A 2026 federal court ruling in United States v. Heppner found that AI-generated documents created through a publicly available AI platform, without counsel’s direction, were not protected by attorney-client privilege or work-product doctrine. The ruling highlights questions organizations should consider when using AI for legal work, including confidentiality, attorney direction, and the terms governing the AI platform. It is estimated that 92% of legal professionals use at least one AI tool daily.
Most organizations have not addressed what happens to information entered into AI platforms. The attorney-client privilege protects confidential communication between a client and their attorney for obtaining legal advice, but AI tools disrupt that framework, and courts are now scrutinizing them. This page examines where AI breaks confidentiality, what courts are saying and what safeguards reduce risk.
Attorney-client privilege is commonly analyzed through a three or four-part working framework: there must be (1) a communication, (2) between an attorney and a client, (3) made for the purpose of obtaining or providing legal advice, and (4) made and maintained in confidence. Some authorities describe the elements in more granular terms, but the core inquiry is the same. This is the legal hinge on which AI and attorney-client privilege concerns turn, as third-party disclosure defeats the reasonable expectation of confidentiality that privilege demands.
Some public AI tools may retain user inputs, use them for model training, or reserve the right to share data with third parties. The Anthropic policy cited in Heppner provides an example. Model Rule 1.6 requires lawyers to ensure that AI tools do not compromise client confidentiality. Consumer-tier AI tools may be treated as third parties for privilege purposes, depending on the tool’s terms and use.
Pennsylvania-specific guidance makes clear that lawyers must confirm that AI platforms maintain strict confidentiality. Three common scenarios illustrate the risk:
In each case, privileged information enters a platform that may retain, train on or share that data.
Heppner provides the clearest judicial signal. The court denied privilege on three distinct grounds:
However, Warner v. Gilbarco, Inc., a February 2026 decision from the Eastern District of Michigan, reached the opposite result on work-product for a pro se litigant, demonstrating that courts are not applying uniform standards.
The work-product doctrine is distinct from the attorney-client privilege, though the two protections are often confused. The work-product doctrine generally requires materials to be prepared in anticipation of litigation and by or at the direction of counsel.
AI outputs may fail work-product requirements when an employee, client, or non-attorney uses AI independently without attorney direction. If an attorney directs the use of a secured, enterprise-configured AI tool in active or anticipated litigation, work-product protection may apply. It is not guaranteed. Experienced litigation counsel can help organizations understand when and how the work-product doctrine applies to AI-assisted materials.
The risks are manageable with the right framework. Four strategies provide concrete safeguards.
Written AI use policies are the foundation of compliance. Organizations should define which tools are approved, what information may be entered, who is authorized to use AI for legal work and what approval process governs these new platforms.
ABA Formal Opinion 512 establishes that Model Rule 1.1 requires lawyers to understand and manage the risks associated with the technologies they use. A firm or legal department without an AI use policy may face increased ethics and risk-management concerns under published guidance.
Public and consumer AI tools differ materially from enterprise-configured platforms. Key evaluation questions include the following:
The Cambridge International Journal of Legal Information found that Lexis+ AI achieved an estimated 65% accuracy and 17% hallucination rate. Enterprise configuration reduces waiver risk but does not replace attorney oversight.
A vendor’s standard privacy policy is not a substitute for a negotiated contract. Anthropic’s standard policy permitted data retention and third-party disclosure, which the court used to deny privilege in Heppner.
Five key terms to consider include:
AI governance counsel can help negotiate vendor contracts that protect privilege.
The work-product doctrine generally requires materials to be prepared in anticipation of litigation and by or at the direction of counsel. Sending AI output to a lawyer after the fact does not satisfy this requirement.
Five documentation steps that reduce risk include:
Lawyers remain accountable for all work product regardless of how it is generated. Employment law counsel can help organizations implement these practices consistently.
These answers address common questions about the use of AI and attorney-client privilege.
It can, especially if using the public version. Entering client facts into a public AI platform constitutes disclosure to a third party because the AI platform’s privacy policy permits data retention, model training and third-party disclosure. Heppner established that users cannot expect confidentiality once they consent to those terms.
AI platform logs, prompt history, and input or output records may constitute electronically stored information subject to discovery. Heppner itself involved the seizure of AI interaction records. Organizations should treat every prompt involving client facts as discoverable unless strict enterprise controls are confirmed.
Attorney review alone is not sufficient to make an AI-generated document privileged. In Heppner, the court addressed the defendant’s independent use of AI and did not decide whether the result would be different if counsel had directed the use. The court noted that, in that circumstance, the AI tool might arguably function like a professional acting as the lawyer’s agent. Accordingly, the use of AI at counsel’s direction, with appropriate confidentiality protections and for a legal purpose, may be relevant to whether privilege applies, although the determination will depend on the particular facts and the ever-developing law around AI.
Enterprise platforms reduce risks but do not automatically confer privilege. Data processing agreements and access controls eliminate many vulnerabilities, but privilege still requires an attorney-client relationship, genuine confidentiality and legal purpose.
This content is for educational purposes only and does not constitute legal advice. Attorney-client privilege analysis is highly fact-specific, with outcomes depending on the AI tool used, how it was used, the platform’s privacy policy and the jurisdiction.
The Philadelphia and Pennsylvania Bar Associations’ Joint Opinion 2024-200 provides state-specific guidance on lawyers’ ethical duties when using AI.
For decades, Johnson Duffie has helped organizations navigate legal challenges with clarity and confidence. Our attorneys can assess your AI use policies, build governance frameworks that align with ABA guidance, review vendor contracts and train your teams on safe AI practices.
Contact our team to discuss how Johnson Duffie can protect your organization’s legal work in an AI-powered environment. Or connect with our business and corporate team to explore solutions tailored to your needs.