A Comprehensive Analysis Of Liability Exposure And Attorney-Client Privilege
Risks When Generative AI Is Used To Develop Litigation Strategy
-Prepared by Shubhank Suman, AI, Privacy, and IP counsel
What this report covers:
This report explains the privilege and liability risks that arise when lawyers, clients, in-house teams, or litigants use generative AI tools like ChatGPT, Claude, Gemini, or similar platforms to develop litigation strategies. In simple terms, it covers:
- Why AI use in legal strategy is risky - Generative AI is increasingly used to draft arguments, analyse facts, prepare defence notes, review contracts, but this creates serious confidentiality and privilege concerns. Conversations with AI tools do not automatically attract attorney-client privilege because AI cannot form a lawyer-client relationship or owe professional confidentiality duties.
- Three-case framework: Heppner, Warner, and Morgan - The report compares U.S. v. Heppner where unsupervised use of free Claude destroyed privilege/work-product claims, Warner v. Gilbarco where AI-assisted litigation work was protected because AI was treated as a tool and disclosure to AI was not waiver, and Morgan v. V2X where AI use under litigation controls received work-product protection but required safeguards through a protective order.
- Work product: AI-assisted litigation materials need the right structure. The report explains that AI prompts, outputs, drafts, and strategy notes may be protected only when created for litigation, under counsel supervision, and kept confidential; casual or unsupervised AI use may leave them discoverable.
- Enterprise AI and contracts: individual subscriptions create waiver risk. The report highlights why legal teams should avoid consumer AI accounts for sensitive legal work and use enterprise tools backed by contracts covering confidentiality, non-training, retention/deletion, access controls, audit logs, and internal AI-use policies.
1. Introduction
The rapid adoption of generative artificial intelligence tools in legal practice has created a fundamental question: does using an AI platform to prepare legal materials protect those communications under the same legal doctrines that protect communications with a human lawyer?
The answer, based on two landmark rulings issued in February 2026 by federal courts in New York and Michigan, is clear: it depends entirely on the facts, but AI tools are never lawyers, and no attorney-client privilege attaches to conversations with any AI platform.
This report explains the two core legal protections, attorney-client privilege and work product doctrine, examines where AI fits into each framework, and provides practical guidance for legal professionals navigating this new landscape. The overarching lesson is this: the law has not changed. The same principles courts have applied for decades continue to govern. AI is simply a new tool to which those old rules now apply.
2. Understanding Attorney-Client Privilege
Attorney-client privilege is one of the oldest and most fundamental protections in the legal system. It allows a client to speak freely with their lawyer without fear that those conversations will later be used against them. The law protects this relationship because society benefits when clients are honest with their attorneys and lawyers can give complete, candid advice.
For the privilege to apply, four conditions must be met at the same time.
Condition | Meaning | What Breaks It |
|---|---|---|
Qualifying relationship | A real lawyer must be involved | Using an AI chatbot or non-lawyer advisor instead of a licensed attorney |
Legal advice | The communication must seek legal guidance | Asking for general information, business strategy, or factual research that is not legal advice |
Confidentiality | The conversation must be kept private | Sharing the communication with outside parties, or using a platform that discloses data to third parties |
Client's intent | The client must intend to seek legal counsel | Using a tool casually for research or drafting without involving counsel |
The most critical point for purposes of AI is the first condition. Attorney-client privilege requires a human attorney. An AI platform is not a lawyer. It is not licensed to practice law, cannot form an attorney-client relationship, owes no duty of confidentiality to the user, and is governed by a privacy policy, not by professional ethics rules. When a person types their legal problems into an AI chatbot, they are not communicating with counsel. They are communicating with software.
Practical Case Studies: Attorney-Client Privilege And AI
Case Study 1: The Self-Represented Defendant (United States V. Bradley Heppner, S.D.N.Y., 2026)
Facts- A criminal defendant, facing serious federal charges, used a publicly available generative AI platform to prepare documents outlining his potential legal defenses. He then forwarded these documents to his actual attorney. When the government sought to review those documents, the defendant claimed attorney-client privilege.
Ruling- The court rejected the claim entirely. The Southern District of New York held that communications with an AI platform are not communications with a lawyer. The platform had a privacy policy that explicitly stated it could share user data with third parties, including government authorities. There was no confidentiality. There was no attorney. There was no privilege. The fact that the defendant later sent the materials to his lawyer did not retroactively protect them.
Analysis: Forwarding AI-generated documents to your lawyer does not make those documents privileged. The protection must exist at the time of creation.
Case Study 2: In-House Counsel Using An Unsecured AI Tool For Contract Review
An in-house legal team at a corporation begins using a publicly available AI platform to analyze contracts and identify risk provisions. The team enters full contract text, including confidential deal terms, into the AI tool. During subsequent litigation, opposing counsel seeks discovery of all communications and inputs related to the contract review.
Because the AI platform retains user inputs and its privacy policy does not guarantee confidentiality, a court is likely to find no reasonable expectation of confidentiality. The privilege analysis would focus on whether the company took adequate steps to maintain the secrecy of the materials. Using a consumer-grade AI tool with a broad data retention policy likely destroys that expectation.
Analysis: Platform selection is a legal decision, not just a technology decision. Legal teams must review the privacy policies of any AI tool before using it in connection with client matters.
Case Study 3: A Client Who Prepares Before Meeting Their Lawyer
A client prepares for an initial consultation by listing all their concerns, facts, and questions in an AI chat interface, treating it like a journal. They print the output and bring it to their lawyer's office. Later, the opposing party seeks to obtain those printed notes.
The AI-generated notes are not privileged. The client was not communicating with a lawyer. However, once the client hands those notes to the lawyer, the lawyer's subsequent analysis, annotations, and strategy built upon that input may qualify as work product, depending on the circumstances.
Analysis: The privilege protects lawyer-client communication. Anything that happens before the lawyer is involved may be discoverable, regardless of the tool used to create it.
Landmark Cases: What The Courts Have Said
Three federal court rulings issued in early 2026 now form the foundation of the law governing AI use in litigation. Read together, they establish a coherent framework: the law has not changed, AI is a tool not a person, and whether protection attaches depends entirely on the facts of how the tool was used.
Feature | U.S. v. Heppner (S.D.N.Y., Feb 17, 2026) | Warner v. Gilbarco (E.D. Mich., Feb 10, 2026) | Morgan v. V2X (D. Colo., 2026) |
|---|---|---|---|
Who used AI? | Criminal defendant, acting alone without telling his lawyers | Pro se plaintiff in employment discrimination case | Litigant using AI under attorney direction |
AI platform | Free version of Claude (consumer tier) | Generative AI tool | AI used in connection with confidential litigation materials |
Protection claimed | Attorney-client privilege and work product | Work product doctrine | Work product doctrine |
Court's ruling | No protection. Every document ordered produced. | Work product protected. Motion to compel denied. | Work product protected. Protective order issued. |
Key reason | AI is not counsel. Free tier had no confidentiality. No attorney direction. | AI tools are instruments, not adversaries. Using them does not waive work product. | AI used under attorney direction reflected counsel's strategy. |
Additional holding | Sharing documents with counsel afterward does not retroactively confer privilege. | Compelling production of AI usage would expose mental impressions. No case law supported waiver. | Protective order: AI on confidential materials must be contractually barred from training on, retaining, or disclosing that data. |
Case 1: The Criminal Defendant Who Trusted A Chatbot (Heppner, 2026)
Bradley Heppner, facing federal criminal charges in New York, independently turned to a publicly available generative AI platform. He typed in details about his situation, asked the AI to help him think through his potential defenses, and saved the resulting documents. He later sent these documents to his defense attorney.
The government sought access to those documents. Heppner claimed they were protected. The court disagreed on both grounds. The AI was not a lawyer. The platform's own privacy policy stated it could share user data with government authorities. The communications were therefore not confidential. And because Heppner created the documents entirely on his own initiative without any instruction from counsel, they did not reflect his lawyer's mental processes or litigation strategy. The work product doctrine did not apply either.
The outcome was that the government obtained access to Heppner's own strategic thinking, documented in his own words, because he chose to create that record using an unprotected tool.
Case 2: Warner V. Gilbarco, Inc. (E.D. Mich., Feb 10, 2026)
A plaintiff representing herself in an employment discrimination case used a generative AI tool to help prepare her litigation materials. The defendants moved to compel production of everything related to her AI usage, arguing that using AI waived any applicable protections. Their waiver argument was supported by no case law but only a Law360 article posing rhetorical questions.
The Eastern District of Michigan denied the motion entirely. The court held that generative AI programs are tools, not persons, even if they may have administrators somewhere in the background. Disclosing litigation materials to a software tool is not the same as disclosing them to an adversary. Work product waiver requires disclosure to an opposing party or in a manner likely to reach one.
The court further held that compelling production of the plaintiff's AI usage information would expose her internal analysis and mental impressions, exactly what work product doctrine is designed to shield. The court described the defendants' pursuit as a fishing expedition and a distraction from the merits.
Work product protection travels with the content and the purpose, not the tool. Using AI to draft litigation materials does not hand your thinking to the other side.
Case Study 3: Morgan V. V2X (D. Colo., 2026)
In the District of Colorado, a court protected work product where AI had been used as a litigation drafting tool under attorney direction. The Morgan court then went further than any prior ruling by issuing a protective order establishing a specific standard for AI use in litigation involving confidential materials.
The order required that any AI used on confidential materials be contractually prohibited from training on, retaining, or disclosing that data. This is the first known court order directly translating the consumer versus enterprise AI distinction into a binding litigation requirement. The standard maps precisely onto the difference between a consumer-tier account, where training is permitted by default and third-party disclosure is allowed by policy, and a business or enterprise tier account, where training is off by default, disclosure is restricted, and contractual confidentiality is committed.
Morgan establishes that using the right tier of AI is not merely good practice. In some jurisdictions and some cases, it may now be a court-mandated obligation.
The Consumer AI Vs. Enterprise AI Distinction
The Heppner ruling turned in significant part on the data practices of the specific AI tool used. The free version of Claude permitted Anthropic to collect inputs and outputs for model training and disclose that data to third parties, including government authorities, without a subpoena. This is not unique to that platform. It reflects the standard architecture of consumer-tier AI products.
Courts examining AI use in litigation will now look at which tier of AI was used. The Morgan protective order has made this inquiry explicit. The distinction between consumer AI and business or enterprise AI is not a marketing distinction. It is a legal one.
Feature | Consumer AI (Free Tier) | Business and Enterprise AI |
|---|---|---|
Training on user inputs | Permitted by default | Off by default; contractually restricted |
Third-party data disclosure | Allowed by policy; may include government disclosure without subpoena | Restricted; subject to contractual confidentiality commitment |
Contractual confidentiality | None | Committed by contract |
Reasonable confidentiality expectation | None. Heppner shows courts will find this destroys any privilege claim. | Higher. Contractual protections support a stronger argument for reasonable expectation. |
Morgan standard compliance | Does NOT meet the Morgan protective order standard | Designed to meet or approach the Morgan standard |
Legal equivalence | Similar to using a public fax machine for confidential client documents | More similar to a legal SaaS platform already trusted with client data |
The practical recommendation emerging from all three cases is not to avoid AI entirely. It is to use the right environment, one whose terms put it in the same category as the legal SaaS platforms already trusted with client data. The choice of platform tier is now a legal judgment, not a budget decision.
The Morgan V. V2X Protective Order Standard
Morgan v. V2X represents the most forward-looking development in the 2026 case law. By issuing a protective order that directly governs which AI tools may be used on confidential litigation materials, the Colorado court moved from passive application of privilege doctrine to active regulation of litigation conduct.
The Morgan standard has three components. Any AI system used on confidential litigation materials must be contractually prohibited from training on that data. It must be contractually prohibited from retaining that data. And it must be contractually prohibited from disclosing that data. These three requirements directly mirror what business and enterprise AI tiers offer by contract and what consumer tiers generally do not.
Morgan Protective Order Requirement What This Means In Practice
AI must be contractually prohibited from training on the data | The platform agreement must explicitly bar the vendor from using your inputs to train or improve the model |
|---|---|
AI must be contractually prohibited from retaining the data | The platform must not store your inputs beyond the session or as permitted by express agreement |
AI must be contractually prohibited from disclosing the data | The platform must not share your inputs with third parties, including government authorities, without your consent and appropriate legal process |
Practitioners advising clients in the District of Colorado, or in any jurisdiction that may adopt the Morgan standard, must ensure that any AI tool used in connection with confidential litigation materials meets all three contractual requirements before use. Failure to do so may result in loss of work product protection, compelled production of materials, and potential sanctions.
Understanding Work Product Doctrine
A separate and equally important question remains, even if AI cannot function as counsel, can materials created with the assistance of AI still receive legal protection when they are prepared for litigation?
The answer, reflected in the recent federal decisions discussed in this report, is yes but only under the right circumstances. This is where the distinction between attorney-client privilege and work product doctrine becomes critical. Attorney-client privilege protects a relationship: the confidential relationship between a client and a licensed attorney for the purpose of seeking or receiving legal advice.
Work product doctrine, by contrast, protects a function: the preparation of materials, analysis, strategy, and mental impressions in anticipation of litigation. That difference matters greatly in the AI context. AI cannot create an attorney-client relationship, but AI may still be used as a tool in the litigation-preparation process.
Work product doctrine was established by the United States Supreme Court in Hickman v. Taylor and later codified in Federal Rule of Civil Procedure 26(b)(3). The doctrine is based on a simple but powerful principle: litigation should not allow one side to freely obtain the other side’s preparation, strategy, legal theories, draft arguments, or internal assessment of the case. If courts routinely compelled parties to disclose their litigation thinking, discovery would reward the unprepared party and penalize the party that had carefully developed its case. Work product protection therefore exists to preserve fairness in the adversarial process. This protection is broader than attorney-client privilege in an important respect. Attorney-client privilege generally requires communication with a licensed attorney. Work product doctrine does not.
Materials may qualify for work product protection if they are prepared in anticipation of litigation by a party, an attorney, a consultant, an investigator, an insurer, or another representative involved in the litigation effort. The central question is not whether every word was communicated to a lawyer. The central question is whether the material was created because litigation was pending, threatened, or reasonably anticipated. That distinction explains why AI must be analyzed differently under the two doctrines.
For attorney-client privilege, the use of AI generally fails at the threshold because the AI platform is not a lawyer, cannot form an attorney-client relationship, and owes no professional duty of confidentiality. This was the core lesson of United States v. Heppner. The defendant’s communications with the AI platform were not privileged because he was communicating with software, not counsel. His later decision to send those materials to his attorney did not retroactively transform them into privileged communications. But work product doctrine asks a different question. It asks whether the materials were prepared for litigation and whether disclosure occurred in a manner that exposed them to an adversary.
On that issue, AI use is not automatically fatal. If AI is used merely as a drafting, organizing, summarizing, or analytical tool in connection with litigation preparation, the resulting material may still reflect protected work product. The AI tool does not become the opposing party merely because it processed litigation-related text. This is the logic reflected in Warner v. Gilbarco. There, the court rejected the argument that a litigant’s use of generative AI automatically waived work product protection. The defendants attempted to compel production of materials related to the plaintiff’s AI use, effectively arguing that involvement of an AI tool opened the door to discovery.
The court disagreed. It treated generative AI as an instrument, not as a person, adversary, or opposing litigant. The court recognized that compelling production of AI-related drafting materials could expose the litigant’s internal analysis, strategy, and mental impressions, precisely the kind of material work product doctrine is designed to protect. The contrast between Heppner and Warner is therefore central to this report’s overall theme. Heppner shows that AI is not counsel. Warner shows that AI is not necessarily an adversary either. These two propositions can coexist. AI does not create attorney-client privilege, but the mere use of AI does not automatically waive work product protection. The legal consequence depends on the role AI played, the purpose for which it was used, the confidentiality of the platform, and whether the use increased the likelihood that the adversary would obtain the material. This is also where Morgan v. V2X becomes important. Morgan moves the analysis beyond the simple question of whether AI was used and focuses instead on how AI was used. The protective order in Morgan required that any AI system used on confidential litigation materials be contractually prohibited from training on, retaining, or disclosing that data. This standard directly connects work product protection with platform governance. It recognizes that an AI tool may be used in litigation, but only if the tool is deployed in a manner that preserves confidentiality and prevents adversarial access. The practical effect of Morgan is to turn platform selection into a legal judgment. A consumer AI tool that retains prompts, trains on user inputs, or permits broad third-party disclosure creates a serious risk that the user has failed to preserve confidentiality. By contrast, an enterprise or legal AI platform that contractually prohibits training, retention, and disclosure provides a stronger foundation for arguing that AI was used as a protected litigation-support tool. The issue is not whether the tool is called “AI.” The issue is whether the tool’s data practices are consistent with the preservation of work product protection. This distinction also explains why the standard for waiving work product protection is harder to satisfy than the standard for waiving attorney-client privilege.
Attorney-client privilege is often waived when a confidential communication is shared with a third party outside the privilege relationship. Work product protection is more durable. It is generally waived only when the material is disclosed to an adversary or disclosed in a way that substantially increases the likelihood that an adversary will obtain it. That is why courts have historically allowed work product materials to be shared with certain consultants, experts, investigators, insurers, litigation support vendors, and other representatives without automatically finding waiver. AI should be understood within that same framework. If AI functions like a secure litigation-support tool, assisting counsel or a party in preparing drafts, organizing facts, summarizing discovery, or testing legal theories, its use should not itself waive work product protection. But if AI functions like an uncontrolled public channel, retaining sensitive inputs, training on litigation strategy, or allowing disclosure to third parties then the work product claim becomes much weaker. The problem is not the presence of AI in the workflow. The problem is the absence of safeguards.
Feature | Attorney-Client Privilege | Work Product Doctrine |
|---|---|---|
Requires a lawyer? | Yes, always | No, a party or representative can create it |
What does it protect? | Confidential communications seeking legal advice | Materials prepared in anticipation of litigation |
How is it waived? | Disclosure to any third party outside the privilege circle | Disclosure to an adversary or in a manner likely to reach an adversary |
Does AI use waive it? | Yes, if the AI platform is not a lawyer and has no confidentiality | No, if the AI tool is not an adversary (Warner v. Gilbarco) |
Strongest protection | Direct communication with a licensed attorney | Materials created at the direction of counsel reflecting legal strategy |
The standard for waiving work product protection is significantly harder to meet than the standard for waiving attorney-client privilege. Using an AI tool to draft litigation materials does not, by itself, constitute a disclosure to an adversary. Courts have described AI tools as instruments, not persons, and using a tool to assist in drafting is no different from using a word processor or a legal research database.
Key Takeaways-
The three 2026 decisions, taken together with the Morgan protective order standard, point directly toward the following guidance.
Situation | Required Action |
|---|---|
Choosing an AI tool for legal matters | Read the privacy policy before use. Confirm training is off, disclosure is restricted, and contractual confidentiality is committed. If those three protections are absent, do not use the tool for client matters. Consumer free tiers do not meet this standard. |
Client using AI independently before or during representation | Advise clients explicitly that AI-generated materials created without counsel's direction are not privileged and may be discoverable. Heppner shows that even |
having retained lawyers does not protect AI work done independently. The protection must be built in at the point of creation. | |
Using AI to draft litigation documents | Ensure the drafting is done at counsel's direction. Document that fact in your file. Use a platform meeting the Morgan standard. Keep records showing the AI was used as a tool, not as a substitute for legal judgment. |
Opposing party's AI usage in discovery | Focus on whether the AI usage involved actual disclosure to adversaries, not simply the use of a tool. Warner and Morgan both show courts will reject fishing expeditions into a party's internal drafting process. Base any motion on specific evidence of adversarial exposure. |
Litigation in jurisdictions following Morgan | Before using any AI tool on confidential litigation materials, confirm it is contractually prohibited from training on, retaining, or disclosing that data. This is now potentially a court-enforceable obligation, not merely best practice. |