AI use is forcing the profession to grapple with a new question: can privilege be maintained over information that enters an AI prompt box? Recent cases offer mixed answers. The core privilege rules persist, but AI is changing the nature and contours of privilege risk for attorneys and their clients.
The basics of legal privilege
Under U.S. law, attorney-client privilege protects confidential oral or written communications between client and counsel made to seek or provide legal advice. The work product doctrine protects materials prepared by counsel or at counsel’s direction in anticipation of litigation or regulatory scrutiny. Although rules on common interest, joint defense, and waiver vary across jurisdictions, the attorney-client privilege generally is waived by disclosure outside the attorney-client group, and work product protection may be waived by sharing the material directly with an adversary or in a manner likely to reach one. Waiver may extend beyond the specific material disclosed to its subject matter.
The basics of legal privilege
Under U.S. law, attorney-client privilege protects confidential oral or written communications between client and counsel made to seek or provide legal advice. The work product doctrine protects materials prepared by counsel or at counsel’s direction in anticipation of litigation or regulatory scrutiny. Although rules on common interest, joint defense, and waiver vary across jurisdictions, the attorney-client privilege generally is waived by disclosure outside the attorney-client group, and work product protection may be waived by sharing the material directly with an adversary or in a manner likely to reach one. Waiver may extend beyond the specific material disclosed to its subject matter.
AI and the attorney-client privilege
The threshold risk that AI use poses to the protections of the attorney-client privilege is inadvertent waiver. Whether a court may find the privilege waived turns on whether the user retained a reasonable expectation of privacy in privileged matter shared with the AI tool. Although case law regarding AI is nascent, earlier cases regarding other technologies are analogous—and strongly signal that users should proceed with caution.
For example, in Scott v. Beth Israel Medical Center Inc., 2007 WL 3053351 (N.Y. Sup. Ct. Oct. 17, 2007), the court rejected the plaintiff’s claim that materials he sent his attorney through his employer’s workplace email system were privileged because (i) the employer’s policy disclaimed any expectation of privacy in using the email system, and (ii) the plaintiff had constructive knowledge of that policy. Courts may analogize AI platforms that store prompts and materials uploaded to them (for training and other purposes) to workplace email systems like that in Scott. ChatGPT’s privacy policy, for example, says it collects user input and uses it to train its agents and improve its service. That provision may defeat a user’s reasonable expectation of privacy and confidentiality.
Lawyers and clients seeking to protect their attorney-client privilege should avoid using AI for legal purposes unless they are sure that the instance of AI they are using protects the information’s confidentiality—which will generally rule out free, consumer-facing AI tools and platforms. Enterprise tools that are closed, meaning that the AI’s use of inputs and outputs is restricted, may present a different case, but the key question remains whether the tool keeps the information confidential and protected within the firm’s or client’s digital walls.
Lastly, attorneys should be aware that the law on attorney use of AI tools is rapidly evolving. In September 2026, for example, California enacted SB-574, a law codifying rules for attorneys to follow in using AI. Among these obligations is a requirement not to enter confidential, personal, or nonpublic information into an unrestricted AI tool. Whether and how statutes like this one impact legal privilege analysis remain to be seen, but as such laws almost certainly spread across the country in the coming years, lawyers should be mindful of how they are using AI in their practice and the type of information they share with AI tools.
AI and the work product doctrine
Courts have protected work product shared with AI, but outcomes turn on the details of the AI use at issue. Generally, attorneys may use AI as a tool to develop and refine their work product without waiving the work product protection. For example, in Tremblay v. OpenAI, Inc., 2024 WL 3748003 (N.D. Cal. Aug. 8, 2024), the district court reversed an order compelling production of counsel’s pre-suit ChatGPT prompts, holding that counsel’s queries contained counsel’s mental impressions. And at least one court has held that, although AI programs “may have administrators somewhere in the background,” such programs are nevertheless “tools, not persons.” Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629, 637 (E.D. Mich. 2026). The Warner court therefore concluded that the pro se plaintiff’s use of ChatGPT did not involve disclosure of her work product “to an adversary or in a way likely to get in an adversary’s hand.” Id. at 636. The court further added that the defendant’s theory of work product waiver was overbroad and would “nullify work-product protection in nearly every modern drafting environment.” Id. at 637.
Courts remain sensitive, however, to the distinction between attorney work product and underlying confidential materials. In Morgan v. V2X, Inc., 2026 WL 864223 (D. Colo. Mar. 30, 2026), for example, the court held that sharing litigation material with an AI platform was analogous to sharing it with an email server and therefore not a disclosure likely to reach an adversary. But the court nonetheless amended the protective order to bar inputting confidential information into AI platforms lacking contractual restrictions on storage, training use, and deletion on request. And in Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC, No. 25-BC11B-0020 (Tex. Bus. Ct. June 3, 2026), the court, although holding that uploading genuine work product to ChatGPT did not waive work product protection, also ordered the disclosure of everything that did not qualify as work product—including materials designated “Confidential.” The upshot is that when using AI tools, attorneys must be careful to distinguish between work product material, which the work product doctrine will protect, and other information, including confidential client information, that the work product doctrine will not.
Finally, these work product doctrine wins should not be overread. The law is rapidly evolving, and some courts have taken more stringent views on AI and waiver in other contexts that could bleed into privilege analyses. For instance, a separate line of trade secret cases finds waiver of trade secret protection when otherwise protected code is shared with AI. Courts could in future analogize to such cases to reach decisions that limit work product doctrine protection when using AI tools.
AI as a client’s source of legal advice
AI can create significant risks when non-lawyers use the tools as surrogate attorneys, whether to seek legal advice directly from AI or to test advice received from counsel. Two 2026 decisions illustrate what can happen when clients do so.
In United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026), a defendant prepared documents using a third-party AI tool and then sent them to his lawyers. He later sought to protect the materials from discovery, but the court rejected each of his privilege claims. The attorney-client privilege did not apply because the defendant’s communications were with a third-party AI tool, not an attorney. The court found that the communications could not have been made to seek legal advice because the AI’s terms of service expressly cautioned that the AI did not provide legal advice. Work product also failed because neither the defendant nor the AI tool was an attorney, and the defendant did not prepare the materials at counsel’s direction. Notably, the court left open whether the material would have been protected by the work product doctrine if the defendant had engaged with the AI pursuant to an attorney’s instruction.
In Fortis Advisors, LLC v. Krafton, Inc., C.A. No. 2025-0805-LWW (Del. Ch. Mar. 16, 2026), a CEO used ChatGPT to devise a strategy to avoid a USD250 million earnout, shared the playbook with another executive, and implemented it. Because it was developed with ChatGPT, not through consultation with an attorney, the court determined that the playbook was not privileged, even though it contained legal analysis and strategy. The court also found that the deletion of query logs suggested premeditation and bad faith and ultimately ordered specific performance under the purchase agreement.
Together, these cases show that courts are unwilling to extend the protections of legal privilege to AI-generated legal advice that does not otherwise meet the traditional requirements for such privilege.
Practical takeaways
Although the privilege risks stemming from AI usage are likely to remain a persistent challenge, there are effective steps lawyers can take to help protect their clients (and themselves) from the risk of waiver.
First, assess AI use on a three-pillar risk spectrum:
- the user and purpose (the “use case”)
- operational controls over access and use
- vendor contract terms governing use of user data.
Lowest risk is when a legal professional uses a proprietary or licensed, confidential platform and the user has exclusive rights to the platform’s inputs and outputs. Intermediate risk is an analyst’s use of an AI tool at counsel’s direction—retaining legal privilege in that case will largely depend on access controls and vendor terms, as well as the record concerning the directions given by counsel. The highest risk use case is non-legal personnel independently seeking legal guidance from an AI tool, particularly a public tool. In that situation, neither input nor output may be privileged, even if counsel is later involved.
Second, counsel should establish and enforce organizational policies regarding AI use and provide regular training and guidance on the use of AI tools to clients, including executives and, board members, and employees. Counsel should emphasize that testing legal advice in a public AI tool likely waives privilege and that courts may not separate counsel’s advice from the employee’s or client’s follow-on AI interaction.
Third, encourage clients to treat AI logs as company records subject to preservation when a document hold is in place. Extend retention protocols to AI use, map workforce AI tools to avoid spoliation, and expect requests for AI logs in litigation.
Fourth, manage AI meeting transcription. These tools expand discoverable material, and whether AI is another “person” for waiver purposes in this context remains unsettled. Consider disabling or requiring opt-in to use such tools; prohibit recording meetings involving legal advice; require human review of any transcription; and limit dissemination. Board and executive committee meetings merit particular caution because recording may chill discussion and unnecessarily duplicate discovery records.
Fifth, verify every AI output. The lawyer is the expert; AI is the assistant. Do not rely on unverifiable output, and independently check every citation.
Conclusion
Legal privilege doctrines may be old, but AI presents new applications of those doctrines and new risks to maintaining legal privilege. Counsel can reduce those risks, however, by adopting comprehensive AI policies like those outlined above and continuing to monitor organizational AI use—an ounce of prevention worth a pound of cure.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
