Somewhere in your firm right now, a professional is drafting a memo or a client analysis inside a generative AI tool, and the record of that work sits on a server the firm does not control. Courts have started deciding whether that record is privileged, and the first answer came from reading the vendor’s privacy policy.
A federal court read the terms of service and found no confidentiality to protect
In United States v. Heppner, a securities-fraud prosecution in the Southern District of New York, agents searching the defendant’s home seized about 31 documents recording his exchanges with the consumer version of an AI assistant. He had used the tool on his own, without his lawyers’ involvement, to prepare reports that “outlined defense strategy,” and he claimed both attorney-client privilege and work-product protection over them. Judge Jed Rakoff rejected both claims from the bench on February 10, 2026, and in a written opinion a week later. O’Melveny’s analysis of the ruling sets out the reasoning.
The tool is not an attorney, so there was no attorney-client communication. The exchanges were not confidential, because the provider’s privacy policy reserved the right to disclose user data to third parties, including regulators, and to train on inputs and outputs; users were “clearly” on notice, and the court found “no reasonable expectation of confidentiality.” The work-product claim failed because counsel had neither prepared nor directed the documents.
Two features of the opinion matter more than the result. The privacy policy was the deciding document: the court asked what the terms said, not whether the defendant felt his drafts were private. And the court left open whether the outcome would differ if counsel had directed the client to use the platform. Those two openings, the terms and who directed the work, are where every later decision has turned.
The logs exist, they persist, and courts are already ordering them produced
The privilege question is only live because the records survive. In May 2025, Magistrate Judge Ona Wang ordered OpenAI to “preserve and segregate all output log data (i.e., ChatGPT chat data)” in The New York Times copyright litigation, “regardless of whether OpenAI has committed to delete such data in its consumer-facing policies.” Loeb & Loeb’s note on that order advised businesses to review their OpenAI contracts for confidentiality protections over inputs and outputs, limits on training use, and notice before disclosure. The same review applies to every AI vendor a firm uses.
Then the logs moved. On January 5, 2026, District Judge Sidney Stein affirmed an order requiring OpenAI to produce a sample of 20 million de-identified conversation logs, 0.5% of its preserved logs, to the plaintiffs under a protective order. Jones Walker’s account of the ruling records the court’s view that users’ privacy interests were “sincere” but adequately protected, and its reasoning that ChatGPT users “voluntarily submitted their communications” to the provider. None of those users was a party. Their conversations became evidence in someone else’s case because a party stored them. If your professionals draft in a consumer tool, the firm’s work product is in that pool.
Privilege was never a property of the document. It is a property of the circumstances, and the tool’s terms are now one of them.
Privilege was never a property of the document. It is a property of the circumstances, and the tool’s terms are now one of them.
Other courts have protected AI work product, and their conditions are your control set
Heppner is not the only word. A July 2026 survey of the decisions by Baker Donelson shows courts dividing, and the divide is instructive. In Morgan v. V2X, the court extended work-product protection to a self-represented litigant’s AI use, holding that routing information through a third-party system “does not eliminate all expectations of privacy,” but ordered him to name the AI platforms that had received confidential information. In Tate Group Automotive v. Legacy Automotive Capital, a Texas court reviewed a party representative’s ChatGPT conversations in camera (privately, by the judge alone), disagreed with Heppner, protected most of the chats, and required the party to identify by Bates number (the page-stamp applied to discovery documents) every discovery document shared with the tool. Tym v. Cerno held that “AI interactions do not automatically compromise work product protections,” and in Assini v. Hayward the court quashed a subpoena to OpenAI for a litigant’s account materials.
Read together, the protective decisions share a set of conditions, and a firm either meets them in advance or argues about them later. The protective order in Morgan permitted AI use with confidential information only where the provider was contractually barred from training on or disclosing inputs and had to delete them on request, a standard the court acknowledged excludes most low-cost or free consumer tools. In Jeffries v. Harcros Chemicals, the court barred uploading even non-confidential discovery materials into open AI tools, citing the difficulty of clawing back data used for training, while allowing closed, secure ones. The protection also has a ceiling: in Conservation Law Foundation v. Shell Oil, the court ordered production of a testifying expert’s prompts, reaffirming that “an expert witness’s methodology is fair ground for discovery.” Every one of these is a trial-level ruling that binds no other court, which is exactly why the conditions, not the holdings, are what a firm can act on.
The ethics rules already describe the control; the discovery cases supply the consequence
None of this should surprise a firm that read its own professional guidance. The American Bar Association’s Formal Opinion 512, issued July 29, 2024, told lawyers to “read and understand the Terms of Use, privacy policy, and related contractual terms” of any generative AI (GAI) tool they use, to determine “whether the [GAI tool] retains information submitted by the lawyer,” and to obtain a client’s informed consent before inputting information relating to the representation into a self-learning tool, consent not satisfied by “merely adding general, boiler-plate provisions to engagement letters.” Heppner is a court applying the same reading of the same terms, a year and a half later, to a document someone wanted to keep.
The exposure is not confined to law firms. Proskauer’s tax group notes that the Heppner court drew on Second Circuit authority about tax advice from an accounting firm, that the accountant privilege under Section 7525 of the Internal Revenue Code does not reach criminal matters, and that counsel-directed AI use under a Kovel arrangement, the structure that brings an accountant or consultant inside the lawyer’s privilege, remains an open question. Their recommendation is to review existing Kovel agreements to cover AI use. Any advisory firm working under them has the same homework.
Our assessment is that the firms that will hold privilege through the next round of decisions share four practices, each with an owner. The general counsel or risk partner keeps a written register of approved AI tools, with each tool’s retention, training and deletion terms on file, so the firm can produce the contract the day a court asks. The managing partner’s AI policy confines client and matter information to closed tools whose contracts bar training and disclosure and require deletion on request; consumer tools stay off the matter. Engagement partners direct and document AI use in anticipation of litigation, the thread every protective decision shares. Litigation teams raise AI terms at the protective-order stage, before either side has uploaded anything. A quarter is enough time to put all four in place.
A court will not ask how badly the firm wanted its drafts protected. It will ask where they were created, on what terms, and at whose direction, and the vendor’s retention policy will be an exhibit. The firms that keep work product out of an adversary’s hands are deciding now which tools hold it and under what contract. The firms that leave it to the privacy policy have already let someone else decide.