The rapid integration of generative AI tools into legal and business workflows is creating fresh challenges for courts as they grapple with long-standing principles of attorney-client privilege and the function-product doctrine. A key question emerging is when data generated by these AI systems – including the prompts used to create it, the outputs themselves, and associated activity logs – is protected from disclosure during legal proceedings. While courts have affirmed that such data can be discoverable, recent rulings are clarifying the conditions under which it might as well be shielded from scrutiny.
The core of the issue lies in applying traditional legal protections to a novel form of information. Courts are consistently applying established privilege and work-product principles to this new category of electronically stored information (ESI), but the outcome hinges on the specific context of how, why, by whom, and under what conditions these AI tools are utilized. The stakes are high, as improper utilize of generative AI could inadvertently waive crucial protections, potentially exposing sensitive legal strategies and client confidences.
The Limits of Privilege When Using AI
Attorney-client privilege, a cornerstone of the legal system, protects confidential communications between lawyers and their clients made for the purpose of seeking or providing legal advice. However, generative AI systems are not themselves lawyers or clients, meaning communications *with* these tools aren’t automatically privileged, even if the subject matter is legal. Privilege can apply, however, when AI is used under the direct supervision of counsel to facilitate legal advice, functioning much like a paralegal or other assistant – but only if a reasonable expectation of confidentiality is maintained.
A recent case, United States v. Heppner, No. 25-cr-00503-JSR ECF 27 (S.D.N.Y. Feb. 17, 2026), offered a stark illustration of these limitations. In that case, Judge Jed S. Rakoff ruled that AI-generated content was not protected by either attorney-client privilege or the work-product doctrine. The defendant had entered prompts into a publicly available GenAI tool to assess potential legal exposure, then shared the resulting analysis with his attorney. Federal agents subsequently seized the computer containing this data, and the government sought its production in discovery.
Judge Rakoff’s decision rested on several key points: the GenAI platform was a third-party tool lacking any expectation of confidentiality; the materials weren’t created at the direction of counsel, and therefore weren’t directly intended to facilitate legal advice; and sharing the AI-generated content with an attorney didn’t retroactively confer privilege. This ruling underscores that the attorney-client privilege applies to confidential communications *between* a lawyer and client for the purpose of providing legal advice, not to documents that simply become useful to counsel later on.
Work Product and the Role of Counsel’s Direction
The work-product doctrine offers a separate, but related, form of protection, shielding materials prepared by or at the direction of counsel in anticipation of litigation. This includes not only factual investigations but also materials reflecting an attorney’s mental impressions, conclusions, and legal strategies. In the context of generative AI, courts are beginning to differentiate between data created at counsel’s direction – which may qualify as work product – and data created independently for business or exploratory purposes, which generally does not.
The Heppner case also addressed the work-product doctrine, again finding against the defendant. The court determined that the AI-generated materials weren’t prepared under counsel’s direction and didn’t reflect the defense strategy. This highlights that simply addressing legal issues isn’t enough to qualify data as work product; it must be demonstrably linked to the preparation for litigation and guided by legal counsel.
However, a contrasting ruling in Tremblay v. OpenAI, Inc., No. 23-cv-03223-AMO, 2024 WL 3748003 (N.D. Cal. Aug. 8, 2024), demonstrated a different outcome. In that case, plaintiffs alleging copyright infringement conducted targeted testing of ChatGPT *before* filing suit to evaluate their potential claims. While they produced the prompts used in their complaint, they resisted producing additional prompts and outputs, arguing they revealed counsel’s litigation strategy. The court agreed in part, holding that unused prompts, account data, and testing results constituted “opinion work product” prepared in anticipation of litigation. Crucially, the court limited any waiver of privilege to the specific prompts and outputs actually relied upon in the pleadings.
Mitigating Risk and Preserving Protections
The rulings in Heppner and Tremblay emphasize that the applicability of privilege and work-product protection hinges on the circumstances of AI use. Maintaining confidentiality is paramount, and using GenAI tools that permit data retention, reuse, or training significantly increases the risk of waiver. As courts continue to evaluate these issues, they are likely to focus on the openness or closed nature of the AI platform, the existence of contractual confidentiality protections, and the level of counsel’s direction and supervision.
To mitigate these risks, legal professionals should prioritize several key steps. Using secure, enterprise-level GenAI platforms with robust data privacy policies is crucial. Treating GenAI as a supervised assistant – with prompts and outputs generated under counsel’s direction and subject to review – is also essential. Limiting the inclusion of privileged information in prompts and clearly labeling protected materials, while not dispositive, can help demonstrate intent. Careful attention to GenAI activity logs and metadata is necessary, as these could reveal litigation strategy. Finally, addressing GenAI data in e-discovery agreements and seeking Rule 502(d) orders can help minimize the risk of inadvertent waiver.
As Judge Rakoff’s decision in Heppner illustrates, courts are applying established legal doctrines to these cutting-edge tools. Privilege disputes involving GenAI data will increasingly turn on issues of supervision, purpose, and reasonable expectations of confidentiality. Litigators must proactively address these issues, coordinating with e-discovery and information governance teams, and advising clients about the potential risks of casual or unsupervised AI use.
The legal landscape surrounding generative AI is rapidly evolving. The next key development will likely be further clarification from courts on the scope of the work-product doctrine in the context of AI-driven investigations and strategy development. Stay informed about emerging case law and best practices to navigate this complex area.
Have thoughts on this developing legal issue? Share your comments below and join the conversation.
