Attorney-Client Privilege and Work-Product Protection: When Lawyers and Clients Use AI

By Mary J. Mazur

In 2023, when lawyers thought about generative artificial intelligence (“AI”), they feared that a bot would invent fake judicial citations. In 2026, lawyers fear that their client’s private AI prompts will be revealed through discovery.

In November 2022, OpenAI first released ChatGPT to the public. Since then, some lawyers’ use of AI has become routine: AI tools summarize depositions, draft correspondence, review contracts, organize discovery, and assist with legal research. Lawyers are increasingly aware that using AI technology can give them a competitive advantage.

A new line of legal decisions focuses on whether a client’s prompts and AI-generated materials are protected by the attorney-client privilege or work-product doctrine. In 2026, courts in New York, Michigan, Colorado, and Massachusetts reached different outcomes. Read together, the cases do not establish an “AI exception” to privilege or work-product protections. They show courts applying familiar doctrines to unfamiliar circumstances created by AI usage.

In sum, lawyers and law firms must control who uses AI, make counsel’s direction explicit, limit disclosure, and tell clients not to conduct independent AI investigations about their matters.

Four AI Decisions, One Traditional Framework

1. Litigant’s independent use of AI for legal strategy

In United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026), a represented criminal defendant independently used the consumer version of Claude to create approximately thirty-one documents concerning his legal exposure, possible defenses, and litigation strategy. Although the defendant had legal counsel and reportedly incorporated information received from legal counsel, he used the tool on his own initiative rather than at counsel’s direction. The court held that the exchanges were not protected by the attorney-client privilege or the work-product doctrine because the defendant was communicating with an AI provider and not with counsel for the purpose of obtaining legal advice. Sharing the materials afterwards with counsel also did not retroactively protect the earlier exchange. The work-product claim failed because the documents were not created by or at the direction of counsel and did not reflect counsel’s litigation strategy.

Therefore, a represented client should not independently use a public AI platform to analyze the representation. The resulting prompts and output are not protected merely because the subject is legal or the materials are later sent to counsel.

2. Self-represented litigant acting as her own advocate

During the same month as the initial Heppner ruling, a court in the Eastern District of Michigan reached a different result in Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026). The defendants sought discovery concerning a self-represented plaintiff’s use of AI tools in connection with her lawsuit. The court held that the requested material qualified for work-product protection.

The court held that work product is not limited to attorneys and that a self-represented litigant is both party and advocate. Her litigation-related drafting and analysis could therefore embody her protected thought process. The court also rejected the proposition that using an AI program automatically waived work-product protection. AI programs, it reasoned, are “tools, not persons,” and disclosure to a tool does not necessarily make the material likely to reach an adversary. Warner, 820 F. Supp. 3d at 634-637.

The court did not view conversations with AI as attorney-client privileged. Its analysis concerned work product, and the litigant’s self-represented posture mattered. The case demonstrates both the breadth and limits of the doctrine: a litigant’s own materials prepared in anticipation of litigation may qualify even without a lawyer, but that does not turn the AI provider into counsel.

3. Protected thought process, discoverable tool identity

In Morgan v. V2X, Inc., No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026), another self-represented litigant used AI in a federal case. The District of Colorado concluded that work-product protection could extend to AI interactions that revealed the litigant’s mental impressions, opinions, and theories. But the court required the litigant to identify the AI tool used in connection with confidential information and approved protective-order restrictions designed to safeguard that information. Morgan, No. 25-cv-01991-SKC-MDB at 2–7.

The distinction is useful. The substance of prompts and drafting may reveal protected litigation strategy; the identity of a vendor and its security characteristics ordinarily do not. A party may therefore have to disclose enough about its system to establish compliance with a protective order even when the substance of its analysis remains protected.

4. Litigant’s independent use of AI

A ruling by the Business Litigation Session in  Shealy v. Seaside Investments, LLC, No. 2684CV00799-BLS2 (Mass. Super. Ct. June 16 2026) brings the issue home to Massachusetts. After receiving a reservation-of-rights letter, the plaintiff sent the letter and transaction documents to his romantic partner. At his direction, she uploaded the materials to ChatGPT, generated a response letter and other documents, and emailed the results back to him. The plaintiff was represented by legal counsel, but counsel had no involvement in the AI use. The plaintiff withheld portions of the communications as work product, but the court ordered production.

Under Massachusetts Rule of Civil Procedure 26(b)(3), work-product must be prepared by or for a party or the party’s representative in anticipation of litigation. Although litigation was anticipated, the romantic partner was not a representative of the kind contemplated by the rule. She had no substantive role in the litigation and no connection to counsel. Treating her as a representative would expand the work-product doctrine without meaningful limitation.

The court also rejected the idea that ChatGPT itself was the plaintiff’s representative, noting that “AI is a tool not a person.” The AI output did not, standing alone, disclose the mental impressions, conclusions, opinions, or legal theories of an attorney or other representative. The court concluded that AI queries made by a party’s romantic partner—and the resulting output—were not protected because they were not performed at counsel’s direction. Shealy, No. 2684CV00799-BLS2 at 3–6.

Effects on the Attorney-Client Privilege and Work-Product Doctrines

1. Attorney-client privilege protects some but not all communications. A conversation is not privileged merely because it concerns a lawsuit, quotes a lawyer, or is later forwarded to counsel. The privilege generally requires confidential communication between privileged people for the purpose of obtaining or providing legal advice. An AI provider is not the client’s lawyer. Placing counsel’s advice into a consumer chatbot may also create a disclosure issue, depending on the platform’s terms, controls, and the circumstances.
2. Work-product protects qualifying preparation, but not everything generated during a dispute. The threshold questions are whether the material was prepared in anticipation of litigation and whether it was prepared by or for a party or a qualifying representative. Warner and Morgan recognize that a self-represented litigant can be both party and advocate. Heppner and Shealy emphasize that when a represented party independently recruits AI—or a friend or romantic partner—to perform legal analysis, the necessary connection to counsel or a qualifying litigation representative may be missing.
3. Counsel’s direction should be concrete and documented. Shealy makes direction of counsel a central dividing line. To the extent that a lawyer wants a client, employee, consultant, or vendor to use AI as part of litigation preparation – which is a decision that should be carefully considered in the first place– the lawyer should define the task, identify the person’s role, specify the approved system, and document that the work is being performed for counsel in anticipation of litigation. A label will not cure a workflow that does not satisfy the doctrine, but contemporaneous documentation can establish the facts on which protection depends.
4. Prompts and outputs may not receive identical treatment. A detailed prompt can reveal the author’s selection of facts, questions, assumptions, and legal theories. An output may merely reflect the model’s response. While Morgan treated litigation-related AI interactions as potentially revealing a self-represented litigant’s mental impressions, Shealy concluded that the output before it did not disclose the mental impressions of an attorney or representative. Firms should not assume that an entire chat will be protected—or unprotected—as a single unit.
5. Confidential vendor controls matter, but they do not create privilege by themselves. A contractual promise not to train on firm data, restricted workspace access, and defined retention periods can support confidentiality and reduce the likelihood of disclosure. However, it will not transform an independent client-AI exchange into a communication with counsel or make a romantic partner part of the litigation team. Technology controls support the legal relationship; they do not provide a substitute for it.
6. All firms should consider putting their AI expectations in writing. Consider drafting a formal policy. Even a short policy can identify approved tools, approved uses, prohibited information, verification requirements, retention rules, and training obligations. As part of the policy, consider including a directive to discuss approved AI use at the beginning of the lawyer-client relationship. For litigation work, add a privilege-and-work-product protocol.

Conclusion

Firms do not need to wait. They can act now by choosing and configuring an AI platform carefully, documenting counsel’s direction, restricting access, and instructing clients before they create an avoidable discovery problem. The technology may be new, but the protective habits are not.

Mary Mazur is the founder of Mazur Legal PLLC offering services in family law, estate planning, immigration, consumer protection and small business privacy compliance matters.