal courts are working out, in real time, how attorney-client privilege and work-product doctrine apply to AI prompts. What is changing is how courts characterize the artifact: what the AI tool is doing in the user’s workflow, and what the vendor is doing with the data. The disagreements among the federal cases trace back to that characterization question.
The doctrine#
Attorney-client privilege. Under Upjohn v. United States, 449 U.S. 383 (1981), and the state-law variants that mirror it, the elements are: (1) a communication; (2) between attorney and client; (3) for the purpose of obtaining legal advice; (4) made in confidence; and (5) by a client who intended to maintain that confidence. Disclosure to a third party who is not within the privilege circle generally destroys the privilege.
Under United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), the privilege also covers communications with a non-attorney agent retained by the lawyer to facilitate the legal advice — the canonical example is the accountant retained by counsel to help her understand the client’s financial records. Kovel is narrow: the agent must be acting at the attorney’s direction, in confidence, in furtherance of legal advice. The doctrine has historically been applied to non-attorney persons — accountants, tax consultants, translators, public-relations consultants, cybersecurity firms in the data-breach cases — not to software.
Work product. The work-product doctrine is older — it traces to Hickman v. Taylor, 329 U.S. 495 (1947), and is codified at Federal Rule of Civil Procedure 26(b)(3). It protects materials prepared in anticipation of litigation, typically by or at the direction of counsel. The doctrine has two flavors: fact work product, which is qualified protection (discoverable on a showing of substantial need and undue hardship) and opinion work product, which contains “the mental impressions, conclusions, opinions, or legal theories of an attorney” and is, in the Ninth Circuit’s phrasing, “virtually undiscoverable.”
Work product tolerates more third-party exposure than privilege does — limited disclosure to a third party waives the protection only if it substantially increases the risk of adversary access. Work product can also be waived by selective disclosure: a party that uses work product as a sword in litigation cannot raise the shield over related material. That is the doctrine of subject-matter waiver.
In Tremblay v. OpenAI (N.D. Cal. Aug. 8, 2024), authors including Sarah Silverman and Michael Chabon sued OpenAI for training ChatGPT on their copyrighted books. Their lawyers had spent months prompting ChatGPT to test whether the model had memorized protected expression. When OpenAI sought production of all the prompts and outputs, District Judge Araceli Martínez-Olguín held that the attorneys’ prompts were “queries crafted by counsel and contain[ed] counsel’s mental impressions and opinions about how to interrogate ChatGPT,” making them opinion work product under Rule 26(b)(3)(B). The technology was new; the doctrinal analysis was familiar. Tremblay is now the foundational ruling for the protected side of the AI-prompt doctrine.
Heppner: privilege denied, work product denied#
In United States v. Heppner (S.D.N.Y. Feb. 17, 2026), Judge Jed Rakoff confronted the doctrine on the unprotected side. Bradley Heppner, a financial-services CEO charged with securities fraud, used Anthropic’s Claude before his arrest to generate 31 case-strategy memoranda analyzing the government’s investigation. He then shared the memoranda with his defense team at Quinn Emanuel and claimed both attorney-client privilege and work-product protection. Rakoff rejected both — and his signature line will be quoted in every AI-discovery brief for the next five years: “non-privileged communications are not somehow alchemically changed into privileged ones upon being shared with counsel.”
The privilege holding rests on three findings. First, the relevant communication was between Heppner and Claude, not between Heppner and his attorney. Second, Claude expressly disclaims providing legal advice, and there is no attorney-client relationship between a defendant and a piece of software. Third, Anthropic’s terms of service permit retention, training on inputs, and disclosure to third parties, defeating the confidentiality element.
The work product holding is narrower. Work product under Rule 26(b)(3) protects materials prepared “by or at the behest of counsel in anticipation of litigation.” Heppner created the memoranda on his own initiative — and materials a client generates without attorney direction do not qualify, whether produced by hand, by typewriter, by Word, or by Claude.
Elizabeth X. Guo’s Harvard Law Review blog critique (March 2026) targets the privilege holding. The HLR’s central argument is that Rakoff asked the wrong privilege question. He framed the test as whether Heppner “intended to obtain legal advice from Claude.” The correct question under existing doctrine, the HLR argues, is whether Heppner intended to use Claude to facilitate obtaining legal advice from his attorney. Courts have long recognized that a client’s self-directed notetaking can be privileged when undertaken to facilitate counsel’s advice — lists of questions for the lawyer, agendas for client meetings, sets of reminders. By collapsing the privilege test into “did the user seek legal advice from the AI,” Rakoff effectively excluded all client AI use from privilege, when a more fact-dependent analysis would protect at least some uses — for example, the AI prompt that organizes a client’s questions for an upcoming meeting with counsel.
Bridget Mary McCormack and Shlomo Klapper’s Wall Street Journal op-ed (April 6, 2026) makes the same point in popular-press terms. Rakoff treated AI like a person — a third party for privilege purposes. But, the op-ed argues, AI is not a person. It cannot be deposed, called as a witness, or made to betray a confidence. The third-party-disclosure risks that animate privilege doctrine “don’t exist when the ’third party’ is a statistical model running on a server.” Typing into ChatGPT, the op-ed contends, is “no different from typing into a cloud-based software, such as Google Docs.” The relevant question is not whether Google Docs creates privilege; it is whether Google Docs destroys privilege — and no one thinks it does.
Both critiques lean on a parallel to cloud tools — Gmail in the HLR, Google Docs in the WSJ — to argue that AI use should not waive privilege any more than email or document storage does. The parallel is incomplete. Cloud storage works as a privilege exception because the vendor’s contractual role is limited to transmission and storage. But the harder question the op-ed doesn’t directly address: consumer AI platforms use inputs to train their models. That is not analogous to Google Docs. It is a genuinely different privacy profile — one that cuts against a reasonable expectation of confidentiality. Anthropic and OpenAI both permit retention, training on inputs, employee review, and disclosure to third parties under their consumer terms. That contractual difference is the gap the cloud-parallel critique skips over — the gap the characterization analysis below develops.
Gilbarco: the same week, the opposite result#
On the same day Rakoff ruled, Magistrate Judge Anthony Patti in the Eastern District of Michigan reached the opposite conclusion. In Warner v. Gilbarco (E.D. Mich. Feb. 17, 2026), a pro se employment-discrimination plaintiff had used ChatGPT to organize her case materials. The defendants moved to compel her ChatGPT logs in discovery, arguing — by analogy to Heppner — that disclosure to OpenAI had waived any work-product protection.
Patti rejected the argument. He treated the AI as “a tool, not a third person,” analogous to a word processor or a calculator. The plaintiff’s interactions with ChatGPT, in his framing, were her own internal mental processes captured in software, not communications to a third party. Forcing production, he wrote, would “nullify work-product protection in nearly every modern drafting environment, a result no court has endorsed.”
The two opinions look like a circuit split. They are widely framed as a disagreement about what Claude is — a third-party “interlocutor” in Rakoff’s analysis, an “instrumental aid” or “high-tech drafting pen” in Patti’s.
What is an AI prompt, doctrinally?#
The disagreement looks metaphysical — what is Claude? — but it is functional: what is the AI doing in the user’s workflow, and what is the vendor doing with the data. Lawyers already answer that kind of question routinely for other digital tools, just without thinking of it as a privilege question.
Lawyers store privileged client documents on Google Drive, Dropbox, and Microsoft 365 every day, and no one argues that doing so waives privilege. Cloud storage is functionally characterized as infrastructure — a passive digital locker where the provider has a contractual duty to host data without consuming its substance. Similarly, no one argues that running a Westlaw search waives anything: a search engine is a research tool, an automated index, with no “communication” between user and provider in any privilege-relevant sense.
Consumer AI is closer to a Google search than to a word processor. When a user types a query into ChatGPT through the public web app, the input travels to OpenAI’s servers, where it may be retained, used for training, reviewed by employees, and produced under legal process. That is the data flow of a search engine plus active consumption — not a word processor. Microsoft Word does not transmit your draft to Microsoft. Cleartext stays on your machine. ChatGPT does more than transmission and storage; it consumes the input.
Locally-run AI is closer to Word than to a Google search. A truly local LLM — running on the firm’s own hardware, with no vendor in the loop — is, functionally, a word processor with autocomplete. No transmission, no third party, no disclosure. Gilbarco’s typewriter analogy works for this deployment, and only this deployment. Patti’s mistake in Gilbarco was applying the analogy to ChatGPT, which is not a typewriter.
The same model can therefore fall on different sides of the line depending on how it is deployed. ChatGPT through the public web app, on a free or consumer tier, with default training enabled — that is Heppner. The same model accessed through an API with a zero-data-retention contract or an enterprise deployment with no training on inputs — that is much closer to Google Drive.
The technology has not changed. The contract has.
A properly contracted enterprise AI deployment satisfies both privilege elements. First, the communication is for the purpose of obtaining legal advice: the client is using the tool to organize questions for counsel, outline a complex transaction, or prepare materials that will feed into the attorney-client relationship. That is exactly the purpose the HLR critique argued Heppner should have recognized. Second, confidentiality is preserved: the contract limits the vendor to transmission and storage (zero data retention, no training on inputs, no employee review except for service provision, no third-party disclosure), so the vendor never consumes the substance of the communication. Lawyers store privileged documents on Google Drive and run research queries on Westlaw every day without anyone arguing privilege is destroyed — because both elements are satisfied. An enterprise AI deployment under the same contractual constraints satisfies them for the same reasons.
Heppner failed both. The consumer deployment consumed the input (confidentiality destroyed), and Rakoff framed the purpose as “obtaining legal advice from Claude” rather than facilitating advice from counsel (purpose element collapsed). A properly structured enterprise deployment avoids both failures without reaching for Kovel.
Kovel remains relevant for the narrower case where AI does work akin to a consultant’s — not research or drafting, but participating in the attorney-client relationship itself. An AI note-taking tool that records and summarizes a privileged legal meeting, an AI platform that interprets client financial records for the lawyer, a system that listens to client interviews and extracts case facts — these deployments look less like Westlaw and more like the accountant in Kovel or the translator in its progeny. Whether a software tool can be a Kovel agent is the harder question Rakoff opened in dictum. Heppner’s hedged language — “Claude might arguably be said to have functioned in a manner akin to a highly trained professional” — is the only judicial gesture toward an answer. Practitioners deploying AI in that consultant-like role are betting on dictum. Practitioners deploying AI to facilitate obtaining legal advice, under contracts that preserve confidentiality, are not.
Waiver: the cost of using your own AI logs#
The leading case is Concord Music Group, Inc. v. Anthropic PBC (N.D. Cal. May 23, 2025). Music publishers sued Anthropic for copyright infringement, alleging that Claude reproduced lyrics from their copyrighted songs. Their lawyers had spent months prompting Claude to test for reproduction. They produced 5,000 prompt-output pairs they relied on in alleging infringement. They refused to produce the rest of their prompts and outputs.
Anthropic moved to compel everything. Following Tremblay, the court agreed that the prompts and outputs were attorney work product. But the Concord Music court found that the plaintiffs had partially waived the protection by placing a subset of the prompts in the complaint. That is classic doctrine: a party that uses work product as a sword cannot then raise the shield over related material on the same subject.
In any litigation where chat logs are themselves the evidence — copyright cases against AI companies, but also product-liability cases against Character.AI, defamation cases involving AI-generated content, employment cases turning on AI-driven decisions — the prompts cut in both directions. A plaintiff who selectively produces favorable AI logs while withholding the unfavorable ones is in subject-matter-waiver territory. A defendant who tries to authenticate one chat thread while objecting to production of the rest is in the same place.
Anthropic’s own fair-use defense in Concord Music puts the point in concrete terms. Anthropic told the court that in a 5-million-prompt sample analyzed in discovery, more than 83% of the lyric reproductions used as evidence of infringement were generated by the plaintiffs themselves or their agents — attorney-directed prompts engineered to provoke Claude into producing copyrighted content. Whether the court accepts that argument is an open question.
What this all means#
The categories already exist, and they are functional. Cloud storage, search engines, email, litigation-support vendors, e-discovery platforms — all are third-party services that interact with privileged or work-product material in established ways. The right question for AI is not “is this technology special?” but “which of the existing categories does this deployment fit?” For consumer AI through a public web app, the answer is “search engine plus content generation, with active vendor consumption of inputs” — which means Heppner’s third-party-disclosure analysis is approximately right, even if the privilege framing the HLR critiques is approximately wrong. For locally hosted AI under firm control, the answer is “word processor with autocomplete” — and Gilbarco’s tool analogy fits. For enterprise AI under a zero-data-retention contract, the use is not privilege-destroying at all — the communication is for the purpose of facilitating legal advice and confidentiality is contractually preserved, the same reason Google Drive and Westlaw don’t implicate privilege.
Terms of service do most of the work. Whether an AI tool is a third-party recipient or a transmission-and-storage utility turns on what the contract says the vendor will do with the inputs. The contract is the doctrinal artifact a court will examine.
What to tell your clients#
Do not let clients “think out loud” to a chatbot during active litigation. Clients use ChatGPT the way they used to use journals — to process, to vent, to test theories. Journal entries have always been discoverable; clients knew that. Chatbot conversations feel more ephemeral and are not. The “I shared it with my lawyer afterward” defense fails Kovel: privilege requires contemporaneous confidentiality, and the confidentiality is gone the moment the user types into a consumer AI tool whose terms permit retention, training, or third-party disclosure. Heppner is the controlling authority on this point in the Second Circuit and the persuasive authority everywhere else.
For enterprise AI, structure the deployment so it isn’t privilege-destroying. A client prompting an enterprise legal AI tool selected by the firm, under instructions from counsel, with a contract that limits the vendor to transmission and storage (zero data retention, no training on inputs, no employee review except for service provision), satisfies both elements: the communication is for the purpose of facilitating legal advice, and confidentiality is preserved. That is the same reason Google Drive and Westlaw don’t destroy privilege. Kovel is a backup theory for the narrower case where AI participates in legal-advice formation rather than facilitating the attorney-client relationship, and that theory rests on Rakoff’s Heppner dictum, untested in any holding. A client venting to ChatGPT has none of these protections — Heppner controls. The products covered in The Tools include enterprise deployments built for this.
Send a litigation-hold letter that names AI tools by name. Standard ESI hold language about “electronic communications” can be argued not to encompass AI chat logs. Specifically naming ChatGPT, Claude, Gemini, Copilot, Perplexity, Character.AI, and Replika removes that ambiguity.
Ask, in discovery, what the other side asked the chatbot. If your opposing party has been using consumer AI tools to prepare their case, those conversations may contain admissions, contradictions, or strategy revelations that no other discovery vehicle will surface. Several family lawyers report serving requests for production specifically targeting AI chat logs as a routine matter starting in Q1 2026. Even attorney-directed prompts cut both ways under subject-matter waiver — Concord Music.
Further Reading#
- United States v. Heppner, No. 25-CR-00503 (S.D.N.Y. Feb. 17, 2026). Judge Rakoff’s written opinion denying privilege and work-product protection over AI-generated documents.
- Warner v. Gilbarco, Inc. (E.D. Mich. Feb. 17, 2026). Magistrate Judge Patti’s opinion treating AI as “a tool, not a third person.”
- Tremblay v. OpenAI, Inc. (N.D. Cal. Aug. 8, 2024). The foundational ruling holding attorney-crafted AI prompts are opinion work product.
- Concord Music Group, Inc. v. Anthropic PBC (N.D. Cal. May 23, 2025). Subject-matter waiver applied to selectively disclosed AI prompts.
- Elizabeth X. Guo, United States v. Heppner, Harvard Law Review Blog (March 2026). The critique that Rakoff asked the wrong privilege question.
- Bridget Mary McCormack & Shlomo Klapper, “A Judge Mistakes the Claude Chatbot for a Person,” Wall Street Journal (April 6, 2026). The op-ed arguing AI is infrastructure, not an interlocutor.
- ABA Formal Opinion 512 (July 2024). ABA guidance on lawyer competence and AI.
- Heppner and Gilbarco: Courts Apply Privilege and Work Product Protection to Generative AI Tools (Perkins Coie). Practitioner analysis reconciling the two opinions.
This is a standalone post on LegalRealist AI. It is intended for informational and educational purposes only and does not constitute legal advice. Court rulings, vendor policies, and discovery practices described here reflect publicly available information as of the publication date and are subject to change. Laws governing discovery, privilege, and evidence vary by jurisdiction.