An AI chat can be protected by privilege or work product, but not always. Three US federal courts ruled on this in early 2026 and reached different results. What decided each case was who directed the AI use, and what the account's terms said about confidentiality. A lawyer controls both.
What Heppner decided
Bradley Heppner, a company executive, was charged with securities fraud. He used Claude to analyze his case and outline a defense, partly with information from his lawyers. He later shared the results with them.
The court refused privilege on three grounds. First, Claude is not a lawyer. In the judge's words, "Because Claude is not an attorney, that alone disposes of Heppner's claim of privilege." Second, the chats were not confidential. The consumer privacy policy he had accepted allowed the provider to use inputs for training and to disclose data to third parties, including government authorities. Third, he had not acted at his lawyers' direction.
Work product failed on that last point. It covers material prepared by or for counsel. Material a client produces alone does not qualify, even with a trial ahead.
A footnote goes further. Even if some of what he typed was privileged, the judge wrote, he waived it "by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party." The record on this point was thin. Some commentators still read it as putting the lawyers' own advice at risk.
Why the other two courts went the other way
In Warner and Morgan, the plaintiffs had no lawyer. Work product protects what a party prepares for litigation, so a party acting for themselves can claim it. The Warner court also rejected waiver. Waiver needs disclosure to an adversary, and AI programs "are tools, not persons."
Commentators explain most of the gap with one fact. Heppner had lawyers and did not involve them. The other two plaintiffs were acting as their own lawyers. None of the three decisions sets a general rule, and any of them could be overturned on appeal.
Your client is the one at risk
Read together, the rulings put the risk on a represented client who uses a consumer chatbot alone. That is an ordinary thing to do. An executive receives a memo from outside counsel and pastes it into a chatbot to understand it better. Under the Heppner footnote, that may waive privilege over the memo.
So the first fix belongs in the engagement letter and the first call. Tell clients in writing not to put your advice, or their account of the facts, into a consumer AI tool. If AI analysis would help, offer to direct it, and record that you did. In internal investigations, Orrick suggests adding the same instruction to the Upjohn warning. A short firm AI policy can carry the staff side of the rule.
Your own use is on the safer side, not a safe one
A lawyer's own AI work meets the test Heppner failed. Counsel does it, for the case. What remains open is the account. The court relied on a consumer privacy policy. Whether business terms change the result has not been tested, and Orrick and the International Bar Association both list it as an open question.
OpenAI and Anthropic say their business accounts are not used for training by default. That removes one of the facts the court cited. It does not settle the rest. In the US, ABA Formal Opinion 512 also asks for the client's informed consent before information about the case goes into a self-learning tool.
Send less in the first place
Privilege decides whether a chat can be used against the client. What the chat contains decides how much it reveals if it is.
With promptShield, names, addresses, account numbers and other identifiers become codes such as [P0ABCD] on your own computer, before a document goes to any AI tool. Within a folder, the same name keeps the same code, so the model can still follow who is who. Decode puts the real values back on your machine. Detection and redaction run locally by default. Only the optional Deep Analysis feature can be set to send page text to a remote model. How the codes work is explained separately.
This does not make anything privileged. It does not make a file non-confidential either: Model Rule 1.6 covers everything about the representation, and strategy or deal terms can identify a client without a single name. The code registry is a file on your machine, subject to the same rules as your other files.
Frequently asked questions
Are ChatGPT conversations protected by attorney-client privilege?
Not when a client has them alone on a consumer account, according to Heppner. A self-represented party's AI-assisted work was protected as work product in Warner and Morgan. No court has ruled on a lawyer's own use on a business account.
Does putting legal advice into an AI tool waive privilege?
Heppner says yes, in a footnote: sharing it with the AI provider is like sharing it with any other third party. Warner reasoned the opposite for work product, because a tool is not an adversary.
Is AI-assisted work protected if a lawyer directs it?
Probably on stronger ground, since counsel's direction was the missing fact in Heppner. It has not been tested yet, so document the direction.
Does a business AI account make chats confidential?
It removes the training clause the Heppner court relied on, but no court has ruled on business terms. Treat it as necessary, not sufficient.