AI and attorney-client privilege: what the courts and the bars have actually said
In February 2026 two federal courts ruled on AI-generated material in the same week and reached different results. Here is what each order said, what the ABA and three state bars have published, and what OpenAI and Anthropic say about legal process, quoted from the sources and dated, so the conversation with your client or your firm starts from the record rather than from a headline.
The question arrives in two forms. A client mentions, halfway through the first call, that they already ran the whole dispute through ChatGPT and have the printouts. Or you are the one with the client's draft in one window and an assistant in the other, wondering what pasting it in would do to privilege. Before February 2026 we have found no published ruling that addressed it. Now there are two, and they disagree.
This page is not legal advice, and it does not tell you whether your privilege is safe. It sets out what the courts, the ABA, the state bars and the vendors have put in writing, with case names, courts and dates, every one read on 6 November 2026. Equerry, which publishes it, makes a personal assistant for client work and comes up only at the end; it does no legal research and makes no claim about privilege.
United States v. Heppner: what the court held (February 2026)
The case. United States v. Heppner, No. 25 CR. 503 (JSR), United States District Court for the Southern District of New York, Judge Jed S. Rakoff. The ruling came from the bench on 10 February 2026; the written opinion followed on 17 February 2026. The facts, as the firm alerts report them from the opinion: a criminal defendant, after receiving a grand jury subpoena and after retaining counsel, used Anthropic's Claude to generate 31 documents, which he later shared with his lawyers. Defense counsel had not told him to do it. The documents were seized under a search warrant executed at his arrest; Cleary's memo notes that "the government did not request them." Proskauer's alert gives the posture: "His defense counsel asserted attorney-client privilege and work-product protection for the AI-generated reports," and "in response, the government moved for a ruling that the AI documents were protected by neither doctrine," which the judge granted.
Attorney-client privilege. The court held the documents were not privileged. Its first point was the simplest: the tool "is not an attorney," and the opinion says that alone disposes of the privilege claim. Its second was confidentiality. Morgan Lewis reports that at the 10 February bench ruling "the court stated from the bench that the defendant" had "disclosed it to a third-party, in effect, AI, which had no obligation of confidentiality"; the written opinion read the tool's privacy policy as contemplating disclosure to "governmental regulatory authorities." Its third was purpose: "what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude's outputs with counsel." Cleary's memo adds that, when asked whether it can provide legal advice, Claude responded: "I'm not a lawyer and can't provide formal legal advice or recommendations."
Work product. The court held the documents were not work product either. They "were prepared by the defendant on his own volition," not by or at the behest of counsel, and did not reflect defense counsel's strategy. The opinion describes the doctrine's purpose as "to preserve a zone of privacy in which a lawyer can prepare and develop legal theories and strategy" "with an eye toward litigation," and, quoting the Second Circuit, that the purpose "is not generally promoted by shielding from discovery materials in an attorney's possession" that "were prepared neither by the attorney nor his agents."
The door the court left open. The opinion says the analysis might have differed with a lawyer in the loop: "[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." It did not decide that question, because counsel had not directed the use. Proskauer's alert puts it plainly: "Whether that type of arrangement would result in protection remains an open question."
The waiver footnote. Cleary's memo reports a footnote in which the judge said that even if the documents incorporated counsel's information, the defendant waived any privilege by sharing information with Claude and Anthropic, "just as if he had shared it with any other third party." That footnote reaches not only what the tool produced but what the user typed in.
Warner v. Gilbarco: the ruling that went the other way, and what is unsettled
The case. Warner v. Gilbarco, Inc., No. 2:24-cv-12333, United States District Court for the Eastern District of Michigan, Magistrate Judge Anthony P. Patti, decided 10 February 2026, the same day as the Heppner bench ruling. The plaintiff was representing herself in a civil case. The defendants asked the court to compel discovery of materials showing her use of third-party AI tools.
What the court held. The request was denied. The court treated her AI-assisted litigation materials as work product and rejected the argument that using the tools had waived that protection. Its reasoning, as quoted in the firm memos: generative AI programs "are tools, not persons, even if they may have administrators somewhere in the background," and holding otherwise "would nullify work-product protection in nearly every modern drafting environment, a result no court has endorsed." The court also found the requests were "not relevant, or, even if marginally relevant, is not proportional" under Rule 26(b)(1), called the request "a fishing expedition," and wrote that the defendants' "preoccupation with Plaintiff's use of AI needs to abate."
What it did not decide. The order was about work product. The plaintiff had no lawyer, and none of the alerts reports a privilege holding.
Why the two can coexist, and why that is not comfort. Paul Weiss's memo (25 March 2026) describes the two as reaching seemingly conflicting outcomes and puts the open point in one sentence: "The relevance of an AI platform's terms of service remains unsettled." The facts differ in ways the opinions themselves emphasise: Heppner was a criminal defendant with counsel who acted without counsel's direction and whose claim was mainly privilege; Warner was a self-represented civil plaintiff whose claim was work product. No published ruling we have read goes beyond these two, and the point is contested even between judges: Cleary records that "The Court also declined to follow Shih v. Petal Card, Inc.," an earlier magistrate judge's decision as Cleary describes it, Judge Rakoff "noting that it was not binding."
Does using AI waive privilege? The facts the two courts wrote about
Read together, the two opinions do not give a rule. They do show which facts each court wrote about before reaching its result, and those are the facts a lawyer will be asked about if the question comes up in your case.
| What the court looked at | Heppner (S.D.N.Y., 17 Feb 2026) | Warner (E.D. Mich., 10 Feb 2026) |
|---|---|---|
| Who used the tool, and at whose direction | The client, "on his own volition," after retaining counsel; counsel had not directed it. | A self-represented litigant preparing her own case. |
| What protection was claimed | Attorney-client privilege and work product; both rejected. | Work product; upheld. Privilege not at issue. |
| What the tool's terms said | Read by the court as contemplating disclosure to "governmental regulatory authorities," so no "reasonable expectation of confidentiality." | Not the deciding point: the programs "are tools, not persons." |
| Purpose of the use | Whether the defendant "intended to obtain legal advice from Claude," not whether he later shared the output with counsel. | "A litigant's internal mental impressions reformatted through software." |
One more thing the Heppner court read was the vendor's privacy policy as it stood at the time. Policies change. Anthropic's consumer privacy policy effective 10 September 2026 says it may share personal data with "government authorities, law enforcement, or other third parties" where it has "a good-faith belief that disclosure is reasonably necessary to (i) comply with applicable law, regulation or legal process," and that it "may use your Inputs and Outputs to train and improve Anthropic AI models" unless the user opts out in account settings. Which version of a policy a court reads, and what it makes of it, is part of what remains unsettled.
What the ABA and the state bars have published
The court rulings are about the evidentiary privilege. The bar opinions are about the lawyer's duty of confidentiality under the professional rules, a different question with its own consequences. What follows is what four of them say, in their words.
ABA Formal Opinion 512, "Generative Artificial Intelligence Tools," 29 July 2024. On confidentiality: "Before lawyers input information relating to the representation of a client into a GAI tool, they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm." On self-learning tools: "because many of today's self-learning GAI tools are designed so that their output could lead directly or indirectly to the disclosure of information relating to the representation of a client, a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool." And on how not to get that consent: "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient." The opinion also lists what earlier cloud-computing opinions asked lawyers to ensure, including that "the lawyer will be notified in the event of a breach or service of process regarding production of client information."
The State Bar of California, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, 2026 revision (it "replaces the 2023 version"). On confidentiality: "As a general matter, a lawyer must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent (see rule 1.0.1(e)) as to the underlying risks." On tools wired into firm systems: "Unrestricted or poorly configured agentic systems may unintentionally disclose confidential information (including across different matters) and even expose privileged material." On what counts as diligence: "It is important to understand that, in some cases, a user may agree to the terms of use and privacy policy simply by using the product."
D.C. Bar Ethics Opinion 388, "Attorneys' Use of Generative Artificial Intelligence in Client Matters," published April 2024. On the products: "Lawyers also should understand that many GAI products currently on the market are specifically designed to collect and use information received from users—which may include client confidences and secrets—for the GAI's own training and for transmission to future users of the technology." On the providers: "Most technology companies that provide these services make no secret of what they will do with any information submitted to them in connection with their publicly usable services: from their perspective, user inputs are theirs to use and share as they see fit." On lawyers: "Lawyers who input Client Confidential Information, or their mental impressions about a client matter, into GAI products—especially “free” ones—risk violating fundamental rules about client confidentiality." And on clients: "And clients are unlikely to give informed consent—and typically should not be asked to consent—to wide ranging disclosures that could waive attorney/client privilege or otherwise make their most confidential and secret information available for third parties to see and use." That is an ethics opinion's warning, not a ruling on privilege.
New York City Bar, Formal Opinion 2024-5, "Generative AI in the Practice of Law," 7 August 2024. Its footnotes carry the confidentiality points: "Lawyers may wish to obtain advance client consent to use Generative AI that will involve sharing of client information, but, because such consent must be knowing, the client must understand the potential consequences of such information-sharing for the consent to be effective."
None of these documents says a lawyer may or may not use a particular product, and this page does not infer one from the silence. Each sets conditions. Which conditions bind you is a matter of where you are admitted, what your client has instructed, and what your firm has decided.
Can ChatGPT be subpoenaed? Discovery and legal holds, as published
Two separate things get mixed up under this question: whether the vendor can be compelled to hand over your records, and whether you can be compelled to produce your own use of the tool in discovery. The published record on each:
- The vendor's records. OpenAI's privacy policy (updated 6 February 2026) says it may share Personal Data, "including information about your interaction with our Services, with government authorities, industry peers, or other third parties in compliance with the law (i) if required to do so to comply with a legal obligation, or in the good faith belief that such action is necessary to comply with a legal obligation," among other listed grounds. On retention it says: "If we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation." Anthropic's policy, quoted above, says the same in its own words.
- A legal hold, in OpenAI's own account. OpenAI's page on The New York Times litigation (published 5 June 2025, with an update dated 22 October 2025) says it was under "a legal order to retain consumer ChatGPT and API content indefinitely," that "our obligations under the earlier order ended on September 26, 2025," and that it "will securely store limited historical April–September 2025 user data," which "remains locked down, accessible only to a small, audited OpenAI legal and security team, and can't be used for anything other than meeting legal obligations." It adds: "This data will not be turned over to the New York Times, the Court, or anyone else at this time." The same page says the order did not apply to ChatGPT Enterprise or Edu, nor to API customers on Zero Data Retention endpoints.
- Your own use, in discovery. Warner is one court declining to order a litigant to produce how she used AI, calling the request "a fishing expedition." Heppner is one court ordering AI-generated documents produced over a privilege claim. There is no general rule yet; there are two orders.
OpenAI's help-centre article on deleting chats says that when you delete a chat, "OpenAI schedules it for permanent deletion from its systems within 30 days, unless it was already de-identified and disassociated from your account or OpenAI must retain it longer for security or legal obligations." What that last exception has meant in practice is the April–September 2025 hold above. Our guide to whether ChatGPT is confidential covers retention, training and who can see a chat, plan by plan.
What this page does not say
It does not say whether privilege or work product covers anything in your matter, whether a given product meets your bar's conditions, or whether a court outside the Southern District of New York or the Eastern District of Michigan will follow either ruling. It quotes the opinions through the firm alerts and memos that reproduce them, not from the dockets directly. It does not cover state-court rulings, non-US privilege rules, or the in-house context where the privilege analysis is different again. If any of that is your question, it is a question for counsel in your jurisdiction.
Where the client record lives: what Equerry does and does not do
Both rulings turn on who made a document, at whose direction and for what purpose. Behind that sits a more ordinary problem that no court will solve for you: knowing what each client actually said, sent and was promised, across the calls and threads of a matter, without pasting it all into something whose terms you have not read. That is the job Equerry does. It is a personal assistant who helps you get things done, built around the client record rather than the law. It reads only what you send it, one item at a time, plus your calendar, read-only, if you allow it. It never asks for your inbox, so the question for your firm is about specific things you chose to send, not an account.
| What you send | The thread with Oyelaran Freight's general counsel about the indemnity cap, with your own Equerry address on the CC line; the engagement letter she signed, shared as a PDF from your iPhone; a voice note you record in Equerry walking out of Tuesday's call, with what she asked for and what you said you would do. |
|---|---|
| What you ask | "What did Oyelaran's general counsel say about the indemnity cap on Tuesday, and what did I promise to send her before Friday?" |
| What you get back | The cap figure she gave, from the voice note; the date she wanted the revised draft by, from the thread; and what you said you would send, in your own words. When an answer draws on a note you saved, it carries a source chip: tap it to see the passage Equerry used and open the original. For the thread: What Equerry remembered from it is listed in Settings → Your memory, each line marked as from that email, and you can delete any line. |
The limits, plainly, because this page has spent its length on other people's terms. Equerry does no legal research, finds no cases and drafts no filings; nothing on this page about privilege or work product is a claim about it. It makes no claim that what you send it is privileged or confidential. What you send is processed so it can be searched and answered from, including by the outside AI providers named on our AI disclosure page, which says what each one receives and states that we never train AI models on what you save. Anyone on a CC'd thread can see Equerry's address on the CC line; forward instead where that would be unwelcome. It sends nothing, books nothing and buys nothing on your behalf. Read that disclosure page the way this guide reads OpenAI's and Anthropic's: as published terms, against your bar's conditions and your firm's policy, before any client material goes in.
Sources, all read 6 November 2026. United States v. Heppner, No. 25 CR. 503 (JSR) (S.D.N.Y. Feb. 17, 2026), as quoted in: Hunton Andrews Kurth, Court Rejects Privilege Claim Over AI-Generated Documents (17 February 2026); Morgan Lewis, When AI Meets Privilege: Early Court Decisions (18 February 2026); Proskauer, SDNY Addresses Privilege and Work Product Implications of Using Unsecured Public AI Tools (18 February 2026); Cleary Gottlieb, Courts Grapple with Privilege Implications of AI (27 February 2026); Paul, Weiss, Federal Courts Reach Different Outcomes on Whether AI-Generated Materials Warrant Work Product Protection (25 March 2026). Warner v. Gilbarco, Inc., No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026), as quoted in the Morgan Lewis, Cleary and Paul, Weiss pieces above. ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024). The State Bar of California, Standing Committee on Professional Responsibility and Conduct, Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law (2026 revision). D.C. Bar, Ethics Opinion 388 (April 2024). New York City Bar, Formal Opinion 2024-5 (7 August 2024). OpenAI, Privacy policy (updated 6 February 2026) and How we're responding to The New York Times' data demands (5 June 2025; update 22 October 2025) and OpenAI Help Center, Deleting and archiving chats in ChatGPT. Anthropic, Privacy Policy (effective 10 September 2026). Nothing on this page is legal advice.
Frequently asked questions
Does using AI waive attorney-client privilege?
No published ruling we have read answers that in general, and this page doesn't either. Two federal rulings in February 2026 went different ways on different facts. In United States v. Heppner (S.D.N.Y., written opinion 17 February 2026), Judge Rakoff held that documents a criminal defendant made with Claude on his own, without counsel's direction, were not privileged and not work product; Cleary Gottlieb's memo reports a footnote saying that even if the documents incorporated counsel's information, sharing it with Claude and Anthropic waived any privilege "just as if he had shared it with any other third party." In Warner v. Gilbarco (E.D. Mich., 10 February 2026), the court held that a self-represented plaintiff's AI-assisted litigation materials were work product, because AI programs "are tools, not persons." What applies to you depends on your facts, your court and your jurisdiction; that is a question for a lawyer, not a web page.
Are ChatGPT conversations privileged?
The one published ruling we have read says no. In Heppner the court wrote that the AI tool "is not an attorney" and that this alone disposed of the privilege claim, and, from the bench on 10 February as Morgan Lewis reports it, that the defendant had "disclosed it to a third-party, in effect, AI, which had no obligation of confidentiality." The same opinion said the analysis might differ if a lawyer had directed the use: "[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege." Whether that is so was not decided, and no later published ruling we have read settles it.
Can ChatGPT chats be subpoenaed?
OpenAI's own documents say its records can be reached by legal process. Its privacy policy (updated 6 February 2026) says OpenAI may share Personal Data, "including information about your interaction with our Services," with government authorities or other third parties "if required to do so to comply with a legal obligation," and that "if we are legally required to retain your data (for instance, we receive a lawful subpoena) then we may retain it for the duration of the relevant legal or regulatory obligation." In its own litigation with The New York Times, OpenAI was under a court order to retain consumer ChatGPT content; it says that order ended on 26 September 2025 and that it still stores "limited historical April–September 2025 user data" under legal hold. Whether a subpoena would be enforced against a particular chat is for a court, and depends on the arguments in that case.
What did United States v. Heppner decide?
United States v. Heppner, No. 25 CR. 503 (JSR), in the Southern District of New York. Judge Jed S. Rakoff ruled from the bench on 10 February 2026 and issued a written opinion on 17 February 2026. A criminal defendant had used Anthropic's Claude, after a grand jury subpoena and after retaining counsel, to generate 31 documents he later shared with his lawyers. The court held they were neither protected by attorney-client privilege nor work product: the tool "is not an attorney"; the documents "were prepared by the defendant on his own volition" rather than at counsel's direction; and the tool's privacy policy, as the court read it, contemplated disclosure to "governmental regulatory authorities." The court also wrote that "what matters for the attorney-client privilege is whether Heppner intended to obtain legal advice from Claude, not whether he later shared Claude's outputs with counsel."
Can a lawyer use Claude or ChatGPT on a client matter?
The bar opinions published so far set conditions rather than giving a yes or no, and this page reports them without adding a verdict. ABA Formal Opinion 512 (29 July 2024) says that before lawyers input information relating to a representation into a generative AI tool, "they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm," and that for self-learning tools "a client's informed consent is required prior to inputting information relating to the representation." The State Bar of California's 2026 Practical Guidance says "a lawyer must not input any confidential information of the client into a generative AI solution that may present material risks to confidentiality or security, absent informed client consent." Your own state's rules, any guidance it has issued, your client's instructions and your firm's policy are what apply to you.
Last updated 2026-11-06.
All product names, logos, and brands are property of their respective owners. Equerry is not affiliated with, endorsed by, or sponsored by any other product mentioned; comparisons are provided for informational purposes.