Product

Solutions

Security

Company

Resources

Request a Demo

Product

Solutions

Security

Company

Resources

Request a Demo

Article

2026-09-18

Is AI use privileged? What Heppner, Warner and Morgan mean for litigators

Three federal rulings this year reached different results on protection for AI prompts and outputs. Heppner rejected protection for a client’s solo use of a consumer tool, while Warner and Morgan protected work product, with practical consequences for counsel-directed use, tool selection and protective orders.

The attachment arrives before Monday’s client call: a twelve-page “timeline and strategy memo”, complete with headings and proposed arguments. Over the weekend, the client pasted emails and a demand letter into a free consumer AI chatbot; counsel had requested none of it. Three weeks later, a document request seeks “all communications with any artificial intelligence tool concerning the subject matter of this action”. Counsel now has to assess both that memo and the team’s own AI-assisted work.

AI use alone creates no privilege. Protection depends on who did the work, counsel’s direction, its litigation purpose and the confidentiality terms. Heppner denied protection for a client’s independent consumer AI use; Warner and Morgan protected AI-assisted work product. At Turbo Law, we support counsel-directed work within the matter under written confidentiality terms. The law remains unsettled.

What did the court decide in United States v. Heppner?

Neither attorney-client privilege nor work product protected the defendant’s AI materials. Judge Jed S. Rakoff announced that ruling in United States v. Heppner, No. 1:25-cr-00503-JSR, in the Southern District of New York on February 10, 2026; the written memorandum followed on February 17.

Before indictment, the defendant had used a consumer generative AI platform to develop defense strategy reports, drawing partly on information received from counsel. His lawyers had not assigned the work. He sent them the outputs afterward.

That sequence mattered.

Attorney-client privilege failed at several points. The platform was not a lawyer, and the exchanges were not made to obtain legal advice from counsel. Nor did its privacy policy support a reasonable expectation of confidentiality: inputs and outputs could be used for training and shared with third parties. Forwarding the finished reports to lawyers did not make those earlier exchanges privileged.

For work product, the court focused on the absence of attorney preparation or direction and found that the materials did not reflect counsel’s mental processes. It disagreed with Shih v. Petal Card, Inc., 565 F. Supp. 3d 557 (S.D.N.Y. 2021), on protection without attorney direction. As Akin’s February 24, 2026 analysis explains, counsel-directed use and closed enterprise tools remained open questions.

What did the court decide in United States v. Heppner?

That sequence mattered.

Why did Warner and Morgan protect AI-assisted work product?

Both courts recognized civil work-product protection for self-represented litigants and refused to treat AI use as an automatic waiver. Neither held that an AI conversation was a privileged lawyer-client communication.

Keep the doctrines separate. Attorney-client privilege generally protects confidential communications for legal advice between lawyer and client; voluntary third-party disclosure ordinarily waives it, subject to exceptions. Work product protects qualifying litigation preparation, with disclosure-based waiver generally turning on whether material reached an adversary or was shared in circumstances substantially increasing that likelihood.

In Warner v. Gilbarco, Inc., No. 2:24-cv-12333, ECF No. 94 (E.D. Mich. February 10, 2026), Magistrate Judge Anthony P. Patti denied discovery into a pro se employment plaintiff’s AI-assisted preparation. Her mental impressions were protected work product. AI programs “are tools, not persons”, the court said, rejecting the waiver argument and describing the request as a fishing expedition.

The result in Morgan v. V2X, Inc., No. 1:25-cv-01991-SKC-MDB, ECF No. 65 (D. Colo. March 30, 2026) needs a closer read. Magistrate Judge Maritza Dominguez Braswell protected another pro se employment plaintiff’s work under Federal Rule of Civil Procedure 26(b)(3), declining to equate provider access with automatic waiver.

But the tool’s identity was discoverable.

The plaintiff had ten days to identify any platform used with information designated CONFIDENTIAL. Work-product protection for his analysis did not excuse that disclosure.

Does it matter whether a lawyer directed the AI use?

Counsel’s direction matters, but it is neither an established universal prerequisite nor a guarantee of protection. As of September 18, 2026, no appellate guidance had resolved these differing approaches.

Start with the rule’s words. Federal Rule of Civil Procedure 26(b)(3) reaches qualifying materials prepared “by or for another party or its representative”, language that accommodates a party’s own litigation preparation. Morgan distinguished Heppner’s criminal setting, where the Federal Rules of Civil Procedure did not govern.

A represented civil litigant working independently with AI falls into an unresolved gap. Neither civil ruling squarely decided that situation, as Mintz’s April 29, 2026 analysis explains.

We think the safer habit is a written assignment before anyone begins: identify the litigation purpose and approved tool, specify what may be entered, and name the reviewer. This records counsel’s actual involvement. A privilege heading cannot supply missing facts.

Give clients instructions early, too. Ask them to consult counsel before entering case facts or correspondence into consumer AI, especially legal advice. Where an upload has already happened, establish what went in and which terms applied, preserving potentially relevant material while evaluating protection.

Which AI tools keep client information confidential enough?

Only a review of the agreement and actual data handling can answer that question. A paid account proves very little. An “enterprise” label does not establish privilege or tell counsel who can access an uploaded demand letter.

ABA Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024), calls for assessment of disclosure and access risks. Before representation-related information goes into a self-learning tool whose operation risks disclosure, lawyers must obtain informed client consent. Engagement-letter boilerplate is insufficient. Counsel needs to understand the terms and explain the relevant risks.

The duty already exists under ABA Model Rule 1.6(c): make reasonable efforts to prevent unauthorized access or disclosure. Florida Bar Ethics Opinion 24-1 (January 19, 2024) likewise directs attention to confidentiality, including whether providers retain or use submitted information.

Before approving a tool, we would get written answers:

Training: What contractual language prohibits training or model improvement using client inputs?
Third-party disclosure: Is sharing confined to necessary service delivery, with equally protective obligations imposed on recipients?
Provider access: Who can reach matter data, for what purpose, and who approves that access?
Logging: Can the firm export records showing access, queries and exports?
Retention: What survives an assignment or account closure, including in backups, and how do deletion terms fit preservation duties?
Isolation: How is the client’s information separated from other customers’ data?

Save the applicable agreement and settings with the approval record. If counsel later needs to establish the conditions surrounding an upload, a screenshot taken after the dispute begins may leave that question unanswered.

California Senate Bill 574, pending before the governor as of September 18, 2026, would prohibit attorneys from entering private client information into nonconfidential AI tools, according to the California Courts Newsroom’s September 3 report.

What AI terms are showing up in protective orders?

Morgan restricted what parties could upload while preserving work-product protection and requiring disclosure of the tool’s identity. Those obligations operated together.

Under its amended order, CONFIDENTIAL information could not enter a platform unless the provider was contractually prohibited from storing or using inputs to train or improve its model, and from disclosing inputs except where essential to service delivery. Necessary service recipients had to be bound by equally protective terms. Those were only part of the order’s requirements.

Raise AI terms at the Rule 26(f) conference. We would also address how AI-generated material fits the privilege-log protocol: Rule 26(b)(5)(A) requires an express claim of protection and enough description to permit assessment without exposing protected content.

A Federal Rule of Evidence 502(d) order can separately address nonwaiver for disclosures connected with the litigation. Negotiate it alongside the AI provisions; it does not authorize uploads forbidden by the protective order.

How does counsel-directed AI work run inside a confidential matter workspace?

Counsel directs assignments inside our workspace after the legal team brings in the matter file. The firm’s DMS remains the system of record. Our workspace connects to it.

Through Review, we read the whole file, including pleadings and productions, correspondence, deposition transcripts, expert reports and work the team has already prepared. Facts and their relationships form a connected picture of the case: people, events, documents, issues and discrepancies remain linked to source pages and lines.

New records update that picture. It adapts to the case type, giving review, drafting, research and reporting shared case context. First-pass attorney-client and work-product flags identify candidates for counsel to assess; the lawyer decides whether protection applies.

The data handling is documented. Our Security commitments prohibit training on client data through contractual and technical controls, with client environments logically isolated. Staff access requires an explicit support ticket and client-side approval. Every access, query and export is logged and exportable.

Assignment records provide another part of the file. Our Assistant records what was asked, what it read and what it produced, giving counsel evidence of direction and review alongside the access records. It prepares cited work product for attorney review. It does not serve, file or send.

Compare those commitments with the actual order, including one like Morgan’s. We do not claim that the workspace satisfies any particular protective order or ethics opinion, and confidentiality alone cannot make material privileged. We neither make privilege calls nor give legal advice; counsel must apply the governing jurisdiction’s law to the facts.

FAQ

Can opposing counsel discover my AI prompts and outputs?

Some may be discoverable, depending on relevance and proportionality and whether privilege or work product applies. Under Rule 26, even ordinary work product may be discoverable upon the required showing of substantial need and undue hardship, while qualifying mental impressions receive protection.

Does using a consumer AI tool waive attorney-client privilege?

Disclosure under terms allowing further use or sharing can jeopardize privilege. Heppner also presented an earlier problem: the AI exchanges themselves were not privileged lawyer-client communications. Sending the output to counsel afterward did not fix that. Assess the original exchange before relying on the later email.

Is AI use protected if it runs in an enterprise tool?

The label supplies no automatic protection. Confidentiality terms matter, but counsel must still examine the communication’s purpose and circumstances, including its participants. Work product requires its own analysis of qualifying litigation preparation.

Do I have to disclose which AI tool I used?

Morgan required identification of platforms used with CONFIDENTIAL information despite protecting the plaintiff’s analysis; it did not establish a disclosure requirement for every AI use. Before the next upload, compare the tool agreement with the governing protective order and record counsel’s authorization.