Still In The Blast Zone: A New Ruling Deflects Some Of The Privilege Bomb's Shrapnel, But Businesses Still Need To Suit Up

In our prior article, we wrote about United States v. Heppner – a ruling that detonated like a [privilege] bomb across the legal and business communities. The blast radius has the potential to extend to every individual and employee who has ever typed a legal question into a public AI tool.

The shrapnel flew fast and far, and some fragments wound both sides. Which is why a subsequent federal ruling, Warner v. Gilbarco, Inc. out of Michigan, matters. It did not defuse the original bomb, and it did not neutralize the threat. But it intercepted a meaningful fragment of shrapnel and redirected it, creating two incompatible frameworks that create even more uncertainty.

Until appellate courts draw clearer lines, the strict protective posture and practical steps we recommended after Heppner remain the safest route for any organization operating in the blast zone. That said, it is important to understand the distinctions between these two rulings and their practical implications for privilege protection.

The Blast Radius: What Heppner Detonated

For those coming to this issue fresh, here is what the Heppner court found and why it reverberated through boardrooms and law firms alike. Judge Jed Rakoff of the Southern District of New York ruled that AI-generated documents created without attorney direction are not shielded from discovery. Even worse, privileged advice that Heppner had received from his own counsel lost its protection the moment he fed it into Claude, an AI chatbot. Heppner had used Claude on his own initiative, feeding in information from his lawyers and generating strategy documents he later shared with counsel. He argued those documents should be protected under the attorney-client privilege and work product doctrines. The court said no, for three reasons that carry well beyond that courtroom:

• AI is not your attorney. Attorney-client privilege requires an actual attorney- client relationship. Chatbots do not qualify, and discussing legal issues with a non-attorney is not protected.
• Privilege waived is privilege gone. Claude’s consumer privacy policy permitted Anthropic to collect user inputs and outputs, use them to train the model, and disclose them to third parties. According to the court, there was no reasonable expectation of confidentiality. The court also held that already-privileged information-advice Heppner had received from counsel and then fed into Claude-lost its protection the moment it entered the chatbot.
• No attorney direction. Work product protection covers documents and tangible things prepared in anticipation of litigation or for trial by or for a party or its representative. The court in Heppner centered work product protection on materials prepared by or at the direction of counsel. Heppner’s lawyers had not suggested, directed, or supervised his Claude sessions. He acted alone, and so the court found the work product doctrine did not apply. It is important to note that the court did not find waiver; it found the work product doctrine inapplicable because the materials did not qualify as work product in the first place.

The takeaway from Heppner: public AI tools are third parties, and sharing protected information with them is legally indistinguishable from handing a confidential memo or attorney-client communication to a stranger.

The Deflection: What Warner Changed

Enter Warner v. Gilbarco, Inc., where Magistrate Judge Anthony Patti of the Eastern District of Michigan confronted a related but materially different scenario. The plaintiff was a pro se litigant (representing herself without an attorney) who used ChatGPT to help prepare her court filings. The defendants moved to compel production of all her AI prompts, outputs, and activity logs, arguing that using an AI tool had waived any work product protection she might otherwise have had. Judge Patti denied the motion, finding that:

• AI is a tool, not a third party. This is the most significant deflection and directly contradicts Heppner’s holding. ChatGPT is software. The court found that disclosing your thoughts to a software tool is not the same as disclosing them to a person. The court noted that there may be administrators somewhere in the background, but that is equally true of email, cloud storage, and legal research platforms.
• Work product is more durable than privilege. Attorney-client privilege and work product doctrine are not the same thing. Privilege is fragile, easily waived by voluntary disclosure to any third party. Work product is more durable: while jurisdictions differ on waiver standards, many courts hold that it is waived only by disclosure to an adversary or in a manner likely to reach one. Warner embraces that view. The Warner court found using an AI drafting tool does not cross that threshold.
• Compelling AI prompts would destroy protection for modern litigation workflows. Forcing production of every drafting interaction with an AI tool would effectively eliminate work product protection across the entire practice of litigation.
• Pro se litigants can assert their own work product protection. Because Warner proceeded pro se (representing herself), her ChatGPT-assisted drafting was prepared in anticipation of litigation by a party functioning as her own attorney. This satisfied the work product standard without separate attorney direction, and the protection attached.

Result: Warner intercepted real fragments, most importantly the distinction between privilege and work product, and the refusal to treat AI software as a human third party capable of receiving confidential disclosures. But it did not disarm Heppner. The two rulings coexist in uneasy tension, and the debris field is wider than either court acknowledged.

Live Mines: What Neither Court Has Resolved

Even read together, Heppner and Warner leave dangerous ground unresolved. On their specific facts, both rulings may be correct. Heppner was a represented criminal defendant who used a consumer AI tool without his lawyer’s involvement. Warner was a pro se plaintiff functioning as her own counsel. Those facts diverge sharply. But both courts made categorical statements and created frameworks that travel well beyond their specific circumstances, and they point in opposite directions.

• Is AI a third party or a tool? Heppner says third party. Warner says tool. Only one can be right as a matter of doctrine. If AI is a third party, privilege is destroyed every time an employee uses a public AI tool, even if governed by a data protection agreement that bars training on user data and restricts disclosure to third parties. If AI is a tool, the core of Heppner’s confidentiality analysis cannot survive appellate scrutiny. A court-almost certainly an appellate court-will eventually have to choose, and until it does, every organization is operating on uncertain ground.
• Is attorney direction required for work product protection? The doctrine’s text does not impose a universal attorney-direction requirement. Heppner’s Second Circuit-centered analysis makes attorney involvement decisive on its facts and emphasizes materials prepared by or at the direction of counsel or reflecting counsel’s strategy. Other courts have protected party-created materials prepared in anticipation of litigation without separate attorney direction. This requirement may ultimately vary by jurisdiction and depend on fact-specific decisions around whether materials were prepared “in anticipation of litigation.”
• Are enterprise terms enough to preserve protection? Neither court addressed what happens when AI use is governed by negotiated data protection terms that prohibit training on user data and restrict third-party disclosure – the very vulnerabilities that destroyed Heppner’s privilege claim. The confidentiality analysis matters on two fronts: it is essential to preserve attorney-client privilege, and it can also bear on work product waiver in jurisdictions where disclosure that increases the risk of adversary access may defeat protection. That case is coming, and when it lands, courts will have to decide whether contractual safeguards can restore the reasonable expectation of confidentiality that consumer terms destroyed.

Conclusion

Heppner and Warner reach fundamentally incompatible conclusions-one treats AI as a third party that destroys confidentiality, the other treats it as a tool that preserves work product protection. Until appellate courts resolve this doctrinal conflict, businesses face genuine uncertainty: AI-specific discovery requests are already landing in litigation, with Heppner cited to compel production and Warner invoked to resist it. In this unsettled landscape, the practical recommendations we outlined following the Heppner decision remain the safest course of action for any organization seeking to protect privileged materials and work product when using AI tools.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.