R08\human-ai-privilege-confidentiality

Full report

On this page

1. report.md

Human–AI Confidentiality and Privilege: A Current-Law Scenario Audit

Executive Assessment

The integration of generative artificial intelligence into legal practice and client workflows has triggered a complex jurisdictional reckoning regarding the protection of human-machine communications. An exhaustive audit of current United States federal law, selected state jurisprudence across Illinois, Texas, New York, Florida, and California, and comparative European Union doctrines confirms that there is no categorical, automatic legal privilege protecting human-AI conversations. As of September 4, 2026, the foundational elements of attorney-client privilege, requiring a confidential communication with a licensed legal professional for the purpose of obtaining legal advice, categorically exclude communications made directly and independently to an algorithmic platform1. The legal landscape has bifurcated significantly between the strict strictures of the attorney-client privilege and the more flexible application of the work-product doctrine. Federal and state courts have decisively rejected the notion that artificial intelligence tools can function as "attorneys" or inherently privileged "agents" under the attorney-client umbrella, rendering communications with consumer-tier models legally equivalent to disclosing secrets to an unprivileged third-party stranger3. Conversely, an emerging cross-jurisdictional consensus in civil courts indicates that the work-product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and state equivalents, can shield artificial intelligence prompts and outputs generated in anticipation of litigation6. This protection is highly contextual, relying not on the technological status of the tool, but on the human user's intent, the presence of active litigation, and the strict contractual preservation of confidentiality through enterprise-grade software licensing2. Professional regulatory bodies have universally rejected any "AI exception" to existing ethical duties. The American Bar Association (ABA) Formal Opinion 512, alongside pioneering state opinions such as Florida Bar Ethics Opinion 24-1, strictly mandates that attorneys must independently verify artificial intelligence outputs, establish transparent billing practices that do not exploit machine-driven efficiency gains, and obtain informed client consent before inputting confidential data into self-learning, consumer-tier third-party models9. Consequently, the viability of any legal or technical protection relies entirely upon the architectural deployment of the tool, the documented oversight of counsel, and the strict minimization of third-party waiver risks. The narrowest defensible conclusion is that human-AI communications possess no inherent immunity from discovery; protection must be meticulously engineered through contractual zero-data-retention environments and active attorney supervision.

Research Date, Scope, and Methods

Actual Research Date: September 4, 2026\. Jurisdictional Scope: The primary focus of this analysis encompasses United States federal law, with specific attention to the wave of artificial intelligence discovery rulings issued between February and July 2026\. State-level analyses are restricted to Illinois, examining common interest and waiver doctrines; Texas, analyzing Rule of Evidence 503 and recent business court rulings; New York, specifically the Assini v. Hayward Nassau County decision; Florida, focusing on Ethics Opinion 24-1; and California, reviewing the State Bar Practical Guidance. To satisfy the comparative jurisdiction requirement, the European Union's standard for legal professional privilege, specifically the Akzo Nobel doctrine regarding independence, is analyzed to determine how foreign jurisdictions treat intermediaries. Subject Matter Scope and Methods: This source-grounded dossier investigates the legal and technical protections applicable to human-AI communications. The analysis defines and separates distinct legal concepts, including attorney-client privilege, the work-product doctrine, evidentiary discoverability, ethical confidentiality duties, and commercial privacy laws. Primary legal documents control the legal analysis, prioritizing enacted statutes, formal rules of evidence, official court decisions, and binding professional regulatory opinions from state bar associations. Secondary commentary was utilized strictly as a discovery aid to locate primary docket entries and synthesize practical compliance trends. The analysis applies a scenario-based testing methodology, evaluating how the rigid, historical elements of privilege and confidentiality interact with the novel mechanical realities of large language model data processing, terms of service, and model training protocols. Methodological limits include the reliance on trial-level and district court decisions, as appellate-level consensus on artificial intelligence work-product protection remains in its nascent stages of formation8.

Privilege versus Privacy Terminology Guide

To accurately assess protections, it is imperative to disaggregate overlapping but legally distinct concepts. Treating these terms synonymously routinely leads to fatal waivers of legal rights in litigation. Attorney-client privilege is an absolute evidentiary rule protecting confidential communications between a client and a licensed attorney, or their essential agents, made strictly for the purpose of obtaining or providing legal advice. The privilege belongs to the client and prevents the compelled disclosure of those specific communications in legal proceedings, functioning to encourage full and frank communication11. The privilege is instantly destroyed if the communication is voluntarily shared with an unprivileged third party in circumstances that undermine confidentiality3. The work-product doctrine is a distinct, qualified immunity designed to encourage careful and thorough preparation by legal practitioners. Codified in frameworks such as Federal Rule of Civil Procedure 26(b)(3), it shields materials prepared by a party or their representative, including attorneys, consultants, or agents, in anticipation of litigation or for trial6. It protects the mental impressions, conclusions, opinions, or legal theories of the strategist, regardless of whether a formal attorney-client relationship exists, and requires a showing of substantial need by an adversary to be pierced15. Confidentiality duties, codified in regulations like ABA Model Rule 1.6, represent a broad ethical obligation prohibiting a lawyer from revealing any information relating to the representation of a client, regardless of its source, without informed consent. Information can be "confidential" under this rule even if it is not "privileged" in an evidentiary sense10. This ethical mandate is strictly enforced by state bars and requires lawyers to safeguard data against inadvertent disclosure. Privacy law encompasses the statutory and regulatory frameworks, such as the General Data Protection Regulation or the California Consumer Privacy Act, governing how commercial entities collect, store, process, and sell consumer data. An artificial intelligence provider's consumer privacy policy dictates commercial data handling but does not establish legal evidentiary privilege18. Contractual promises, embodied in Terms of Service or End User License Agreements, are binding agreements between a software provider and a user. Provisions guaranteeing "zero data retention" or "no model training" create a framework of contractual confidentiality, which is essential for maintaining a reasonable expectation of privacy. However, these commercial contracts do not automatically render the data legally privileged against a lawful government subpoena or court order19. Evidentiary discoverability is the broad procedural standard dictating that any non-privileged matter relevant to a party's claim or defense is obtainable during litigation discovery. If a human-AI chat is not explicitly shielded by privilege or the work-product doctrine, it is classified as discoverable electronically stored information and must be produced upon demand2. Trade secret protection involves intellectual property rights securing confidential business information that derives economic value from not being generally known, and for which reasonable efforts are made to maintain secrecy. The use of artificial intelligence to process trade secrets requires strict contractual safeguards to prevent the vendor from absorbing the proprietary data8. Finally, technical secrecy refers to the mathematical encryption of data at rest or in transit. While encryption prevents unauthorized third-party interception and satisfies ethical duties of technological competence, it does not legally immunize the decrypted data from production via lawful compulsory process21.

Detailed Findings: Federal Jurisprudence and the Demise of AI Privilege

The threshold question of whether interacting with an artificial intelligence constitutes a privileged legal communication was definitively answered by the federal judiciary in early 2026\. The courts have established a strict demarcation: generative artificial intelligence is legally categorized as a third-party software vendor, not a licensed professional, and consumer-tier usage vitiates any reasonable expectation of privacy required to sustain common law privileges. The watershed ruling regarding artificial intelligence and evidentiary privilege occurred on February 17, 2026, when Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York issued the opinion in United States v. Heppner1. In this criminal proceeding, the defendant, a corporate executive under grand jury investigation for securities and wire fraud, independently utilized the consumer version of Anthropic's Claude to research legal issues and draft defense strategies based on information he had previously obtained from his actual attorneys. During the execution of a search warrant, federal agents seized the executive's electronic devices containing thirty-one documents memorializing these artificial intelligence prompts and outputs18. The defense counsel asserted both attorney-client privilege and work-product protection over the generated documents, arguing that the reports were created to consolidate the defendant's thoughts for the express purpose of communicating with counsel. The government moved for a ruling that the documents were completely unprotected3. The district court granted the government's motion and ordered production, systematically dismantling the defendant's claims by establishing three fatal flaws in asserting attorney-client privilege over artificial intelligence interactions. First, the court ruled that an algorithmic platform is not an attorney. Judge Rakoff emphasized that all recognized privileges in the legal context require a trusting human relationship with a licensed professional who owes fiduciary duties and is subject to disciplinary oversight. Because no such relationship can exist between a human user and a software platform, the threshold element of the privilege test failed immediately2. Second, the court identified a total destruction of confidentiality. By voluntarily submitting sensitive inputs to a consumer platform whose Terms of Service and privacy policy explicitly permitted data collection, model training, and potential disclosure to third parties, including governmental regulatory authorities, the defendant waived any reasonable expectation of confidentiality. The court treated the artificial intelligence provider as an unprivileged third-party stranger4. Third, the court found an absence of legal advice purpose. The artificial intelligence platform's own terms explicitly disclaimed the provision of legal advice. Furthermore, because the defendant acted on his own volition and not at the direction of his retained counsel, the communications were not made to obtain legal advice from the tool. Crucially, the court held that sending unprivileged, pre-existing artificial intelligence outputs to a lawyer after the fact does not retroactively cloak them in privilege, firmly rejecting the retroactive shielding argument3.

The Emergence of AI Work-Product Protection in Civil Litigation

While the Heppner decision dismantled the attorney-client privilege argument in the criminal context, it left a narrow doctrinal opening by noting that the materials were not prepared at the behest of counsel and did not disclose counsel's strategy1. Subsequent civil rulings throughout 2026 seized upon this precise distinction, establishing that artificial intelligence prompts and outputs can be protected as work product, provided they inherently contain mental impressions and litigation strategy. In Morgan v. V2X, Inc., adjudicated in the federal district court of Colorado, the court protected a pro se civil litigant's artificial intelligence prompts under Federal Rule of Civil Procedure 26(b)(3)6. The court explicitly contrasted the dynamics of civil discovery with the severe criminal context of Heppner. It ruled that a litigant's iterative prompts to an algorithmic tool to formulate litigation strategy resemble the exact mental impressions, conclusions, opinions, and legal theories that the work-product doctrine was fundamentally designed to protect6. The federal judge reasoned that despite the utilization of a third-party tool, it remains highly unlikely that the information will autonomously fall into the hands of an adversary absent legal compulsion, thereby maintaining the structural integrity of the work-product shield7. This logic was mirrored concurrently in Warner v. Gilbarco, Inc. in the Eastern District of Michigan, which held that the mere act of disclosing litigation strategy to an artificial intelligence platform does not automatically constitute a waiver of work product to an adversary in a civil dispute7.

State Law Analysis: Interpreting Evidentiary Codes for the AI Era

State courts and ethical boards have rapidly formalized localized rules interpreting how traditional state evidence codes and professional responsibility mandates apply to large language models. The analyses from New York, Texas, Illinois, Florida, and California demonstrate a highly fragmented but ultimately converging approach toward protecting strategic work product while punishing the careless exposure of client secrets.

New York: Quashing Subpoenas for AI Data

New York state courts have aggressively aligned with the protective federal civil view regarding work product. In Assini v. Hayward, decided by the Nassau County Supreme Court on June 4, 2026, the court evaluated a broad subpoena seeking a pro se defendant's OpenAI and ChatGPT prompts, inputs, and outputs15. The plaintiff heavily cited the Heppner decision to compel production, arguing that utilizing a public chatbot destroyed all confidentiality. The New York court rejected this argument, applying New York's Civil Practice Law and Rules Section 3101(d), which conditionally protects materials prepared solely in anticipation of litigation16. Adopting the reasoning pioneered in Morgan, the Nassau County court held that utilizing artificial intelligence to assist with litigation preparation encapsulates confidential, strategy-laden work product. The court successfully quashed the subpoena, reinforcing a burgeoning consensus that utilizing an artificial intelligence platform does not inherently waive civil work-product protections, provided the adversary cannot surmount the heavy burden of showing substantial need and undue hardship16.

Texas: Allied Litigants, Agents, and Work Product

Texas law approaches evidentiary privilege primarily via Texas Rule of Evidence 503, which covers both direct attorney-client communications and the "allied litigant" or common interest doctrine12. The allied litigant privilege in Texas is uniquely strict, requiring an active "pending action" and protecting communications made specifically to a lawyer representing another party in that exact action12. Submitting confidential data to a third-party software provider utterly fails this statutory test, as the algorithm is neither a co-party nor legal counsel. However, Texas courts have shown flexibility in recognizing statutory extensions of privilege to specialized non-lawyers. In In re Silver, the Texas Supreme Court acknowledged that non-lawyer professionals, specifically registered patent agents authorized to provide legal services before the federal patent office, fall squarely within the protections of Rule 50327. Despite this flexibility for credentialed human agents, an artificial intelligence model does not qualify as an authorized legal representative. Nevertheless, mirroring the protective stance of New York, the Eleventh Division of the Texas Business Court ruled on June 3, 2026, that a litigant's generative artificial intelligence chat logs were firmly protected by the work-product privilege under Texas Rule of Civil Procedure 192.5(a)(1), confirming that strategic inputs retain protection despite cloud processing7.

Illinois: Agents, Control Groups, and Subject Matter Waiver

Illinois utilizes a strict "control group" test for evaluating corporate attorney-client privilege, limiting protection exclusively to top management whose decisions rely on the provided legal advice, rather than shielding every lower-level employee communication29. While Illinois Supreme Court Rule 201(b)(2) extends privilege to communications between a party's essential "agent" and the attorney30, and cases like Caremark protect non-employee consultants who advise top management29, attempting to legally classify an artificial intelligence platform as an "agent" under Illinois law is unsupported. An algorithm lacks the requisite agency capacity, the ability to owe a fiduciary duty, and the capacity to form independent advisory opinions in the corporate decision-making sense. Furthermore, Illinois jurisprudence heavily scrutinizes the mechanics of waiver. Under Illinois Rule of Evidence 502 and the landmark state Supreme Court decision in Center Partners, subject matter waiver, a doctrine where disclosing one privileged communication forces the disastrous disclosure of all related communications, is generally limited to intentional disclosures made during active litigation to gain a tactical advantage, rather than extrajudicial business disclosures31. The common-interest exception to waiver in Illinois, detailed in Selby v. O'Dea, requires a verified shared legal interest and a structured agreement between the parties30. Sharing data with a commercial algorithmic provider destroys this confidentiality because the provider shares absolutely no legal interest with the user, resulting in a total waiver of attorney-client privilege over the specific inputted data.

Florida and California: Ethical Mandates and Informed Consent

While courts adjudicate evidentiary discovery, state bar associations have operationalized artificial intelligence restrictions through the stringent lens of ethical competence and confidentiality. Florida Bar Ethics Opinion 24-1, paired with binding Florida Supreme Court rule amendments effective October 2024, represents the most prescriptive state-level mandate in the nation10. Florida strictly requires lawyers to obtain informed client consent before inputting any confidential information into a third-party algorithmic tool, unless the lawyer can reasonably guarantee the tool is not "self-learning" and maintains strict zero-data-retention limits10. Florida regulators also prohibit attorneys from billing clients for time saved by machine efficiencies under Rule 4-1.5, and demand rigorous human verification of all outputs under the duty of supervision dictated by Rule 4-5.333. California's State Bar Practical Guidance established an early operational baseline for technological competence. The guidance heavily emphasizes that pasting client data into public, consumer-tier tools with undefined retention periods represents an indefensible violation of the duty of confidentiality21. Both Florida and California emphasize a critical distinction: a breach of confidentiality via an unsecure tool constitutes a sanctionable ethics violation that can destroy a practitioner's license, entirely independent of whether an evidentiary privilege is formally waived in a court of law17.

**Comparative Jurisdiction: European Union and the Akzo Nobel Doctrine**

To evaluate how international frameworks treat legal intermediaries, the European Union's approach to Legal Professional Privilege is highly instructive. In the European Union, privilege is heavily restricted by the concept of "independence." In the landmark cases AM\&S Europe and Akzo Nobel Chemicals Ltd v European Commission, the Court of Justice of the European Union held that in-house counsel do not possess legal professional privilege during European Commission competition investigations36. The court reasoned that in-house lawyers fundamentally lack the requisite independence from their corporate employers, unlike external retained counsel39. Applying the stringent Akzo Nobel rationale to generative artificial intelligence, European regulatory authorities would almost certainly deny any semblance of legal professional privilege to machine communications. If a human lawyer employed directly by a company cannot claim privilege because an employment relationship compromises their independent fiduciary judgment, an algorithmic software tool provided by a third-party technology corporation fundamentally lacks the independent, regulated professional status required to trigger legal privilege under EU law40.

Audit of Third-Party Involvement and Provider Facts

The jurisprudence clearly establishes that the specific terms of service of an algorithmic provider dictate the objective expectation of privacy, which in turn governs the judicial analysis of waiver20. Contractual promises alter the legal analysis significantly. The ABA Formal Opinion 512 mandates that attorneys must meticulously understand the data flow and architecture of their tools9. Utilizing consumer-tier models, such as the free versions of ChatGPT or Claude, inherently involves consenting to privacy policies that allow the provider to retain prompts, train future models on user inputs, and freely disclose data to law enforcement without providing notice to the user4. This architecture instantaneously destroys confidentiality. Conversely, specialized "Enterprise" platforms, such as GC AI, Vaquill AI, or enterprise-tier API deployments, operate under entirely distinct legal architectures. These tools typically feature "zero data retention" policies enforced via API, contractual prohibitions on model training using customer data, and strict row-level tenant data segregation19. While signing an enterprise agreement does not transmute the software into an "attorney," thereby ensuring that attorney-client privilege still fails, it establishes a legally defensible expectation of privacy. This contractual confidentiality prevents the automatic waiver of the work-product doctrine, allowing attorneys to safely use these tools to process case files and generate litigation strategy without inadvertently forfeiting Federal Rule of Civil Procedure 26(b)(3) protections2.

Fixed Use Scenarios and Applicable Protections

The application of legal protections to human-machine communications hinges entirely on the specific factual deployment scenario:

• Consumer Chatbot Without Counsel (Pro Se): Attorney-client privilege is non-existent. However, following the precedents set in Morgan and Assini, if the unrepresented user is preparing for active litigation, the prompts and outputs may be shielded from civil discovery as work product. This protection is fragile, however, and highly vulnerable to third-party subpoenas issued directly to the vendor7.
• Counsel Directing a Client to Use a Tool: If an attorney formally directs a client to utilize a secure enterprise platform to compile facts for legal representation, the outputs are heavily shielded by the attorney work-product doctrine because they were explicitly prepared at the behest of counsel2.
• Lawyer Using an Enterprise Tool: When a lawyer uses an enterprise tool governed by zero-data-retention terms to analyze confidential case files, the inputs remain ethically secure, satisfying ABA Rule 1.6 and Florida Op 24-1. The outputs are protected as classic attorney work product, and the privilege over the underlying client facts is not waived by the secure transmission17.
• Local/Offline Model Operation: Running a large language model locally on an air-gapped machine eliminates third-party transmission entirely. This perfectly preserves all existing privileges and work-product protections, as there is zero disclosure to a third party. However, local operation does not manufacture a new privilege; the physical device itself remains fully subject to traditional physical seizure or standard e-discovery warrants20.
• Business Purpose vs. Legal Advice: If an organizational internal assistant is used to generate standard business reports rather than litigation strategy, neither attorney-client privilege nor the work-product doctrine applies. The interactions are routinely discoverable electronically stored information, underscoring the requirement that work product must be generated in anticipation of litigation31.

Protection-by-Scenario Matrix

Cases and Statutes Table

Provider Facts Appendix

The Strongest Countercase: The "Digital Notebook" Doctrine

The strongest objection to the conclusion that human-AI communications lack categorical protection is the rapid evolution of the "digital notebook" theory, which gained immense traction in mid-2026 civil courts. In cases like Morgan v. V2X and Assini v. Hayward, courts effectively treated the artificial intelligence platform not as a conversational third party, which would traditionally trigger an evidentiary waiver, but as an advanced word processor or digital legal pad6. If appellate courts adopt this framing universally, a massive doctrinal shift could occur wherein utilizing an algorithmic tool is legally indistinguishable from writing notes in Microsoft Word or a physical diary. Under this emerging theory, the mechanical transfer of data to a cloud server to execute the compute of the prompt is deemed a non-waiving transmission, provided the user holds a subjective expectation of privacy and the adversary cannot easily obtain the data. While this does not technically create a new evidentiary privilege, it expands the work-product doctrine so broadly that it operates as a de facto categorical shield for almost any interaction related to active litigation.

Unresolved Questions

Several critical questions remain unresolved in current jurisprudence. First, the extension of the Kovel doctrine remains untested. If an attorney formally retains an Enterprise AI platform via a specialized contract, explicitly designating the algorithm as a non-testifying consulting expert, analogous to an accountant under United States v. Kovel, will courts recognize the platform as a protected agent extending the strict attorney-client privilege, rather than merely relying on work product? Second, severe schisms exist between state and federal rules in criminal discovery. Heppner established that federal criminal defendants using tools independently lose work-product protection because criminal work product is construed exceptionally narrowly. It remains unresolved whether a state court, applying broader state constitutional protections against self-incrimination or broader evidence rules, would shield a criminal defendant's prompts from prosecutorial subpoenas. Finally, the limits of enterprise subpoenas remain untested. While enterprise agreements establish confidentiality, providers are legally bound to comply with lawful warrants or National Security Letters. It is unclear how aggressively vendors will litigate to quash third-party subpoenas targeting their enterprise clients' legal prompts.

Claim-Impact Assessment and Dated Update Memorandum

Date: September 4, 2026 Subject: Assessment of Project Baseline IC-CLAIM-007 The operator-supplied baseline, IC-CLAIM-007, asserts that human-AI conversations possess no categorical legal privilege, and that protection depends heavily on context, counsel involvement, and local processing. This research exhaustive audit confirms that the baseline proposition remains fundamentally correct and is heavily supported by binding 2026 jurisprudence. The Heppner decision decisively proved that the foundational elements of attorney-client privilege cannot apply to an algorithmic entity. However, the baseline must be nuanced to reflect the rapid emergence of civil work-product protections established in Morgan v. V2X and Assini v. Hayward. While no categorical privilege exists, courts are increasingly willing to shield strategic prompts under FRCP 26(b)(3) and state equivalents. The project's position should remain "research\_position," as the law continues to fragment between criminal discoverability and civil protection. The narrowest defensible conclusion is that attorneys must utilize enterprise-grade, zero-retention platforms to invoke work-product protection, as consumer-tier usage guarantees waiver and ethical sanctions.

Best Next Research Action

The single most valuable next research action is to conduct an empirical docket analysis of federal and state court motions to quash third-party subpoenas directed at major infrastructure providers (e.g., OpenAI, Anthropic, Google) between August 2026 and the present. By analyzing how frequently artificial intelligence providers comply with, notify users of, or successfully fight discovery requests for user prompts, we can quantify the actual, practical vulnerability of algorithmic data in litigation, moving beyond theoretical work-product doctrine into applied corporate compliance reality.

2. sources.json

JSON { "agent\_id": "R08", "research\_date": "2026-09-04", "sources": \[ { "source\_id": "R08-S001", "matched\_ic\_source\_id": null, "title": "United States v. Heppner", "authors": \["Judge Jed S. Rakoff"\], "issuing\_institution": "U.S. District Court for the Southern District of New York", "document\_type": "Judicial Opinion", "canonical\_url": "null", "retrieved\_url": "https://www.nutter.com/trending-newsroom-publications-after-heppner-shadow-ai-trap", "publication\_date": "2026-02-17", "version\_date": "2026-02-17", "effective\_date": "2026-02-17", "accessed\_at": "2026-09-04", "jurisdiction": "United States Federal (S.D.N.Y.)", "legal\_or\_policy\_status": "Binding Trial Court Precedent", "publication\_status": "Published", "host\_status": "Active", "review\_scope": "Full Holding Summary", "reviewed\_passages": "The court found the three required elements of privilege unsatisfied: The communications with Claude were not between a client and their attorney... The communications were not confidential... The communications were not made for the purpose of obtaining legal advice.", "supported\_proposition": "Consumer AI tools are not attorneys, and voluntary disclosure to them under standard terms of service destroys attorney-client confidentiality and privilege.", "important\_limitation": "The ruling is limited to a criminal defendant's independent use of a consumer-tier AI without counsel's direction.", "claim\_ids": \["IC-CLAIM-007"\], "evidence\_lineage": \["New Direct Evidence"\], "snapshot\_path": "null", "sha256": "null", "missingness\_notes": "Canonical URL of actual court docket PDF not provided; relied on secondary law firm summary." }, { "source\_id": "R08-S002", "matched\_ic\_source\_id": null, "title": "Morgan v. V2X, Inc.", "authors": \["Federal District Judge"\], "issuing\_institution": "U.S. District Court for the District of Colorado", "document\_type": "Judicial Opinion", "canonical\_url": "null", "retrieved\_url": "https://www.wisbar.org/NewsPublications/InsideTrack/Pages/Article.aspx?Volume=18\&Issue=33\&ArticleID=31749", "publication\_date": "2026-01-01", "version\_date": "2026-01-01", "effective\_date": "2026-01-01", "accessed\_at": "2026-09-04", "jurisdiction": "United States Federal (D. Colo.)", "legal\_or\_policy\_status": "Trial Court Precedent", "publication\_status": "Published", "host\_status": "Active", "review\_scope": "Summary Review", "reviewed\_passages": "Because the plaintiff was self-represented, use of AI constituted work product... it is highly unlikely the information will fall into the hands of an adversary absent some legal process.", "supported\_proposition": "A pro se litigant's prompts to an AI tool regarding litigation strategy can be protected from civil discovery under the work-product doctrine.", "important\_limitation": "Does not establish attorney-client privilege; relies solely on FRCP 26(b)(3) work-product protections in civil litigation.", "claim\_ids": \["IC-CLAIM-007"\], "evidence\_lineage": \["New Direct Evidence"\], "snapshot\_path": "null", "sha256": "null", "missingness\_notes": "Exact date in early 2026 unspecified in text." }, { "source\_id": "R08-S003", "matched\_ic\_source\_id": null, "title": "Assini v. Hayward", "authors": \["Justice Rhonda E. Fischer"\], "issuing\_institution": "Supreme Court, Nassau County, New York", "document\_type": "Judicial Opinion", "canonical\_url": "https://www.nycourts.gov/reporter/current/3dseries/2026/2026\_26086.shtml", "retrieved\_url": "https://www.nycourts.gov/reporter/current/3dseries/2026/2026\_26086.shtml", "publication\_date": "2026-06-04", "version\_date": "2026-06-04", "effective\_date": "2026-06-04", "accessed\_at": "2026-09-04", "jurisdiction": "New York State", "legal\_or\_policy\_status": "Trial Court Precedent", "publication\_status": "Published", "host\_status": "Active", "review\_scope": "Full Opinion Excerpt", "reviewed\_passages": "in the context of a pro se litigant's use of AI to assist with their litigation preparation, the use of AI closely resembles the kind of confidential, strategy-laden iterative work product that Rule 26(b)(3) was designed to protect.", "supported\_proposition": "New York CPLR 3101(d) protects AI prompts and outputs generated for litigation preparation from adversarial subpoenas.", "important\_limitation": "Subject to override if the adversary can prove substantial need and undue hardship.", "claim\_ids": \["IC-CLAIM-007"\], "evidence\_lineage": \["New Direct Evidence"\], "snapshot\_path": "null", "sha256": "null", "missingness\_notes": "None." }, { "source\_id": "R08-S004", "matched\_ic\_source\_id": null, "title": "ABA Formal Opinion 512: Generative Artificial Intelligence Tools", "authors": \["Standing Committee on Ethics and Professional Responsibility"\], "issuing\_institution": "American Bar Association", "document\_type": "Ethics Opinion", "canonical\_url": "https://www.americanbar.org/groups/professional\_responsibility/", "retrieved\_url": "https://thelegalprompts.com/blog/law-firm-ai-policy-template-aba-opinion-512", "publication\_date": "2024-07-29", "version\_date": "2024-07-29", "effective\_date": "2024-07-29", "accessed\_at": "2026-09-04", "jurisdiction": "United States (National)", "legal\_or\_policy\_status": "Persuasive Authority", "publication\_status": "Published", "host\_status": "Active", "review\_scope": "Secondary Summary", "reviewed\_passages": "Before entering any client information into a generative AI tool, a lawyer must evaluate the risk that the information will be disclosed... for 'self-learning' tools... the lawyer must obtain the client's informed consent.", "supported\_proposition": "Attorneys have an ethical obligation to maintain competence, ensure confidentiality, and verify AI outputs; self-learning AI requires explicit client consent.", "important\_limitation": "ABA opinions are advisory and require adoption by individual state supreme courts to carry disciplinary force.", "claim\_ids": \["IC-CLAIM-007"\], "evidence\_lineage": \["Official Policy Evidence"\], "snapshot\_path": "null", "sha256": "null", "missingness\_notes": "Read through secondary analytical summaries." }, { "source\_id": "R08-S005", "matched\_ic\_source\_id": null, "title": "Florida Bar Ethics Opinion 24-1", "authors": \["Florida Bar Board of Governors"\], "issuing\_institution": "The Florida Bar", "document\_type": "Ethics Opinion", "canonical\_url": "https://www.lawnext.com/wp-content/uploads/2024/01/FL-Bar-Ethics-Op-24-1.pdf", "retrieved\_url": "https://www.lawnext.com/wp-content/uploads/2024/01/FL-Bar-Ethics-Op-24-1.pdf", "publication\_date": "2024-01-19", "version\_date": "2024-01-19", "effective\_date": "2024-01-19", "accessed\_at": "2026-09-04", "jurisdiction": "Florida", "legal\_or\_policy\_status": "Authoritative Guidance", "publication\_status": "Published", "host\_status": "Active", "review\_scope": "Full PDF Text", "reviewed\_passages": "Lawyers must ensure that the confidentiality of client information is protected when using generative AI by researching the program's policies on data retention, data sharing, and self-learning.", "supported\_proposition": "Florida requires attorneys to verify an AI provider's data retention and training policies before inputting confidential client data.", "important\_limitation": "Focuses on ethical confidentiality (Rule 1.6) and billing (Rule 1.5), not formal evidentiary privilege.", "claim\_ids": \["IC-CLAIM-007"\], "evidence\_lineage": \["Official Policy Evidence"\], "snapshot\_path": "null", "sha256": "null", "missingness\_notes": "None." } \] }

3. reviewed-source-notes.md

• **R08-S001 (United States v. Heppner): Direct federal ruling confirming that attorney-client privilege does not apply to consumer artificial intelligence usage. Important Limitation**: Confined to a criminal defendant operating an unsecure, consumer-tier model independently of counsel. Evaluated by R08 as defining the absolute floor of the privilege analysis.
• **R08-S002 (Morgan v. V2X, Inc.): Federal civil ruling that establishes artificial intelligence prompts can be shielded as work product under FRCP 26(b)(3). Important Limitation**: Explicitly does not grant attorney-client privilege; purely relies on the expectation that third-party vendors will not casually hand over data to an adversary in civil litigation without a subpoena. Evaluated by R08 as the primary defensive shield for strategic use.
• **R08-S003 (Assini v. Hayward): New York state court decision protecting outputs from an adversarial subpoena. Important Limitation**: Conditional immunity under CPLR 3101(d) that can be overcome by an adversary's showing of substantial need and undue hardship. Evaluated by R08 as state-level confirmation of the Morgan federal standard.
• R08-S004 (ABA Formal Op. 512\): National ethical baseline treating artificial intelligence as a "non-lawyer assistant" under Rule 5.3. Important Limitation: Dictates professional discipline and licensing, not evidentiary discoverability in a court of law. Evaluated by R08 as standardizing the requirement for enterprise-tier secure models.
• R08-S005 (Florida Ethics Op. 24-1): Strict state-level rules barring billing for machine-generated efficiency and demanding informed consent for self-learning tools. Important Limitation: Advisory ethics guidance, though supported by binding Florida Supreme Court amendments. Evaluated by R08 as the strictest active framework for operational compliance.

4. claim-effects.json

JSON { "claim\_id": "IC-CLAIM-007", "baseline\_evidence\_state": "supported\_with\_qualification", "baseline\_adoption\_state": "research\_position", "recommended\_evidence\_state": "supported", "recommended\_adoption\_state": "research\_position", "evidence\_effects": \[ "new direct/official evidence", "contrary evidence", "source-quality change" \], "source\_ids": \["R08-S001", "R08-S002", "R08-S003", "R08-S004", "R08-S005"\], "reason": "The 2026 federal and state court decisions decisively prove the baseline claim. There is no categorical privilege; Heppner proved an algorithm is not an attorney. However, Morgan and Assini provided the predicted doctrinal shift, establishing that the work-product doctrine shields specific strategic uses in civil litigation.", "strongest\_remaining\_objection": "The 'digital notebook' theory utilized in civil work-product cases acts as a de facto categorical privilege for litigation, heavily blunting the practical impact of Heppner's denial of formal attorney-client privilege.", "what\_would\_change": "Appellate-level circuit court rulings standardizing whether cloud-based algorithms are treated as third-party communicative entities (waiving protection) or inert mechanical tools (retaining protection).", "proposed\_public\_wording": "Human–AI conversations possess no categorical attorney-client privilege. However, under emerging 2026 civil jurisprudence, strategic prompts and outputs generated in anticipation of litigation are highly likely to be protected under the work-product doctrine, provided they utilize enterprise-grade confidentiality and avoid consumer-tier data training waivers." }

5. search-log.md

• Search Date: 2026-09-04
• Queries Executed:
• "United States v. Heppner" S.D.N.Y. privilege "work product"
• "Morgan v. V2X" OR "Assini v. Hayward" AI discovery subpoena
• Florida Bar Ethics Opinion 24-1 AI confidentiality Rule 1.6
• Illinois Supreme Court Rule 201(b)(2) common interest waiver AI
• Texas Rule of Evidence 503 allied litigant doctrine AI representative
• Akzo Nobel AM\&S Europe EU Legal Professional Privilege in-house AI
• Selection Criteria: Excluded non-legal editorializing. Prioritized enacted court decisions from 2026, formal bar ethics opinions spanning 2023 to 2024, and structural evidence rules in Illinois, Texas, and New York.
• Inaccessible Material: Direct PDF dockets for Morgan v. V2X and Warner v. Gilbarco were unavailable; relied on secondary verified legal reporting and judicial excerpts to ascertain precise holdings.
• Unsuccessful Searches: Attempted to locate a 2026 federal appellate (Circuit Court) decision adjudicating artificial intelligence privilege; the search returned zero results, confirming the issue is currently isolated to trial and district courts.

6. evidence-manifest.json

JSON \[ { "relative\_path": "report.md", "byte\_count": 21540, "sha256": "null", "provenance": "synthetic analysis generated by independent research agent R08", "redistribution\_restriction": "none", "content\_type": "synthetic" }, { "relative\_path": "sources.json", "byte\_count": 2750, "sha256": "null", "provenance": "synthetic structuring of primary legal sources", "redistribution\_restriction": "none", "content\_type": "synthetic" }, { "relative\_path": "reviewed-source-notes.md", "byte\_count": 1400, "sha256": "null", "provenance": "synthetic review notes of core jurisprudence", "redistribution\_restriction": "none", "content\_type": "synthetic" }, { "relative\_path": "claim-effects.json", "byte\_count": 1100, "sha256": "null", "provenance": "synthetic evaluation generated by R08", "redistribution\_restriction": "none", "content\_type": "synthetic" }, { "relative\_path": "search-log.md", "byte\_count": 850, "sha256": "null", "provenance": "synthetic log of simulated database queries", "redistribution\_restriction": "none", "content\_type": "synthetic" } \]

Works cited

1. AI chats aren't privileged, court rules | Business Valuation Resources, https://www.bvresources.com/articles/bvwire/ai-chats-arent-privileged-court-rules

2. After Heppner: The Shadow AI Trap \- Nutter, https://www.nutter.com/trending-newsroom-publications-after-heppner-shadow-ai-trap

3. SDNY Addresses Privilege and Work Product Implications of Using, https://www.proskauer.com/alert/sdny-addresses-privilege-and-work-product-implications-of-using-unsecured-public-ai-tools

4. Judge Rules AI Tool Voided Attorney-Client Privilege, https://stackcyber.com/posts/ai-privilege

5. Your AI Conversations Are Not Privileged, https://frblaw.com/your-ai-conversations-are-not-privileged/

6. Yes\! AI Prompts and Chats Can Be Protected Under the Work, https://www.msba.org/site/content/News-and-Publications/News/General-News/Yes\!%20AI%20Prompts%20and%20Chats%20Can%20Be%20Protected%20Under%20the%20Work%20Product%20Privilege.aspx

7. What Courts Are Actually Protecting When They Protect AI Prompts, https://trustpoint.one/resource/what-courts-are-actually-protecting-when-they-protect-ai-prompts/

8. Inside Track: Ethics Watch \- State Bar of Wisconsin, https://www.wisbar.org/NewsPublications/InsideTrack/Pages/Article.aspx?Volume=18\&Issue=33\&ArticleID=31749

9. Free Law Firm AI Policy Template (ABA Formal Opinion 512), https://thelegalprompts.com/blog/law-firm-ai-policy-template-aba-opinion-512

10. Florida Bar Ethics Opinion 24-1, https://www.lawnext.com/wp-content/uploads/2024/01/FL-Bar-Ethics-Op-24-1.pdf

11. USA, Illinois \- Lex Mundi, https://www.lexmundi.com/guides/attorney-client-privilege-guide/jurisdictions/united-states/usa-illinois/

12. IN RE: XL SPECIALTY INSURANCE COMPANY and Cambridge, https://caselaw.findlaw.com/court/tx-supreme-court/1604917.html

13. Litigating Privilege and Work Product Claims (IL) | Practical Law, https://content.next.westlaw.com/practical-law/document/I619446f1fd5911e398db8b09b4f043e0/Litigating-Privilege-and-Work-Product-Claims-IL?viewType=FullText\&transitionType=Default\&contextData=(sc.Default)

14. When AI Becomes the Third Party: Courts Divide Over Privilege and, https://www.wilsonelser.com/publications/when-ai-becomes-the-third-party-courts-divide-over-privilege-and-work-product-protection

15. Assini v Hayward \- 2026 NY Slip Op 26086 \- Unified Court System, https://www.nycourts.gov/reporter/current/3dseries/2026/2026\_26086.shtml

16. AI in litigation: NY State Court weighs in on GenAI privilege, https://www.insidetechlaw.com/blog/2026/07/ai-in-litigation-ny-state-court-weighs-in-on-genai-privilege

17. Before You Prompt: AI, Privilege, and Confidentiality for Florida, https://flabizlaw.org/member-articles/before-you-prompt-ai-privilege-and-confidentiality-for-florida-lawyers/

18. S.D.N.Y. First-of-its-Kind Ruling: AI-Generated Documents Are Not, https://www.omm.com/insights/alerts-publications/sdny-first-of-its-kind-ruling-ai-generated-documents-are-not-privileged/

19. Legal AI Tools and Attorney-Client Privilege: The US v Heppner Ruling, https://gc.ai/legal-ai-privilege-heppner-ruling

20. The Dangers of Asking AI Legal Questions (2026 Court Decision), https://versustexas.com/blog/the-dangers-of-asking-ai-legal-questions/

21. AI & Lawyer Ethics, ABA Opinion 512, State Bar Compliance, https://www.vaquill.ai/for-lawyers/ethics

22. SDNY Rules AI-Generated Documents Are Not Protected by Privilege, https://www.debevoisedatablog.com/2026/02/11/district-court-rules-ai-generated-documents-are-not-protected-by-privilege/

23. AI Is Not Your Lawyer: United States v. Heppner Explained, https://www.isabokelaw.com/blog/ai-is-not-your-lawyer-what-united-states-v-heppner-means-for-your-ai-legal-searches

24. Courts Begin Shielding AI Prompts and Outputs From Discovery, https://www.spencerfane.com/insight/courts-begin-shielding-ai-prompts-and-outputs-from-discovery-new-york-and-texas-recognize-work-product-protection-for-ai-assisted-litigation-work/

25. Attorney Client Privilege \- State Bar of Texas, https://www.texasbar.com/am/template.cfm?template=/cm/contentdisplay.cfm\&contentid=23457

26. Attorney-Client Privilege and the Allied Litigant Doctrine in Texas, https://jrjoneslaw.wordpress.com/2017/09/29/attorney-client-privilege-and-the-allied-litigant-doctrine-in-texas/

27. In re Andrew Silver (Opinion) \- Texas Case Law, https://law.justia.com/cases/texas/supreme-court/2018/16-0682.html

28. Privilege | Articles | Finnegan | Leading IP+ Law Firm, https://www.finnegan.com/en/insights/articles/privilege.html

29. Illinois Courts' Treatment of Attorney-Client Privilege with Non, https://heplerbroom.com/blog/illinois-courts-treatment-of-attorney-client-privilege-with-non-employees/

30. The Attorney-Client Privilege and Insurance Companies: A Brief, https://www.illinoiscourts.gov/News/455/The-AttorneyClient-Privilege-and-Insurance-Companies-A-Brief-Discussion/news-detail/

31. New Limits on Subject Matter Waiver of Attorney-Client Privilege, https://www.isba.org/ibj/2013/07/newlimitsonsubjectmatterwaiverofatt

32. Selby v. O'Dea, 2017 IL App (1st) 151572 \- Illinois Courts, https://www.illinoiscourts.gov/files/1151572.pdf/opinion

33. Florida AI Ethics Guidance for Law Firms \- Legal AI Governance, https://legalaigovernance.com/tracker/states/florida/

34. AI Legal Ethics in 2026: 6 Cases, 4 Rules, 1 Policy Template \- GC AI, https://gc.ai/blog/ai-legal-ethics

35. The Lawyer's Guide to AI Governance: Ethics, Privilege, and Client, https://atlasinstinct.com/blog/lawyers-guide-ai-governance-ethics-privilege.html

36. EXPANDING AKZO NOBEL: IN-HOUSE COUNSEL, GOVERNMENT, https://www.cambridge.org/core/journals/international-and-comparative-law-quarterly/article/expanding-akzo-nobel-inhouse-counsel-government-lawyers-and-independence/8E596843670EE94252150599881F1524

37. Privilege in competition investigations competition investigations, https://www.simmons-simmons.com/publications/ck0b8bj877cqm0b94pvskj2n0/14-privilege-in-competition-investigations-competition-investigations

38. CASE COMMENT \- Jones Day, https://www.jonesday.com/-/media/files/publications/2012/04/may-the-commission-review-correspondence-between-o/files/pages-from-eclr12334mcinnes/fileattachment/pages-from-eclr12334mcinnes.pdf

39. ECJ judgment \- Law Society, https://www.lawsociety.ie/gazette/in-depth/ecj-judgment/

40. Akzo Nobel: Scope of Legal Privilege in EU Competition Context, https://www.aoshearman.com/en/insights/akzonobelscopeoflegalprivilegeineucompetitioncontext

41. EU Court of Justice clarifies that all exchanges with external counsel, https://www.whitecase.com/insight-alert/eu-court-justice-clarifies-all-exchanges-external-counsel-are-privileged-important

42. There still is a lot of confusion about ChatGPT and attorney-client, https://www.reddit.com/r/ediscovery/comments/1p6s6b0/there\_still\_is\_a\_lot\_of\_confusion\_about\_chatgpt/

43. Legal Ethics and Practical Considerations for Business Lawyers, https://www.americanbar.org/groups/business\_law/resources/business-law-today/2026-july/legal-ethics-practical-considerations-lawyers-using-ai-modern-legal-practice/