Recent AI and attorney-client privilege rulings raise new legal questions

Summary

• Federal court rules AI communications not protected by privilege.
• Case centers on defendant’s use of Claude during investigation.
• Court finds lack of confidentiality and attorney involvement.
• Contrasting ruling in Warner highlights evolving AI legal standards.

A federal judge’s ruling that a criminal defendant’s use of a consumer-grade artificial intelligence platform did not qualify for attorney-client privilege or work product protection is prompting attorneys to reassess how client interactions with emerging technology may be treated in litigation.

The government in U.S. v. Heppner sought a determination that prosecutors could access written communications the defendant exchanged with the AI platform Claude, arguing those materials were not shielded by either the attorney-client privilege or the work product doctrine.

The defendant used the AI tool after receiving a grand jury subpoena and after becoming aware he was the target of a criminal investigation.

U.S. District Judge Jed S. Rakoff of the Southern District of New York granted the government’s motion, first in a Feb. 10 bench ruling and later in a written opinion issued Feb. 17.

In that opinion, Rakoff described the issue as a question of first impression: whether communications with a publicly available AI platform in connection with a criminal investigation are protected by attorney-client privilege or the work product doctrine.

The court concluded they are not.

In rejecting the defendant’s arguments, Rakoff emphasized that traditional legal principles governing privilege still apply, even when newer technologies are involved.

“AI’s novelty does not mean that its use is not subject to longstanding principles, such as those governing the attorney-client privilege and the work product doctrine,” Rakoff wrote. “Because Heppner’s use of Claude fails to satisfy either of these rules, the AI documents do not merit the protections Heppner has claimed.”

Attorney-client privilege is traditionally rooted in a confidential, fiduciary relationship between an attorney and client, a framework that courts may be reluctant to extend to interactions with consumer AI tools that lack those professional obligations.

Attorneys say the ruling reflects how courts are beginning to apply existing privilege doctrines to emerging technology.

Jenni McCarty, vice chair of Baker Donelson’s labor and employment group, said the decision is one of the first meaningful indicators of how courts are likely to approach AI use in litigation going forward.

“I think what’s so significant is that we’re just now getting some sense of how the courts are going to handle the use of AI by parties in cases, whether it’s criminal or civil, and how they’re going to treat it with respect to attorney-client privilege and work product,” McCarty said. “Because we know everybody’s using AI right now, but people forget that they could potentially be waiving privilege or work product and facing the risk of having their searches and results be discoverable.”

McCarty said the risks are not just theoretical, pointing to how easily client behavior can create problematic evidence in litigation.

“I think about, like, what if a manager types into ChatGPT, ‘How do I fire a pregnant person?’” she said. “That wouldn’t be a great thing to turn up in litigation.”

What happened in Heppner

Heppner stems from a criminal prosecution in which the defendant, an executive of a publicly traded company, was accused of defrauding investors through misrepresentations and transactions involving companies under his control. After he was indicted and federal agents executed a search warrant at his home, among the materials seized were approximately 31 documents reflecting his communications with the AI platform that were all created after he received a grand jury subpoena and knew he was a target of the investigation.

Defense counsel argued the materials were prepared in anticipation of litigation and were intended to help develop a defense strategy. Following that assertion, prosecutors agreed to segregate the materials until the court could determine whether they were protected.

In opposing the privilege claim, the government argued that the communications did not qualify because they were not between the defendant and his attorneys.

“[O]utside of certain narrow exceptions not relevant here, the attorney-client privilege does not attach to non-attorney communications,” Assistant U.S. Attorney Alexandra N. Rothman wrote. “The defendant’s use of the AI tool here is no different than if he had asked friends for their input on his legal situation.”

Rothman also argued that the work product doctrine did not apply because the defendant had not acted at the direction of counsel in creating the materials.

“Had counsel directed the defendant to run the AI searches, the analysis might be different,” she wrote. “But the defendant elected to run his own AI searches and then shared the outputs of those searches with counsel.”

Attorneys say that distinction — whether a client acts independently or at the direction of counsel — is likely to become increasingly important as courts continue to evaluate AI-related privilege issues.

Tyler Coe, an ethics lawyer with Dentons, said the Heppner ruling reinforces that independent use of AI can create real discovery risks for clients.

“Using AI on your own … can create discoverable evidence,” Coe said. “And the outcome can turn on whether an attorney has told their client to do something or whether the client acted independently.”

In its analysis, the Heppner court found that the materials failed to meet multiple requirements necessary for attorney-client privilege.

First, the court determined that the communications were not between the defendant and his attorneys.

“Because Claude is not an attorney, that alone disposes of Heppner’s claim of privilege,” Rakoff wrote.

Second, the court concluded that the communications were not confidential. It pointed to the platform’s privacy policy, which allows for the collection and use of both user inputs and outputs, as well as potential disclosure to third parties, including regulatory authorities.

“This is not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy … provides that [the company] collects data on both users’ ‘inputs’ and [outputs] … and reserves the right to disclose such data to a host of ‘third parties,’” Rakoff wrote.

The court also addressed whether the communications were made for the purpose of obtaining legal advice, describing that issue as a closer question. Ultimately, it concluded that the relevant inquiry was the defendant’s intent at the time of the communication, not whether the materials were later shared with counsel.

“Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned … as a lawyer’s agent,” Rakoff wrote. “But because Heppner communicated with Claude of his own volition, what matters … is whether Heppner intended to obtain legal advice from Claude.”

Taken together, those findings led the court to conclude that the communications were not protected by attorney-client privilege.

The court reached a similar conclusion regarding the work product doctrine.

Even assuming the materials were created in anticipation of litigation, Rakoff emphasized that they were not prepared by or at the direction of counsel and did not reflect counsel’s legal strategy at the time.

“The AI documents do not merit protection under the work product doctrine because … they were nevertheless not ‘prepared by or at the behest of counsel,’ nor did they reflect defense counsel’s strategy,” he wrote.

Attorneys say the ruling highlights the importance of attorney involvement in maintaining privilege protections.

McCarty said the issue is not just whether litigation is anticipated, but whether the client’s actions are tied to legal strategy directed by counsel.

“If the attorney didn’t direct the use, then it becomes much harder to argue work product,” McCarty said. “Because that usually, for a non-lawyer, needs to be done at the direction of a lawyer.”

Different conclusion reached in Warner

A separate federal ruling handed down Feb. 10 involving AI, privilege and work product protection  reached a different conclusion.

In Warner v. Gilbarco, the U.S. District Court of the Eastern Division of Michigan – Southern Division denied a motion to compel production of a pro se plaintiff’s AI-related materials, holding that the plaintiff’s AI-assisted internal analysis and mental impressions were protected as work product. The court found that materials prepared in anticipation of litigation may qualify for work product protection and that waiver depends on whether the information is disclosed to an adversary. The court noted “ChatGPT… [is a] tool[], not person[],” and applied adversary-disclosure waiver principles.

Dentons’ Amianna Stovall, a partner with the firm’s commercial litigation unit, said the different outcome in Warner was driven in part by the plaintiff’s status as a pro se litigant.

“Warner involved a pro se plaintiff, which means the plaintiff was effectively acting as their own counsel for purposes of the work product doctrine,” she said. “But the real issue between the two cases is that in Warner, AI was treated as a tool, not a third party receiving information.”

McCarty said the contrast between the two decisions highlights how courts are approaching AI differently depending on the context of its use.

“It’s kind of a different approach between the two different judges. One is seeing AI as kind of a third party, the other is viewing it as a tool,” McCarty said.

Coe said the two cases ultimately turn on the same two questions, applied to different facts.

“The true thing that was looked at was whether an attorney directed or supervised the AI use,” Coe said. “And then the second thing is whether the platform provided confidentiality.”

He said attorney involvement and the nature of the platform are likely to shape how future courts evaluate similar disputes.

The Warner opinion further emphasized that work product protection is not automatically waived by disclosure to a third party unless that disclosure is made to an adversary or in a manner likely to reach one, reinforcing a distinction between attorney-client privilege and the work product doctrine.

Future of AI and attorney-client privilege

The Heppner ruling has prompted attorneys to reconsider how they advise clients about the use of AI tools during litigation. The ruling places significant emphasis on confidentiality, particularly in the context of widely available AI platforms whose terms of service allow for the collection, storage and potential sharing of user data.

McCarty said the Heppner court focused heavily on how AI platforms handle user data, including the potential for disclosure to government agencies, and concluded there could be no reasonable expectation that communications would remain confidential.

Coe said the issue is also tied to how many AI tools operate economically.

“If you’re using something for free, you’re paying in data,” he said. “And so that’s very relevant when you’re thinking about confidentiality.”

Stovall said those risks make it critical for clients to understand how their information may be used.

“Clients need to remember that both their inputs and the AI outputs are potentially discoverable,” she said. “Because of that risk, it’s really important to put parameters around AI usage to avoid unforced errors amounting to privileged waivers.”

Stovall added that clients may be tempted to turn to AI seeking a quick and inexpensive answer, but that the short-term appeal can be deceptive. Any perceived benefit, she said, is likely to be outweighed by the motion practice and privilege challenges that can follow.

McCarty said attorneys are increasingly advising clients to avoid using AI tools without guidance, and some are beginning to include AI-use restrictions directly in engagement letters.

“The risk of it potentially being discoverable is just too high to allow them to do that,” McCarty said. “Lawyers are going to want to talk to their clients very early on and say, ‘You shouldn’t be using AI, you should come to me.’”

The differing conclusions in Heppner and Warner suggest that the legal framework governing AI use in litigation is still developing, with outcomes likely to depend heavily on the specific facts of each case. Stovall said the issue is likely to keep moving up the appellate chain until courts establish a more uniform standard.

“I think we are going to see differences of opinions from different courts, and so this is likely to be something that we’re going to see moving through the circuit courts and potentially up to the Supreme Court,” she said.

Coe said the core problem is one most people haven’t fully reckoned with is that what feels like a private thought exercise when using AI tools is anything but.

“Pretend I took everything from your phone — your emails, your notes, your documents — put it in a clear plastic tote and set it in the busiest park in your city with ‘read me’ written on it,” he said. “This is new technology … We don’t know how the case law will evolve.”