Federal Courts Split on Whether Using AI Waives Attorney-Client Privilege

The legal profession is built on a foundation of absolute secrecy. For centuries, the attorney-client privilege has guaranteed that what a client tells their lawyer cannot be used against them in court, fostering an environment of total candor. But the rapid, ubiquitous adoption of generative artificial intelligence has violently collided with this ancient doctrine, sparking a high-stakes existential question for the justice system: Does typing your legal strategy into a chatbot waive your right to confidentiality? As lawyers and clients alike integrate large language models into their daily workflows to summarize documents and draft arguments, they may unknowingly be handing their most sensitive secrets to their adversaries.[1][7]

In early 2026, this theoretical debate erupted into a formal judicial conflict. On the exact same day in February, two federal courts handed down diametrically opposed rulings on whether using AI tools destroys legal protections. This emerging circuit split has sent shockwaves through law firms and corporate legal departments across the country. It leaves litigators to navigate a doctrinal minefield where a single prompt could expose their entire case strategy. The conflicting decisions highlight how the law is struggling to keep pace with technological innovation, forcing judges to apply centuries-old evidentiary rules to cloud-based neural networks.[3][6]

The threat to legal confidentiality was starkly illustrated in the Southern District of New York in the case of United States v. Heppner. The defendant, a financial services executive facing severe federal fraud charges, utilized Anthropic's public AI tool, Claude, to analyze his legal exposure and draft comprehensive defense strategies. When federal agents executed a search warrant and seized his electronic devices, they discovered thirty-one documents generated through his interactions with the AI platform. The government immediately moved to compel the production of these documents, arguing that the AI-generated files were not privileged and could be used as direct evidence against him in court.[3][5]

Judge Jed S. Rakoff agreed with the government, delivering a decisive bench ruling that stripped the documents of both attorney-client privilege and work-product protection. The court's reasoning was blunt and structural: an AI platform is a machine, not a lawyer, and therefore cannot form a legally binding attorney-client relationship. More importantly, because the defendant used a public-facing AI tool whose privacy policy explicitly allowed user inputs to be retained and potentially used for future model training, the court ruled he had forfeited any 'reasonable expectation of confidentiality.' By sharing his secrets with the platform, he had effectively broadcast them to a third party.[3][5]

Yet, hundreds of miles away in the Eastern District of Michigan, a different federal judge reached the exact opposite conclusion in the civil case Warner v. Gilbarco, Inc. In this instance, a litigant representing himself used a public AI chatbot to prepare his litigation materials and organize his arguments. When the opposing side discovered this and attempted to compel the production of those AI-generated documents during discovery, the court firmly blocked the request. The judge ruled that the materials remained fully protected, setting up a direct ideological clash with the New York court's interpretation of digital privacy.[4][6]

The Michigan court anchored its decision in the fundamental nature of the technology itself, declaring that generative AI programs are 'tools, not persons.' The judge reasoned that inputting data into an AI platform's interface is not legally equivalent to disclosing secrets to a human third-party eavesdropper. Because the work-product doctrine is generally only waived when materials are shared directly with an adversary—or in a manner highly likely to reach an adversary—the court concluded that the AI's internal data processing and server storage did not constitute a waiver of legal protections.[4][6]

To fully understand this judicial collision, one must parse the mechanical differences between the two legal doctrines at play. The attorney-client privilege is notoriously fragile; it strictly protects communications between a lawyer and a client, but it is instantly destroyed if a third party is allowed to listen in. If a court views an AI company—or its server architecture—as a third-party eavesdropper, the privilege evaporates the moment the user hits the 'send' button. This strict standard makes attorney-client privilege highly vulnerable to modern cloud computing environments.[2][5]

The work-product doctrine, however, is significantly more resilient. It is designed to protect materials prepared specifically in anticipation of litigation, shielding a lawyer's mental impressions, conclusions, and trial strategies from the opposing side. Unlike attorney-client privilege, work-product protection survives incidental disclosure to third parties, provided that the disclosure does not substantially increase the risk that the adversary will obtain the information. This crucial distinction explains why the Michigan court was able to save the AI documents under the work-product doctrine, while the New York court struck them down under the stricter privilege standard.[2][4]

The circuit split has forced the legal community to confront the underlying architecture of generative AI. Historically, lawyers used software like Microsoft Word, Excel, or Westlaw without any fear of waiving privilege, because those tools were passive local applications or highly secure, closed databases. But public generative AI models are fundamentally different entities. They actively ingest user inputs, process them on external servers, and often retain that data to train future iterations of the model, creating a permanent digital footprint of the user's thought process.[2][7]

This active data-retention mechanism is the absolute crux of the confidentiality crisis. If an AI platform's terms of service allow it to review user prompts, share them with human reviewers for quality control, or use them for algorithmic training, courts are increasingly likely to rule that the user has voluntarily disclosed their secrets. The New York City Bar Association recently issued a comprehensive report warning that market participants must understand these underlying data flows, noting that the specific terms of service of the AI platform will be the deciding factor in any future privilege dispute.[2][6]

In response to this paralyzing uncertainty, a clear dividing line is emerging between consumer-grade and enterprise-grade artificial intelligence. Legal experts and professional associations are urgently advising law firms to abandon public chatbots entirely in favor of closed-loop, enterprise AI systems. These enterprise platforms operate under strict data processing agreements that contractually guarantee user inputs will not be used for model training or accessed by the AI provider. By eliminating the third-party data risk, these systems attempt to preserve the expectation of confidentiality required by the courts.[4][7]

The procedural landscape of litigation is already shifting rapidly to accommodate this new technological reality. Federal judges across the country are proactively updating standard protective orders to address the unique privacy risks of artificial intelligence. Some courts have even begun issuing blanket prohibitions on the use of public AI tools for any discovery materials, mandating that litigants either use closed enterprise systems or risk severe judicial sanctions for unauthorized data exposure. The era of unregulated AI use in legal discovery is effectively over.[4][7]

This technological shift also deeply implicates the ethical obligations of practicing attorneys. The American Bar Association explicitly requires lawyers to maintain technological competence, meaning they cannot simply ignore artificial intelligence or refuse to understand how it works. However, this duty to innovate is now directly at odds with their ironclad duty of client confidentiality. Litigators must now act as amateur technologists, rigorously auditing the data architecture, server locations, and privacy policies of any software they deploy in their daily practice.[1][2]

The factual nuances of the early 2026 cases leave several critical questions unanswered for the broader legal industry. In the Michigan case, the litigant was acting pro se—representing himself—which legally merges the roles of client and attorney and complicates the standard privilege analysis. In the New York criminal case, the defendant used the AI independently, without the explicit direction or supervision of his counsel. It remains entirely to be seen how appellate courts will rule when a fully retained, licensed attorney uses a public AI tool on behalf of a corporate client.[2][6]

As these foundational cases inevitably march toward the federal appellate courts, the legal industry remains in a precarious state of suspended animation. The eventual resolution of this circuit split will dictate the future of legal technology for decades to come. It will ultimately determine whether artificial intelligence becomes an indispensable, protected partner in the pursuit of justice, or a fatal liability that strips litigants of their most fundamental constitutional protections. Until the Supreme Court weighs in, every AI prompt carries a hidden legal risk.[6][7]