A Tool-Based Framework: How AI Platforms Fit Into Centuries Of Privilege Doctrine

Artificial intelligence is rapidly reshaping the legal landscape, and the courts are taking notice.  As one court recently observed, “[g]enerative artificial intelligence presents a new frontier in the ongoing dialogue between technology and the law.” United States v. Heppner, 2026 WL 436479, at *4 (S.D.N.Y. Feb. 17, 2026).  That frontier, however, is not without boundaries.  The growing integration of AI into litigation has forced “courts to confront difficult questions about how and to what extent longstanding protections apply when parties use AI to assist them in the litigation process.”  Morgan v. V2X, Inc., 2026 WL 864223, at *2 (D. Colo. Mar. 30, 2026).  However, “AI’s novelty does not mean that its use is not subject to longstanding legal principles, such as those governing the attorney-client privilege and the work product doctrine.” Heppner, 2026 WL 436479, at *4.

The question, then, is not whether AI fits within existing privilege doctrine, but how.  Some advocates argue that the doctrine should adapt to technology and that many practitioners treat AI tools as confidants, but as American University Professor Ira Robbins has noted, “ubiquity and intimacy are not the touchstones” of privilege.  Ira P. Robbins, Against an AI Privilege, JOLT Dig., Harvard L. Sch. (Nov. 7, 2025).  At least three courts confronting this new frontier in early 2026 have reached consistent conclusions about the governing standard: that the use of AI cannot extend privilege by casting AI as a lawyer in its own right, but AI use can be protected where attorneys and litigants wield it as a tool in service of otherwise privileged work.  This piece examines the reasoning underlying the courts’ early guidance and explores the limitations on privilege set by this tool-based framework as AI becomes an increasingly common fixture in legal practice.

The Status Quo of Privilege Doctrine 

Two foundational privileges govern the confidentiality of legal communications and litigation materials: the attorney-client privilege and the work product doctrine.  Each operates under a distinct legal standard but they are related in purpose to protect distinct categories of information.

“The attorney-client privilege is the oldest of the privileges for confidential communications known to the common law.”  Upjohn Co. v. United States, 449 U.S. 383, 389 (1981).  “Its purpose is to encourage full and frank communication between attorneys and their clients” and “rests on the need for the advocate and counselor to know all that relates to the client’s reasons for seeking representation if the professional mission is to be carried out.”  Id.  To that end, the privilege attaches to, and protects from disclosure, “communications (1) between a client and his or her attorney (2) that are intended to be, and in fact were, kept confidential (3) for the purpose of obtaining or providing legal advice.”  Heppner, 2026 WL 436479, at *2. 

“Related to but distinct from the attorney-client privilege, the work product doctrine, [a]t its core[,] ... shelters the mental processes of the attorney, providing a privileged area within which he can analyze and prepare his client’s case.”  Id. at *3 (internal citation omitted).  Although the doctrine may in some circumstances apply to materials generated by non-lawyers, courts have stressed that its “availability in reference to materials in the possession of a client depends upon the existence of a real, rather than speculative, concern that the thought processes of [the client’s] counsel in relation to pending or anticipated litigation would be exposed.”  Id. (internal citation omitted).  That distinction matters: the doctrine is not a general shield against disclosure of litigation-related documents, but a targeted protection for the strategic and analytical work by the attorney.

Together, these two doctrines form the core of the confidentiality framework into which AI has now arrived and into which courts are beginning to define its place.

United States v. Heppner (February 17, 2026)

The Southern District of New York confronted “a question of first impression nationwide: whether, when a user communicates with a publicly available AI platform in connection with a pending criminal investigation, are the AI user’s communications protected by attorney-client privilege or the work product doctrine.”  Heppner, 2026 WL 436479, at *1.  The court’s answer was an unambiguous no, and its reasoning made clear that the use of an AI tool standing alone does not qualify as attorney involvement sufficient to be protected.
            In the case, defendant Bradley Heppner received a grand jury subpoena and learned he was a target of an investigation alleging that he defrauded investors.  Thereafter, Heppner turned to the publicly available AI platform Claude, which he used, without any direction from his attorneys, to prepare “reports that outlined defense strategy” and “that outlined what he might argue with respect to the facts and the law.”  Id.  When FBI agents executed a search warrant at Heppner’s home, they seized those documents.  Heppner’s counsel argued they were privileged because Heppner had input information learned from counsel, created the documents to prepare for conversations with counsel, and later shared them with counsel, even though counsel had never directed him to use the AI platform.  The court disagreed.

The court held that all three elements of the attorney-client privilege were lacking.  The first and most fundamental deficiency was the simplest: Claude is not an attorney.  “[T]hat alone disposes of Heppner’s claim of privilege.”  Id. at *2.  This framing reflects the court’s core skepticism: the privilege exists to protect the attorney-client relationship, and there is no framing that can qualify an AI platform as the requisite attorney in that relationship.

The court’s skepticism continued with the second element, confidentiality.  The court emphasized not only that Heppner communicated with a third-party in his very use of the AI platform, but also that Claude’s written privacy policy required users to consent to their inputs being collected to “train” Claude and that Claude has the right to disclose such data “to a host of third parties.’”  Id. (internal citation omitted).  On those facts, the court held, “Heppner could have had no reasonable expectation of confidentiality in his communications with Claude.”  Id. (internal citation omitted).  According to the court, the voluntary disclosure of information to a platform operating under such a policy was fundamentally incompatible with the confidentiality that privilege requires.

Third, and most notable for attorneys and their clients moving forward, Heppner had not used Claude for the purpose of obtaining legal advice, nor had he been directed to do so by counsel.  Although Heppner’s attorneys argued that he had “communicated with Claude for the express purpose of talking to counsel,” his counsel also “conceded, Heppner did not do so at the suggestion or direction of counsel.”  Id. at *3 (internal citations omitted).  That concession was key to the court’s ruling.  The attorney-client privilege does not attach simply because a client later shares the documents with an attorney; the communication must be made for the purpose of obtaining legal advice, and the court held that purpose was absent here.

The court’s work product protection analysis followed similar logic.  The critical fact was that Heppner prepared the documents of his own volition, rather than by or at the direction of counsel.  As a result, he “was not acting as his counsel’s agent when he communicated with Claude.”  Id.  Absent that direction forming an agency relationship, the documents could not reflect counsel’s mental processes, which work product doctrine exists to protect.  “Because the AI Documents were not prepared at the behest of counsel and did not disclose counsel’s strategy, they do not merit protection as work product.”  Id. at *4.

As one of the first courts addressing this new frontier of privilege doctrine, the Southern District of New York in Heppner showed its obvious skepticism toward the broader proposition that AI-assisted communications might warrant privilege protection in their own right.  Grounding its analysis firmly in existing privilege doctrine, the court was very clear: privilege belongs to the attorney-client relationship; the work product doctrine protects the attorney’s mental process and strategy.  Use of an AI tool, the court believes, does not insert a lawyer into the equation standing alone, and cannot therefore establish protection.

Warner v. Gilbarco (February 10, 2026)

Just one week before Heppner was decided, the Eastern District of Michigan reached a different result on very similar facts.  Warner v. Gilbarco, 2026 WL 373043, at *4 (E.D. Mich. Feb. 10, 2026).  Where as Heppner denied protection because no attorney was in the picture, Warner granted work product protection for precisely the opposite reason: the pro se litigant was the attorney.

This time in a civil case, pro se plaintiff Sohyon Warner had used ChatGPT in the course of litigation to prepare her work product..  Defendants moved to compel production of all documents related to her use of third-party AI tools in connection with the lawsuit, arguing that Warner had waived work product protection by using the platform to prepare.  Id. at *4. 

The court held that Warner’s AI-generated materials were protected by the work product doctrine, reasoning that ChatGPT was merely a tool in service of Warner’s own litigation preparation.  Acting as her own attorney pro se, Warner’s use of the AI platform reflected her internal drafting and thought processes, which were prepared in anticipation of litigation and are squarely protected as attorney work product.  Unlike in Heppner, the AI did not generate the strategy; it assisted the person who did.

The court further held that Warner had not waived work product protection by using ChatGPT.  Anchoring its analysis in the core principle that work product waiver requires disclosure to an adversary, or disclosure in a manner likely to reach an adversary’s hands, the court found that Warner’s use of a third-party AI platform did not meet that standard.  Id.  The court was notably unimpressed by the defendants’ waiver theory, warning that accepting it “would nullify work-product protection in nearly every modern drafting environment.”  Id.  

That framing provided important insight into the court’s view of AI  as functionally the same as the use of any other drafting aid: a tool.  Where as Heppner used that characterization to deny protection, because the tool was operating in the absence of any attorney, Warner used it to extend protection, because the tool was assisting the pro se litigant herself. The thrust of the two decisions is the same: the attorney-client privilege and the work product doctrine attach to the human legal mind at work, not to the platform facilitating that work.

Morgan v. V2X, Inc. (March 30, 2026)

The very next month, the District of Colorado picked up where the Eastern District of Michigan left off.  Citing Warner with approval, the court in Morgan v. V2X, Inc. reaffirmed that a pro se civil litigant can assert work product protection in connection with AI use.  2026 WL 864223, at *4-5 (D. Colo. Mar. 30, 2026). 

In Morgan, the defendants moved to compel pro se plaintiff Archie Morgan to disclose the specific AI platform he had been using in connection with the litigation, and simultaneously sought to amend the existing protective order to restrict how confidential information could be used with AI tools.  Id. at *2.  Morgan did not oppose amending the protective order in principle, but resisted disclosing his AI tool of choice, arguing that a litigant’s selection of litigation support tools falls squarely within the work product doctrine.  Id.  

The court agreed with Warner that work product protection applies to a pro se litigant’s use of AI, rooting its analysis in Rule 26(b)(3), which protects “documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative.”  Id. at *3 (citing Fed. R. Civ. Pro. 26(b)(3)(A)).  The court observed that the Advisory Committee’s 1970 Amendments to the Rule were specifically designed to extend that protection beyond attorneys’ work product to materials prepared by or for a party and that courts have broadly interpreted the Rule to shield not just litigation preparation materials, but also the mental impressions, opinions, and theories of the parties themselves.  Id. at *3.

The court held that the fact that “AI systems like ChatGPT, Claude, Gemini, and others widely available to the public, collect user data for training and other purposes” does not “eliminate all expectations of privacy or automatically waive protections.”  Id. at *4.  Drawing on Warner’s waiver reasoning, the court reiterated that even though AI use technically discloses information to a third party, it is highly unlikely that information would reach an adversary’s hands absent legal process to compel it, and that AI interactions therefore do not automatically compromise work product protection.  Id. 

Notably, the court contextualized its analysis in the privacy expectations that Fourth Amendment doctrine has recognized in other third-party contexts, emphasizing that routing information through a third-party system does not forfeit all privacy.  The court placed particular weight on the distinctive nature of modern AI platforms, which are “specifically designed and trained to engage,” “invite candid and significant disclosure of information, including sensitive information,” and “simulate empathy, foster trust, and interact in a way that feels genuine and intimate.”  Id. at *5.  That intimacy, the court suggested, counsels against treating AI interactions as the kind of voluntary third-party disclosure that strips away legal protection.

Morgan represents the fullest judicial articulation to date of the tool-based framework.  Across all elements of its analysis, the court’s reasoning returned to the same premise: AI is a tool in service of the litigant’s mind, and protection follows the mind, not the tool.

Tool or Privilege Holder?

Taken together, Heppner, Warner, and Morgan establish a coherent—though still developing—framework for analyzing privilege claims in the age of AI.  At its core, the framework is simple: AI is a tool, not a lawyer, and protection follows the legal mind wielding it, not the platform through which it works. 

Professor Ira Robbins has argued, “[t]he relevant duty-bearer is the lawyer—the human professional who owes fiduciary duties, is subject to discipline, and exercises legal judgment. AI systems cannot be admitted to the bar; they cannot form fiduciary relationships; and they cannot be sanctioned by courts or regulators the way human professionals can.”  Ira P. Robbins, Against an AI Privilege, JOLT Dig., Harvard L. Sch. (Nov. 7, 2025).  And although this may be the case, AI systems can certainly aid the relevant duty-bearer.

The district court in Warner stated the premise clearly, explaining that “ChatGPT (and other generative AI programs) are tools, not persons, even if they may have administrators somewhere in the background.”  Warner, 2026 WL 373043, at *4.  Heppner and Morgan affirmed that characterization.  None of the three district courts to address this issue showed any interest in treating AI as establishing a privileged relationship in its own right.  The question in each case was not what the AI was doing, but who was directing it, and whether that person stood in a legally cognizable relationship to an attorney.

In fact, even Heppner, which ultimately denied protection, reflected a similar line of thinking, theorizing that “[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege.”  Heppner, 2026 WL 436479, at *3. 

Confidentiality Concerns or Waiver of Privilege?

The tool-based framework resolves whether AI-assisted materials are privileged, but it does not resolve the concerns surrounding the confidential information fed into the tool to produce the privileged material.  Morgan made clear that these are distinct questions, and that the answer to the first does not settle the second.

Even as the district court extended work product protection to Morgan’s AI-generated litigation materials, it acknowledged that the risks of uploading confidential data to mainstream AI platforms could not be ignored.  The defendant had raised legitimate concerns that its confidential information, including trade secrets and personnel files, was being entered into AI platforms, which collect and store user inputs and may disclose them to third parties.  The court agreed that the defendant had a right to know where that data was going, and ordered Morgan to disclose the name of his AI tool so the defendant could assess whether confidential information had been compromised.  Morgan, 2026 WL 864223, at *5.

To address the underlying risk going forward, the court crafted what appears to be the first AI-specific provision in a federal protective order of its kind—and perhaps a template for future litigation—prohibiting the submission of confidential information into any AI platform unless the provider is contractually barred from using inputs to train its model or disclosing them to third parties.  Id. at *7.  The court was candid that this requirement , as a practical matter, would bar the use of most mainstream AI tools with confidential discovery materials, and cautioned parties against over-designation of information as confidential in light of that burden.

Morgan confirms that work product protection and confidentiality protection are not the same shield.  A litigant’s mental impressions may be protected from compelled disclosure to an adversary, but that protection does not permit feeding sensitive information into a platform that may retain, analyze, or redistribute it.

Guidance Of These Early Cases

Ultimately, these three decisions reflect a confirmation of existing privilege doctrine in a new frontier.  Courts have long extended attorney-client privilege and work product protection beyond the attorney alone, to clients acting on counsel’s direction, to agents functioning as necessary extensions of the legal relationship, and to parties preparing their own litigation materials in anticipation of trial.  AI, under the tool-based framework, fits comfortably within that doctrine as another instrument through which attorneys and litigants do the work that privilege has always protected.

The three decisions together offer attorneys and litigants reasonably clear guidance on how to preserve privilege and work product protection when using AI in litigation.  Most importantly, attorneys should be prepared, if challenged, to demonstrate that AI was used as a tool in service of their legal work.  Attorneys should direct, instruct, and supervise their clients’ use of AI tools rather than leaving clients to use them independently.  Attorneys should document the purpose of AI use, ensuring that the record reflects that AI-generated materials were prepared by themselves or their clients in anticipation of litigation and in furtherance of counsel’s legal strategy, not merely as a personal exercise.