Privilege In The GenAI World – A Caution To Litigants (And Counsel)

The recent decision in United States v. Heppner offers an early judicial warning for litigants using public generative AI tools in active matters: a litigant's conversations about litigation with a publicly available generative AI tool may not be protected by privilege.¹ In what the court described as a new legal issue, the Southern District of New York held that a criminal defendant's exchanges with Anthropic's Claude were protected by neither attorney-client privilege nor the work product doctrine. While no reported Canadian decision has addressed the same fact pattern, Heppner is a useful prompt for Canadian counsel and clients to revisit privilege, confidentiality and the use of public AI in litigation.

Background

Bradley Heppner was indicted on securities fraud, wire fraud, conspiracy, false statements to auditors and falsification of corporate records arising from alleged misconduct at GWG Holdings. The indictment alleged that Heppner defrauded investors of more than US$150 million through false representations and undisclosed self-dealing transactions involving entities he controlled. After his arrest, the FBI executed a search warrant at his home and seized documents and devices. Among those materials were approximately 31 documents memorializing communications between Heppner and Claude. According to defence counsel, those exchanges occurred after Heppner had received a grand jury subpoena and after it was clear he was the target of the investigation.

Counsel argued that Heppner had prepared reports setting out defence strategy and arguments he expected the government might bring, and that he did so in anticipation of a potential indictment. Counsel also asserted that Heppner had input information learned from counsel and later shared the Claude-generated materials with counsel. However, his counsel conceded that Heppner had not been directed to run the Claude searches.²

The decision

Attorney-client privilege

The court rejected the privilege claim on three grounds.

First, Claude was not a lawyer. Communications were not between client and counsel and "that alone disposes" of the claim.³

Second, the communications were not confidential. The court relied on Anthropic's privacy policy, which stated that Anthropic collected user inputs and outputs, used them to train Claude, and could disclose them to third parties, including in connection with claims, disputes or litigation. In those circumstances, the court held Heppner had no "reasonable expectation of confidentiality" in his communications with Claude.⁴ (One wonders whether under different terms of use, the outcome on this issue may have been different.)

Third, Heppner was not using Claude to obtain legal advice. Although counsel argued the exchanges were for the purpose of talking to counsel, Heppner had acted without counsel's direction, and Claude itself disclaimed giving legal advice. The court also rejected the argument that later sharing the materials with counsel somehow transformed them into privileged communications, stating that non-privileged communications are not "alchemically changed" into privileged ones upon transfer to counsel.⁵

This reasoning appears to be consistent with Canadian law. Canadian solicitor-client privilege protects confidential communications between lawyer and client for the purpose of seeking or giving legal advice.⁶ It arises from the first steps taken to obtain legal advice and extends to information that must be provided in confidence for that purpose.⁷ Because the privilege applies only in clearly defined and narrowly limited circumstances, a communication shared outside the solicitor-client relationship (i.e., with a publicly available generative AI tool) will be difficult to protect.⁸

The use of a public AI platform may also be analyzed as a waiver problem. In Canadian law, solicitor-client privilege belongs to the client and may be waived only by the client.⁹ On that basis, inputting privileged information into a public AI platform could potentially be characterized as the client's own disclosure of the communication outside the privileged relationship, and a Canadian court could regard that step as inconsistent with maintaining solicitor-client privilege.

Work product doctrine

Judge Rakoff assumed that the AI materials were created in anticipation of litigation, but still found the work product doctrine unavailable because the documents were not "prepared by or at the behest of counsel" and did not reflect counsel's strategy.¹⁰ Defence counsel had confirmed that the documents were created by Heppner "on his own volition," and while they may have affected later strategy, they did not reflect counsel's mental processes at the time they were created.¹¹ The court therefore held that the materials did not merit work product protection. It also declined to follow a broader US authority that would have protected litigant-created materials without counsel direction, reasoning that such an approach would undermine the doctrine's purpose of preserving a lawyer's private area for trial preparation.¹²

It remains to be seen whether this same reasoning would apply in the context of litigation privilege under Canadian law. In Blank, the Supreme Court of Canada held that litigation privilege is distinct from solicitor-client privilege, serves the adversarial process, and creates a "zone of privacy" for pending or apprehended litigation.¹³ It can arise even in the absence of a solicitor-client relationship, and confidentiality is not an essential component in the same way it is for solicitor-client privilege.¹⁴ In Lizotte, the Court reaffirmed that litigation privilege protects documents and communications whose dominant purpose is preparation for litigation, including communications with third parties such as witnesses or experts.¹⁵ It is possible (although by no means certain) that a Canadian court might therefore take a broader approach to the application of litigation privilege than the US court in Heppner to deny protection solely because the materials were created by the litigant rather than by or at the direction of counsel. A Canadian court would, however, still need to grapple with whether disclosure to a public AI platform undermines or waives any litigation-privilege claim in the first place.

Key takeaways for clients and counsel

1. Public AI tools are likely to be treated as third parties in considering privilege.

Prompts and outputs entered into a public model are unlikely to be protected by privilege, especially where the provider's terms permit retention, training, reuse or disclosure. Litigants should be cautious in inputting confidential information relating to an ongoing matter into a public GenAI tool.

2. Canadian litigation privilege may leave more room for argument than US work product, but not much.

Unlike the work product analysis in Heppner, Canadian litigation privilege does not necessarily depend on counsel direction. Still, the dominant-purpose requirement, the document-specific inquiry and the third-party platform problem mean that any Canadian litigation-privilege argument would remain highly fact-sensitive.

3. Professional guidance is moving faster than the case law.

The Canadian Bar Association warns that inputting confidential or case-specific information into general or "free" third-party generative AI systems can compromise confidentiality, while noting that APIs, opt-out settings and stronger technical controls may reduce, but not eliminate, those risks.¹⁶ The Law Society of Ontario now directs licensees to dedicated AI resources, including a white paper, practice note and quick-start checklist.¹⁷

Conclusion

Heppner is an important early decision at the intersection of privilege and generative AI. Its clearest lesson is that public AI systems may be treated by courts as third parties, not as private extensions of a litigant's thought process. Clients should be very careful about asking legal questions and seeking legal advice or strategy advice from a public generative AI tool (or inputting actual legal advice to double check it). No reported Canadian decision yet squarely addresses the same fact pattern. Even so, current Canadian authorities on the doctrine of privilege instruct a cautious approach – a Canadian court may well reach the same decision, depending on the facts of the case including the nature of the tool, the provider's terms, who created and used the material, and whether the dominant purpose of the document can genuinely be shown to have been litigation.

Footnotes

About Dentons

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.