Privilege And AI: When AI-generated Documents Are Not Protected

What you need to know

Two recent US cases have considered whether communications involving AI tools are protected by attorney–client privilege or the work product doctrine. While these decisions arise under US law, the principles – particularly in relation to the possible loss of confidentiality and lack of requisite purpose – are informative for other jurisdictions, including Australia.

We expect further judicial scrutiny as AI use continues to increase across business, compliance and legal workflows. In the meantime, these cases reinforce that:

• care needs to be taken with use of public AI tools as there is a significant risk that privilege will not apply because confidentiality has been undermined;
• even when using private AI instances where confidentiality is protected, there is significant risk that communications between the business and the AI tool will not be privileged.
  • this includes situations where teams are querying AI tools for answers on legal questions, where teams do not have a dominant purpose of obtaining legal advice from a lawyer in querying those tools and obtaining the responses, or where the lawyer hasn't requested the work.
  • sharing AI outputs with lawyers later on (ie asking lawyers to provide views on the accuracy of the AI output) will not fix the problem.

For companies, consideration should be given to training teams to recognise when AI use may create risks for maintaining privilege, particularly in regulated or contentious contexts. Incorporating guardrails around the use of AI into communications protocols is also prudent.

What were the cases about?

United States v Heppner (Judge Jed Rakoff of the Southern District of New York, 17 February 2026)

In United States v Heppner, the court considered whether the defendant's communications with a public generative AI tool were protected by attorney-client privilege or the work product doctrine. At the time of the communications, the defendant, Mr Heppner, was under criminal investigation and used Anthropic's AI tool "Claude" to explore legal issues and defence strategy. The prompts and AI‑generated outputs were later shared with Mr Heppner's lawyers.

The court held that neither attorney-client privilege nor work product protection applied.

In relation to attorney-client privilege, the communications were held not to be privileged primarily because they were not communications between a client and a lawyer (or a lawyer's agent), and the use of a public AI platform undermined the necessary element of confidentiality. The court placed particular emphasis on the AI provider's terms, which permitted the collection, use and potential disclosure of both inputs and outputs to third parties, including regulators.

Work product protection was also rejected. Although the materials were created while litigation was reasonably anticipated, they were generated at the client's own initiative, not at the direction of counsel, and did not disclose counsel's strategy. The court noted that the purpose of the work product doctrine was to protect lawyers' mental processes. The fact that the AI outputs were later shared with lawyers did not convert them into protected material.

Warner v Gilbarco Inc (Magistrate Judge Anthony P Patti of the Eastern District of Michigan, 10 February 2026)

In Warner v Gilbarco, Inc, the plaintiff, who was self‑represented in a civil employment discrimination proceeding, used ChatGPT in preparing her case. The defendants sought discovery of all documents and information relating to the plaintiff's use of third‑party AI tools in connection with the litigation and argued that any attorney–client privilege or work product protection had been waived by the use of AI.

The court declined to order production of the AI‑related materials. It held that the requested information was not discoverable, and in any event, was protected by the work product doctrine on the basis that they had been prepared in anticipation of litigation. Importantly, the court rejected the argument that the mere use of ChatGPT amounted to a waiver of work product protection.

In doing so, the court distinguished work product from attorney-client privilege. Unlike attorney-client privilege, which may be waived by voluntary disclosure to a third party, work product protection is generally waived only where disclosure is made to an adversary or in circumstances likely to place the material in an adversary's hands. On the facts, the court was not persuaded that use of ChatGPT met that threshold.

How do these themes apply in an Australian context?

AI is not a lawyer – and communications with AI are not, without more, privileged

Heppner reaffirmed the foundational principle under US law that attorney–client privilege protects communications between a client and a lawyer for the purpose of obtaining legal advice. An AI system is not a lawyer and cannot, by itself, stand in the place of one.

Similarly, in Australia, where legal issues are discussed between non lawyers – whether between employees, or between a user and an AI tool – those communications will not attract LPP unless they are for the dominant purpose of obtaining or giving legal advice or use in existing or reasonably contemplated litigation.

This risk is acute where business teams use AI tools to:

• analyse legal exposure,
• develop defence strategies,
• assess regulatory compliance,
• "sense‑check" legal arguments,

and there is no "lawyer in the loop", in the sense that the lawyer has not asked for the analysis to occur, or the business team has not undertaken the work for the dominant purpose of seeking legal advice from a lawyer.

Sharing AI outputs with lawyers after the fact does not retroactively make the underlying communications privileged if the requisite purpose did not exist at the time the communication was prepared.

Confidentiality remains critical – public AI tools present particular risks

In Heppner, the court also placed significant weight on the lack of confidentiality inherent in the use of a public generative AI platform. There, the user had accepted platform terms that permitted:

• collection of both inputs and outputs,
• use of that data for model training, and
• disclosure to third parties, including regulators.

That was sufficient to undermine any claim to attorney-client privilege.

While communicating with ChatGPT was not fatal to the plaintiff's privilege claim in Warner, that was on the basis that a waiver of work-product privilege requires something more than the mere showing a voluntary disclosure to a third party.

Work product privilege in the US is similar in some respects to litigation privilege in Australia in that both require that the relevant documents be prepared in the context of actual or anticipated litigation. However, there are material differences, including the circumstances in which privilege can be waived.
In Australia, confidentiality is a necessary element of both legal advice and litigation privilege. Any act inconsistent with the maintenance of confidentiality is enough to risk a waiver. Accordingly, care needs to be taken with use of public AI tools.

Private or enterprise AI tools with stronger confidentiality protections reduce the risk of a loss of confidentiality.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.